Central authority service device, authority management method, device, equipment and medium

Abstract

The present disclosure provides a central authority service device, authority management method, device, equipment, and medium, relating to the field of computer security technology. In some embodiments of the present disclosure, the central authority service device includes: a core platform layer and an authentication component layer; the central platform layer includes: a user management module, a user group management module, a project management module, a authority management module, a log management module, and a policy engine module; the user management module is used to manage user information of the central authority management platform; the present disclosure changes the decentralized management model, realizes the centralization and systematization of authority management and authentication, thereby improving the efficiency of authority management, improving system security, and improving operation and maintenance efficiency.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and in particular to a central authority service device, authority management method, device, equipment and medium. Background Art

[0002] With the continuous development of information technology and the deepening of enterprise digital transformation, enterprises generally deploy multiple business platforms in their daily operations to support diverse business needs. To ensure data security and access control across these platforms, permission management systems have become an indispensable core component. Traditional permission management often adopts a decentralized architecture, with each business platform maintaining its own independent permission system. This leads to increasingly prominent problems such as difficulty in unifying permission policies, difficulty in tracking permission changes, and inconsistent authentication interfaces. Therefore, how to achieve centralized management and dynamic control of permissions across multiple business platforms has become a key research direction in the current development of enterprise IT systems.

[0003] In existing technologies, common permission management models include role-based access control (RBAC) and discretionary access control (DAC). For example, a large enterprise's resource management platform uses the RBAC model, categorizing users into roles such as regular users, merchants, and administrators, and assigning corresponding operational permissions to each role. Its cloud platform, on the other hand, uses the DAC model, allowing resource owners to independently determine who can access their resources. This permission information is typically stored in each platform's own database or configuration files, lacking unified standards and centralized management mechanisms. Furthermore, authentication interfaces vary significantly between platforms, requiring developers to adapt them individually for each platform, increasing development and maintenance costs.

[0004] Currently, the efficiency of authority management is low, the system security is low, and the operation and maintenance efficiency is low. Summary of the Invention

[0005] The present disclosure provides a central authority service device, authority management method, device, equipment and medium to at least solve the problems of low authority management efficiency, low system security and low operation and maintenance efficiency.

[0006] According to a first aspect of the present disclosure, there is provided a central authority service device, comprising: a central platform layer and an authentication component layer;

[0007] The central platform layer includes: a user management module, a user group management module, a project management module, a rights management module, a log management module and a policy engine module; the user management module is used to manage user information of the central rights management platform; the user group management module is used to manage user group information of the central rights management platform; the project management module is used to centrally manage the metadata information and rights files of the project and has a version control function; the rights management module is used to edit the rights files and identify the rights codes that users can access through a unified authentication component; the log management module is used to record operation logs related to rights; the policy engine module is used to parse and execute rights policy generation;

[0008] The authentication component layer includes: a standardized software development toolkit module, a real-time authentication interface module and a cache management module; the standardized software development toolkit module is used to provide multiple programming language interfaces for the business platform to call the authentication function; the real-time authentication interface module is used to process user authentication requests; and the cache management module is used to manage the life cycle of the local cache.

[0009] According to a second aspect of the present disclosure, a rights management method is provided, comprising:

[0010] After the business platform is deployed, the encrypted activation code carrying metadata information and current attribute information is sent to the central authority service device;

[0011] The central authority service device parses the encrypted activation code, matches the corresponding authority file, generates an authority policy, and returns authority initialization data to the business platform;

[0012] The service platform writes the permission initialization data into a local permission database for calling by an authentication software development toolkit.

[0013] According to a third aspect of the present disclosure, there is provided a rights management apparatus, comprising:

[0014] The sending module is used to send the encrypted activation code carrying metadata information and current attribute information to the central authority service device after the business platform is deployed;

[0015] A generation module, configured for the central authority service device to parse the encrypted activation code, match the corresponding authority file, generate an authority policy, and return authority initialization data to the business platform;

[0016] The writing module is used for the business platform to write the permission initialization data into the local permission database for calling by the authentication software development tool kit.

[0017] According to a fourth aspect of the present disclosure, there is provided an electronic device, including:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the second aspect.

[0021] According to a fifth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the second aspect.

[0022] According to a sixth aspect of the present disclosure, a computer program product is provided, comprising a computer program / instruction, wherein the computer program / instruction is executed by a processor to execute the steps of the method described in the second aspect.

[0023] In some embodiments of the present disclosure, a central authority service device includes: a core platform layer and an authentication component layer; the central platform layer includes: a user management module, a user group management module, a project management module, a permission management module, a log management module, and a policy engine module; the user management module is used to manage user information of the central authority management platform; the user group management module is used to manage user group information of the central authority management platform; the project management module is used to centrally manage metadata information and permission files of projects and has a version control function; the permission management module is used to edit permission files and identify the permission codes that users can access through a unified authentication component; The log management module is used to record operation logs related to permissions; the policy engine module is used to parse and execute permission policy generation; the authentication component layer includes: a standardized software development tool kit module, a real-time authentication interface module and a cache management module; the standardized software development tool kit module is used to provide multiple programming language interfaces for the business platform to call authentication functions; the real-time authentication interface module is used to process user authentication requests; and the cache management module is used to manage the life cycle of the local cache; the present disclosure changes the decentralized management model, realizes the centralization and systematization of permission management and authentication, thereby improving the efficiency of permission management, improving system security, and improving operation and maintenance efficiency.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute an improper limitation of the present disclosure.

[0026] Figure 1 A structural diagram of a central authority service device provided by an exemplary embodiment of the present disclosure;

[0027] Figure 2 A flowchart of a rights management method provided by an exemplary embodiment of the present disclosure;

[0028] Figure 3 A schematic structural diagram of a rights management device provided by an exemplary embodiment of the present disclosure;

[0029] Figure 4 A schematic structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0031] The following describes a central authority service device for storing data, an authority management method, an apparatus, and an electronic device according to embodiments of the present disclosure with reference to the accompanying drawings.

[0032] Figure 1 This is a structural diagram of a central authority service device provided by an exemplary embodiment of the present disclosure. Figure 1 As shown, the central authority service device includes: a central platform layer and an authentication component layer. The central platform layer includes: a user management module, a user group management module, a project management module, a permission management module, a log management module and a policy engine module; the user management module is used to manage user information of the central authority management platform; the user group management module is used to manage user group information of the central authority management platform; the project management module is used to centrally manage the metadata information and permission files of the project, and has a version control function; the permission management module is used to edit the permission files and identify the permission codes that users can access through a unified authentication component; the log management module is used to record operation logs related to permissions; the policy engine module is used to parse and execute permission policy generation;

[0033] The authentication component layer includes: a standardized software development toolkit module, a real-time authentication interface module, and a cache management module; the standardized software development toolkit module is used to provide multiple programming language interfaces for the business platform to call authentication functions; the real-time authentication interface module is used to process user authentication requests; and the cache management module is used to manage the life cycle of the local cache.

[0034] The User Management module manages user information on the central permissions management platform, including user registration, login, and information modification. It supports batch import and export of users, facilitating large-scale user management for enterprises. By integrating with an enterprise's existing user management system, it enables unified management and synchronization of user information, avoiding duplicate entry and inconsistencies.

[0035] The User Group Management module manages user group information within the central permissions management platform, including user group creation and editing, group membership management, and user group project management. A user can belong to multiple user groups, and a user group can contain multiple projects. Users within a group can perform permission management operations on projects managed by the user group.

[0036] The project management module is a featured module of the central permissions management platform. It is responsible for the centralized management and version control of metadata information and permissions files for each project, including functions such as project creation, editing, status adjustment, and deletion. Project management operations integrate git functions: creating a project saves project information and creates a local git repository; editing a project edits project information and deletes the original git local repository to create a new git local repository; deleting a project deletes project information and deletes the git local repository; project version management allows viewing information and permission files for each version of the project, and supports creating permission file snapshots, allowing the permission file of a certain version of the project to be quickly restored to a saved snapshot; status management allows files of a certain version of the project to be set to active or completed status. Permission files in the active state support viewing and editing, while permission files in the completed state only allow viewing. Permission files are saved in a format based on ABAC (Attribute-Based Permission Control) to achieve more flexible and fine-grained permission control. Permission files contain rich attribute information, including user attributes, resource attributes, and environment attributes. User attributes can include information such as the user's role, department, position, and years of experience; resource attributes can include resource type, project, access frequency, and sensitivity; and environmental attributes can include access time, access location, and network status. By combining these attributes, complex and precise permission policies can be defined.

[0037] The permissions management module is responsible for editing permissions files under a specific project version. API (Application Programming Interface)-related operations include adding, editing, deleting, and viewing APIs. Permission code-related operations include adding, editing, deleting, and viewing permission codes. Policy-related operations include adding, editing, deleting, and viewing policies. API-bound permission codes dynamically calculate which permission codes a user can access based on the current attributes of the business platform and the set policies. A unified authentication component verifies whether the permission code corresponding to the API currently being requested allows access.

[0038] The log management module records all permission-related operations, including user login and logout records, permission change records, and authentication request records. Audit logs are stored in a structured manner, facilitating query and analysis. By analyzing audit logs, potential security risks, such as unusual permission changes and frequent authentication failures, can be promptly identified and addressed accordingly. Audit logs also provide a crucial basis for compliance audits, meeting enterprise requirements for data security and compliance.

[0039] The policy engine module is the core module of the central permissions management platform, responsible for parsing and executing permissions policy generation. After the business platform is installed and deployed, an encrypted activation code containing the business platform's metadata and current attribute information is sent to the central permissions management platform to request permission initialization data. The central permissions management platform parses the activation code and returns the permission data to the business platform. The business platform then writes the original permission data into the permissions database for use by the authentication SDK (Software Development Kit). Permission files are stored in JSON format, making them highly readable and extensible. Each permission policy exists as a separate object within the file, containing fields such as the policy's ID, name, description, conditional expression, and corresponding permission operation. Conditional expressions are attribute-based logical expressions that determine whether permission conditions are met by evaluating user, resource, and environment attributes. A permission policy might specify that a "Senior Engineer" (user attribute) from the "R&D Department" (user attribute) can modify code files (resource attributes) in "Project A" (resource attributes) only during weekday working hours (environmental attributes). This ABAC-based permissions file structure enables rapid adjustment and expansion of permissions policies based on business changes and actual needs, improving the flexibility and adaptability of permissions management. Based on the metadata and attribute information of the business platform, permissions files are automatically matched and parsed based on the metadata, and corresponding permissions policies are dynamically generated based on the attribute information. The use of efficient algorithms and data structures ensures the speed and accuracy of policy parsing, enabling rapid response to large numbers of authentication requests. Dynamic policy updates and expansion are supported, allowing permissions policies to be adjusted promptly when business rules change without restarting the system.

[0040] The standardized software development kit module provides a standardized software development kit (SDK) to facilitate the integration of unified authentication functionality across various business platforms. The SDK offers a simple, easy-to-use interface, allowing business platforms to perform user authentication and authorization operations simply by calling the corresponding interface. It supports multiple programming languages ​​and development frameworks, such as Java and Python, adapting to the technology requirements of different business platforms. Furthermore, the SDK boasts excellent compatibility and scalability, enabling easy integration with existing functional modules of business platforms.

[0041] The real-time authentication interface module is responsible for processing user authentication requests and communicating with the cache or business platform database to obtain the latest authentication results. It utilizes efficient communication protocols and interface designs to ensure rapid response and processing of authentication requests. It supports multiple authentication methods, such as token-based and certificate-based authentication, to meet the security requirements of diverse business scenarios. Furthermore, the real-time authentication interface offers excellent fault tolerance and stability, providing reliable authentication services even in the event of network anomalies or central service failures.

[0042] The cache management module enables collaboration between local cache and central services, improving authentication efficiency. The cache management module is responsible for managing the lifecycle of the local cache, including operations such as cache creation, updating, and deletion. It utilizes advanced caching algorithms and data structures to ensure cache hit rates and data consistency. When a user makes an authentication request, the local cache is first queried. If a valid authentication result exists in the cache, it is returned directly. If the cache does not exist or the authentication result has expired, a request is initiated to the business platform database, and the latest authentication result is cached locally for future use. Cache management reduces pressure on central services and improves overall system performance and responsiveness.

[0043] In other embodiments of the present disclosure, the version control function of the project management module includes: saving project information and creating the original local warehouse when creating a project; editing project information and creating a new local warehouse to replace the original local warehouse when editing a project; deleting project information and deleting the original local warehouse when deleting a project; project version management can view the information and permission files of each version of the project, and supports creating permission file snapshots and quickly restoring any version of the permission file of the project to a saved snapshot. Status management can set any version of the file of the project to active and completed status. Among them, when creating a project, the initial information of the project is automatically saved, and an original local warehouse is created on the local server to store the initial version file of the project; when editing a project, the project information is updated, and a new local warehouse is created to replace the original local warehouse to retain historical version records; when deleting a project, the project information and the original local warehouse corresponding to the project information are deleted synchronously; among them, project version management supports viewing each version of project information and permission configuration files, allowing users to create snapshots for permission files, and can quickly restore any historical version of permission files to the saved snapshot state when needed; the status management function allows users to set the specified version of the project file to the active state for use, or to the completed state to terminate subsequent modifications and operations.

[0044] In one specific embodiment of the present disclosure, a project management module is designed to efficiently and securely manage software development projects. When a user creates a new project, the system automatically saves the initial project information, including basic information such as the project name, description, and creation time, and creates an original local repository for the project on the local server. This repository stores the initial version of the project's files, ensuring a complete version control record from the project's inception.

[0045] If project information needs to be edited during the project (such as updating the project description or modifying certain configurations), the system will perform the following steps: first, update the basic project information; second, create a new local repository to replace the original one, while retaining historical version records to ensure that any historical state of the project can be traced at any time. This mechanism not only supports flexible adjustments to project information, but also ensures data security and integrity.

[0046] For projects that no longer require maintenance, users can choose to delete them. The system will then perform two simultaneous operations: first, deleting all related information about the project and second, removing the original local repository corresponding to the project. This process ensures efficient management and cleanup of system resources, avoiding unnecessary space usage.

[0047] Furthermore, the project version management feature allows users to view various versions of project information and permission configuration files. Users can create snapshots of permission files as needed. This allows them to quickly restore any historical version of the permission file to the saved snapshot state if a permission setting issue is discovered or a rollback is needed. This significantly enhances the system's flexibility and security.

[0048] Finally, the status management function allows users to set a specific version of the project file to the "Active" state for use, or to the "Complete" state to terminate any subsequent modifications and operations. In this way, team members can clearly know which versions are currently in use and which versions have completed their life cycle.

[0049] This embodiment significantly improves the efficiency and security of project management by integrating an efficient version control system, detailed permission management, and clear status identification. It not only makes the management of project information and files easier, but also greatly reduces the risk of data loss due to misoperation by providing a mechanism for rapid access and recovery of historical versions. At the same time, the status management function helps teams better organize workflows and clarify the roles of each version, further promoting the speed and quality of team collaboration and project progress. In summary, this embodiment provides a comprehensive, flexible, and powerful project management solution.

[0050] The permission file in the project management module is saved in an attribute-based access control format and includes user attributes, resource attributes, and environment attributes. User attributes include at least one of the following: user role, department, position, and years of experience; resource attributes include at least one of the following: resource type, project, access frequency, and sensitivity; and environment attributes include at least one of the following: access time, access location, and network status.

[0051] In other embodiments of the present disclosure, the editing operations of the permission management module include application interface related operations, permission code related operations, and policy related operations. Application interface related operations are used to configure and update application interfaces, wherein application interface related operations support modification of interface addresses, request methods, and parameter formats, and automatically perform interface connectivity verification; permission code related operations are used to define and allocate permission codes, wherein permission code related operations include adding, deleting, or modifying permission identifiers and their corresponding operation scopes; policy related operations are used to set and adjust access control policies, wherein policy related operations include editing role-based access control policy rules, and support configuration of permission control logic and version association.

[0052] In other embodiments of the present disclosure, the permission management module provides the ability to flexibly edit system permission configurations. The module supports three main types of editing operations: application program interface (API) related operations, permission code related operations, and policy related operations.

[0053] Application Programming Interface (API) operations are used to configure and update APIs involved in permission control in the system. Users can modify the address path, request method (such as GET, POST, PUT, DELETE), parameter format, and data type definition of a specific API through the graphical interface or by calling the backend interface. After each modification, the system automatically performs an interface connectivity verification process to ensure that the updated interface remains accessible and can correctly respond to authentication requests. This mechanism effectively prevents service unavailability due to configuration errors.

[0054] Permission code-related operations are used to achieve refined management of permission identifiers. Administrators can add permission codes to correspond to new business operations, delete permission identifiers that are no longer in use, or modify the operation scope and description information of existing permission codes. For example, for the "User Management" module, you can define multiple permission codes such as "User Create," "User Delete," and "User View," and accurately set their applicable objects and scope of influence. The system also supports batch import and export of permission codes, facilitating the maintenance of large-scale permission systems.

[0055] Furthermore, policy-related operations are used to set and adjust the system's access control policies. Specifically, the system supports a role-based access control (RBAC) model, allowing administrators to assign permission codes to different roles and build complex permission control logic through a rules engine. For example, a "department manager" role can be assigned read and write permissions to specific resources, while an "intern" role only has read-only permissions. Furthermore, all policy configurations can be bound to project versions, enabling rapid rollback and reuse of policy configurations during version changes.

[0056] In addition, when performing the above-mentioned editing operations, the system will automatically generate an operation log and record key information such as the operator, operation time, and change content to support subsequent auditing and tracing.

[0057] This embodiment achieves high flexibility and maintainability of permission control by dividing the permission management module into three functional modules: API configuration, permission code management, and access policy editing. The API automatic verification mechanism improves the security and stability of interface configuration; the structured management of permission codes enhances the ability to control permission granularity; and the association design between policies and versions significantly improves the reuse efficiency and consistency of permission configuration under multi-version projects. Overall, this solution not only simplifies the complexity of permission management, but also effectively improves system security, auditability, and operation and maintenance efficiency, providing solid technical support for building a fine-grained and scalable permission management system.

[0058] In other embodiments of the present disclosure, the policy engine module receives an encrypted activation code with metadata information of the business platform and current attribute information sent by the business platform, parses the activation code, and returns the permission data to the business platform.

[0059] In other embodiments of the present disclosure, the policy engine module is configured as a core processing unit in the permission control system, for receiving an encrypted activation code from the service platform and performing permission parsing and return operations based on the activation code.

[0060] Specifically, when the service platform initiates a system activation, feature enablement, or user authentication request, it generates an encrypted activation code containing platform metadata (such as platform identification, device information, and deployment environment) and current attribute information (such as user role, access time, and geographic location). This code is then sent to the policy engine module. The encrypted activation code is encapsulated using a symmetric or asymmetric encryption algorithm to ensure secure transmission.

[0061] After receiving the activation code, the policy engine module first calls the decryption module to decrypt it and extract the platform metadata and current attribute information. The policy engine then evaluates and calculates the permission status of the target business platform based on pre-defined permission policy rules (e.g., those based on RBAC, ABAC, and other models) and the extracted information. This generates a corresponding permission data set, including but not limited to a list of accessible resources, permitted operations, and the validity period of the permissions.

[0062] Finally, the policy engine module returns the generated permission data in a structured format (such as JSON or XML) to the business platform for subsequent permission verification, feature release, and access control decisions. Throughout the entire process, the system also records a complete operation log, including the activation code source, parsing results, and returned data, to support subsequent auditing and tracking.

[0063] Through the above implementation method, the policy engine module realizes the intelligent analysis and issuance of dynamic permissions for the business platform, improving the flexibility and security of permission management. The use of encrypted activation codes effectively ensures the tamper-proof and anti-leakage of permission data during transmission; and the combination of platform metadata and current attribute information for permission calculation makes permission control more refined and scenario-based, and can adapt to the complex permission requirements in multi-tenant, cross-platform, and dynamic environments. In addition, the structured return of permission data and the complete logging mechanism also enhance the maintainability and auditability of the system, helping to build an efficient, secure, and controllable permission management system.

[0064] In other embodiments of the present disclosure, upon receiving an authentication request, the cache management module queries the local cache; if no valid authentication result is found, the cache management module requests authentication data from the service platform database and updates the local cache.

[0065] Specifically, when a user initiates a business operation request, the system triggers the authentication process, and the cache management module is the first to intervene. Upon receiving the authentication request, the module first queries the local cache based on key fields in the request, such as the user ID, role information, and resource ID, to determine whether a valid authentication result record exists.

[0066] If a valid authentication result is found in the local cache (for example, the user has been verified to have access to a resource within the current time range), the cache management module directly returns the authentication result to the caller without initiating a query to the database, thereby significantly improving response efficiency and reducing network latency and database load.

[0067] If no valid authentication result is found in the local cache, the cache management module further initiates an authentication data request from the business platform database to obtain the latest permission status information. After obtaining the authentication data returned by the database, the cache management module not only returns the authentication result to the caller but also writes it to the local cache so that subsequent identical or similar requests can directly hit the cache, achieving a fast response.

[0068] To ensure the validity and security of cached data, the cache management module also has cache expiration mechanisms and update policies, such as time-based TTL (Time To Live) control and event-driven active refresh mechanisms, to ensure that the authentication information in the cache is always consistent with the database or that there are differences within an acceptable time window.

[0069] In addition, the cache management module supports a multi-level cache structure, including local memory cache and distributed cache working together to adapt to business needs in different scales and deployment environments.

[0070] Regarding access control, the proposal proposes that multiple business platforms uniformly adopt attribute-based access control strategies and a unified authentication component. A central permissions management platform manages access control permission files for each business. Developers on each business platform use the management module API provided by the central permissions service to create, edit, view, and delete permission files. Permission files are encrypted and stored to ensure the security and confidentiality of permission data. When parsing permission files, permissions are dynamically resolved based on real-time context and user attribute information, improving the flexibility and adaptability of permission management.

[0071] This paper designs a project permission management model that supports version control. This model allows version control of permission file management strategies and records historical information of each permission change. When it is necessary to go back to a specific permission status, you can easily switch to the corresponding version. During the project development process, permissions may be adjusted and optimized multiple times. Through version control, you can clearly understand the reasons and impacts of each permission change, which facilitates the audit and evaluation of permission management. At the same time, version control also facilitates the testing and verification of permission management. When testing a new permission strategy, you can first test it on a specific version to ensure its stability and security before applying it to the formal environment.

[0072] In terms of authentication architecture, a real-time authentication architecture with cache collaboration has been built to achieve a balance between performance and security. The unified authentication component supports a collaborative working mode between local cache and database. When a user makes an authentication request, the local cache is first queried. If a valid authentication result exists in the cache, it is directly returned, improving the speed and efficiency of authentication. If the result does not exist in the cache or has expired, a request is initiated to the database to ensure the real-time and accuracy of authentication. This architecture effectively improves system performance while ensuring system security and reduces the pressure of authentication requests on the database. In high-concurrency business scenarios, a large number of authentication requests can be quickly processed through the local cache, reducing the load on central services and improving the overall response speed of the system.

[0073] The present disclosure proposes a dynamic permission initialization mechanism to dynamically adjust the permissions of the business platform. The central permission service device can dynamically generate and initialize permissions based on the business platform attributes and policy information. When the business rules of the business platform change or the platform attributes change, the system can adjust the permissions in real time to ensure that the permissions are consistent with business needs and the actual situation of the user. When the business platform requests the central permission platform with different attributes, the platform can dynamically generate permission files based on the current attributes and policies of the business platform, reducing the business platform's storage of permission data unrelated to the current attributes, improving authentication efficiency and achieving more accurate access control.

[0074] The present disclosure realizes centralized management of permissions for multiple business platforms through a central permission service device, avoids the confusion and inconsistency problems caused by decentralized management, and improves management efficiency and accuracy. The dynamic update function of the permission management and policy engine based on ABAC enables permission policies to be quickly adjusted and expanded according to business changes and actual needs, adapting to the dynamic development of corporate business; the unified authentication component provides users with a convenient and efficient unified authentication service, reducing the trouble of multiple identity authentication for users, while improving the security and reliability of authentication; the log management module records all permission-related operation logs, and uses a structured storage method to facilitate query and analysis, which helps to timely discover potential security risks and meet corporate compliance requirements; the cache management module realizes the collaborative work of local cache and central service, improves authentication efficiency, reduces the pressure on central service, and improves the overall performance and response speed of the system.

[0075] Figure 2 A flowchart of a rights management method provided by an exemplary embodiment of the present disclosure.

[0076] like Figure 2 As shown, the method comprises the following steps:

[0077] Step 201: After the service platform is deployed, an encrypted activation code carrying metadata information and current attribute information is sent to a central authority service device.

[0078] In step 202, the central authority service device parses the encrypted activation code, matches the corresponding authority file, generates an authority policy, and returns the authority initialization data to the business platform.

[0079] In step 203, the business platform writes the permission initialization data into the local permission database for the authentication software development kit to call.

[0080] In this embodiment, the execution subject of the above method may be a server or a terminal device.

[0081] Among them, terminal devices include but are not limited to mobile stations (MS), mobile terminals, mobile phones, handsets, and portable equipment. The terminal devices can communicate with one or more core networks via a radio access network (RAN). For example, the terminal devices can be mobile phones (or "cellular" phones), computers with wireless communication capabilities, etc. The terminal devices can also be computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, AR terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc., and the operating systems installed on the terminal devices include but are not limited to: iOS, Android, Windows, Linux, Mac OS, etc. In different networks, a terminal may be called by different names, such as user equipment, mobile station, subscriber unit, station, cellular phone, personal digital assistant, wireless modem, wireless communication device, handheld device, laptop computer, cordless phone, wireless local loop station, television, etc. For the convenience of description, the terminal is referred to as terminal equipment in this embodiment.

[0082] In this embodiment, the server implementation is not limited. For example, the server can be a conventional server, a cloud server, a cloud host, a virtual center, or other server devices. The server components primarily include a processor, a hard disk, memory, a system bus, and other common computer architecture types.

[0083] In this embodiment, the implementation of each step of the above method can refer to the description of the corresponding part of the above embodiment, which will not be repeated here.

[0084] In some embodiments of the present disclosure, when a user initiates an authentication request, the authentication software development toolkit queries the local cache; if a valid authentication result is found in the local cache, the authentication software development toolkit returns the authentication result to the business platform; if a valid authentication result is not found in the local cache, the authentication software development toolkit initiates an authentication data request to the business platform database, and updates the local cache after obtaining the authentication data; the central authority service device records all authority-related operation logs and stores them in a structured manner. Among them, the authority policy is constructed based on attribute-based access control, and a conditional expression is formed based on a combination of user attributes, resource attributes, and environment attributes; based on the conditional expression, it is determined whether the user is qualified to perform the target authority operation.

[0085] In some embodiments of the present disclosure, the authentication process is collaboratively implemented by an authentication software development kit (SDK) and a central permission service. This combines a local caching mechanism with the Attribute-Based Access Control (ABAC) model to achieve efficient and fine-grained permission determination and management. When a user initiates a business operation request, the system first triggers the authentication process. At this point, the authentication SDK, as a front-end processing component, first queries the local cache for authentication result records. This cache stores recent user permission determination results, including information such as user ID, resource ID, operation type, and permission status, and is configured with a reasonable time-to-live (TTL) to ensure data freshness. If a valid authentication result is found in the local cache, the authentication SDK directly returns it to the business platform, rapidly completing permission verification, improving response speed and reducing reliance on back-end systems. If a valid authentication result is not found, the authentication SDK initiates a request for authentication data from the business platform database. Upon receiving the request, the database forwards the relevant information to the central permission service for permission determination. Based on the ABAC model, the central authorization service comprehensively analyzes multiple dimensions of information, including user attributes (such as role, department, and position), resource attributes (such as resource type, project, and sensitivity level), and environmental attributes (such as access time, location, and device type). It then constructs conditional expressions to assess whether the current user has permission to perform the target operation. For example, a conditional expression might read: "If the user belongs to the 'Finance Department,' the access time is between 9:00 AM and 6:00 PM on weekdays, and the target resource is of the 'Expense Report' type, then the view operation is permitted." The central authorization service performs logical analysis based on these rules, generates the final authentication result, and returns it to the authentication SDK.

[0086] After obtaining the result, the authentication SDK will, on the one hand, return the result to the business platform to continue subsequent operations, and on the other hand, update the local cache so that the next time the same or similar request can be responded to quickly. At the same time, the central authority service device will also record a complete log of the authority-related operations, including the operator, operation time, access resources, judgment basis, result output and other information, and store it persistently in a structured manner (such as JSON, XML, relational table structure) to facilitate subsequent auditing and tracking. In addition, the entire authentication process supports dynamic policy configuration and real-time effectiveness mechanism. Administrators can flexibly adjust the authority rules through the graphical interface or API interface without restarting the service or affecting the existing business operation.

[0087] In the above-described embodiment, when the permission policy changes, the central permission service device updates the permission file and synchronizes the updated permission file to each business platform via a standardized software development kit. When the permission policy changes, such as adding or adjusting access control rules or modifying role permission relationships, the central permission service device generates an updated permission file based on the changes and replaces the original configuration file. The device then synchronizes the updated permission file to each business platform via a standardized software development kit (SDK). The SDK provides a unified interface and communication protocol to ensure that permission changes take effect in real time or near real time across all access systems. Furthermore, the synchronization process supports version control and rollback mechanisms to ensure the consistency and security of permission updates. This mechanism effectively enhances the centralized management capabilities and distribution efficiency of permission policies, ensuring that the permission status across multiple business platforms remains synchronized and compliant.

[0088] Exemplarily, the business request is sent to the unified authentication component, the user information and request interface information are parsed, and the user's accessible permission set is calculated according to the user information and environment information according to the authentication policy; if the accessible permission set contains the permission code that can access the API, the authentication is successful and the authentication success result is returned; if the accessible permission set does not contain the permission code that can access the API, the authentication fails and the authentication failure result is returned.

[0089] It should be noted that the embodiments of the present disclosure may include multiple steps. For the convenience of description, these steps are numbered, but these numbers do not limit the execution time slots or execution order between the steps; these steps can be implemented in any order, and the embodiments of the present disclosure do not limit this.

[0090] In summary, the embodiments of the present disclosure have the following beneficial effects:

[0091] In some embodiments of the present disclosure, a central authority service device includes: a core platform layer and an authentication component layer; the central platform layer includes: a user management module, a user group management module, a project management module, a permission management module, a log management module, and a policy engine module; the user management module is used to manage user information of the central authority management platform; the user group management module is used to manage user group information of the central authority management platform; the project management module is used to centrally manage metadata information and permission files of projects and has a version control function; the permission management module is used to edit permission files and identify the permission codes that users can access through a unified authentication component; The log management module is used to record operation logs related to permissions; the policy engine module is used to parse and execute permission policy generation; the authentication component layer includes: a standardized software development tool kit module, a real-time authentication interface module and a cache management module; the standardized software development tool kit module is used to provide multiple programming language interfaces for the business platform to call authentication functions; the real-time authentication interface module is used to process user authentication requests; and the cache management module is used to manage the life cycle of the local cache; the present disclosure changes the decentralized management model, realizes the centralization and systematization of permission management and authentication, thereby improving the efficiency of permission management, improving system security, and improving operation and maintenance efficiency.

[0092] For example, Figure 3 FIG. 3 is a schematic diagram of a structure of a rights management device 30 provided by an exemplary embodiment of the present disclosure. Figure 3 As shown, the rights management device 30 includes: a sending module 31 , a generating module 32 and a writing module 33 .

[0093] The sending module 31 is used to send the encrypted activation code carrying metadata information and current attribute information to the central authority service device after the business platform deployment is completed;

[0094] Generation module 32, used for the central authority service device to parse the encrypted activation code, match the corresponding authority file, generate the authority policy, and return the authority initialization data to the business platform;

[0095] The writing module 33 is used by the business platform to write the permission initialization data into the local permission database for the authentication software development tool kit to call.

[0096] Optionally, the writing module 33 can also be used for: when the user initiates an authentication request, the authentication software development tool kit queries the local cache; when a valid authentication result is hit in the local cache, the authentication software development tool kit returns the authentication result to the business platform; when a valid authentication result is not hit in the local cache, the authentication software development tool kit initiates an authentication data request to the business platform database, and updates the local cache after obtaining the authentication data; the central authority service device records all authority-related operation logs and stores them in a structured manner.

[0097] Optionally, the writing module 33 can also be used to: construct the permission policy based on attribute-based access control, and form a conditional expression based on the combination of user attributes, resource attributes and environment attributes; and determine whether the user is qualified to perform the target permission operation based on the conditional expression.

[0098] Optionally, the writing module 33 may also be used to: when the authority policy changes, the central authority service device updates the authority file and synchronizes the updated authority file to each business platform through a standardized software development kit.

[0099] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0100] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0101] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0102] like Figure 4As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 402 or a computer program loaded from storage unit 408 into RAM (Random Access Memory) 403. RAM 403 may also store various programs and data required for the operation of device 400. Computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. An I / O (Input / Output) interface 405 is also connected to bus 404.

[0103] Various components in device 400 are connected to I / O interface 405, including an input unit 406, such as a keyboard, mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a magnetic disk, optical disk, etc.; and a communication unit 409, such as a network card, modem, wireless communication transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0104] Computing unit 401 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of computing unit 401 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphic Processing Units), various specialized AI (Artificial Intelligence) computing chips, various computing units that run machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processors, controllers, microcontrollers, etc. Computing unit 401 performs the various methods and processes described above, such as the rights management method. For example, in some embodiments, the rights management method may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed onto device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by computing unit 401, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute the aforementioned rights management method in any other appropriate manner (eg, by means of firmware).

[0105] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System on Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0107] In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, RAM, ROM, EPROM (Electrically Programmable Read-Only-Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0108] To provide for user interaction, the systems and techniques described herein can be implemented on a computer having a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide for user interaction; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user can be received in any form, including acoustic input, voice input, or tactile input.

[0109] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: LAN (Local Area Network), WAN (Wide Area Network), the Internet, and blockchain networks.

[0110] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, establishing a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a host product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical servers and VPS services ("Virtual Private Servers" or "VPS"). The server may also be a server in a distributed system or a server integrated with blockchain.

[0111] It's important to note that artificial intelligence (AI) is the study of how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). This encompasses both hardware and software technologies. AI hardware technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily encompass computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graphs.

[0112] The various numerical numbers such as first and second involved in the present disclosure are only for the convenience of description and are not used to limit the scope of the embodiments of the present disclosure, and also indicate the order of precedence.

[0113] The at least one in the present disclosure can also be described as one or more, and the multiple can be two, three, four or more, which is not limited in the present disclosure. In the embodiments of the present disclosure, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0114] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0115] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A central authority service device, characterized in that: include: Central platform layer and authentication component layer; The central platform layer includes: a user management module, a user group management module, a project management module, a rights management module, a log management module and a policy engine module; the user management module is used to manage user information of the central rights management platform; the user group management module is used to manage user group information of the central rights management platform; the project management module is used to centrally manage the metadata information and rights files of the project and has a version control function; the rights management module is used to edit the rights files and identify the rights codes that users can access through a unified authentication component; the log management module is used to record operation logs related to rights; the policy engine module is used to parse and execute rights policy generation; The authentication component layer includes: a standardized software development kit module, a real-time authentication interface module, and a cache management module; the standardized software development kit module is used to provide multiple programming language interfaces for the service platform to call the authentication function; the real-time authentication interface module is used to process user authentication requests; and the cache management module is used to manage the life cycle of the local cache; Project version management supports viewing project information and permission configuration files of various versions, allowing users to create snapshots of permission files and quickly restore any historical version of permission files to the saved snapshot state when needed. The status management function allows users to set a specified version of a project file to the active state for use, or to the completed state to terminate subsequent modifications and operations. The permission management module is responsible for editing the permission files under any version of the project, including: operations related to the application programming interface, including adding a new application programming interface, editing an application programming interface, deleting an application programming interface, and viewing an application programming interface; operations related to the permission code, including adding a new permission code, editing a permission code, deleting a permission code, and viewing a permission code; operations related to the policy, including adding a new policy, editing a policy, deleting a policy, and viewing a policy; binding the permission code to the application programming interface; dynamically calculating the permission code that the user can access according to the set policy based on the current attributes of the business platform; and identifying whether the permission code corresponding to the application programming interface currently requested by the user is allowed to access through a unified authentication component.

2. The device according to claim 1, characterized in that The version control function of the project management module is used to: When creating a project, the initial information of the project is automatically saved, and an original local repository is created on the local server to store the initial version files of the project; When editing a project, update the project information and create a new local repository to replace the original local repository, preserving historical version records; When deleting a project, the project information and the original local repository corresponding to the project information are deleted simultaneously.

3. The device according to claim 1, characterized in that The project management module is also used to: The permission file in the project management module is saved in an attribute-based access control format, and the permission file includes: user attributes, resource attributes, and environment attributes.

4. The device according to claim 3, characterized in that The user attributes include at least one of the following: the user's role, department, position and years of work experience; the resource attributes include at least one of the following: the resource type, project to which it belongs, access frequency and sensitivity; the environmental attributes include at least one of the following: access time, access location and network status.

5. The device according to claim 1, characterized in that The rights management module is further used to: The editing operations include: application program interface related operations, permission code related operations and policy related operations; The application program interface related operations are used to configure and update the application program interface, wherein the application program interface related operations support the modification of the interface address, request method and parameter format, and automatically perform interface connectivity verification; The permission code related operations are used to define and allocate permission codes, wherein the permission code related operations include adding, deleting or modifying permission identifiers and their corresponding operation scopes; The policy-related operations are used to set and adjust access control policies, wherein the policy-related operations include editing of role-based access control policy rules and support configuration and version association of permission control logic.

6. The device according to claim 1, characterized in that The policy engine module is further configured to: Receive the encrypted activation code sent by the business platform with the business platform metadata information and current attribute information, parse the activation code and return the permission data to the business platform.

7. The device according to claim 1, characterized in that The cache management module is further configured to: When an authentication request is received, query the local cache; If no valid authentication result is found, the authentication data is requested from the service platform database and the local cache is updated.

8. A rights management method, applied to the central rights service device according to any one of claims 1 to 7, characterized in that: include: After the business platform is deployed, the encrypted activation code carrying metadata information and current attribute information is sent to the central authority service device; The central authority service device parses the encrypted activation code, matches the corresponding authority file, generates an authority policy, and returns authority initialization data to the business platform; The service platform writes the permission initialization data into a local permission database for calling by an authentication software development toolkit.

9. The method according to claim 8, characterized in that The method further comprises: In the case of a user initiating an authentication request, the authentication SDK queries the local cache; If a valid authentication result is found in the local cache, the authentication software development toolkit returns the authentication result to the service platform; If no valid authentication result is found in the local cache, the authentication software development toolkit initiates an authentication data request to the business platform database and updates the local cache after obtaining the authentication data; The central authority service device records all authority-related operation logs and stores the authority-related operation logs in a structured manner.

10. The method according to claim 8, characterized in that The method further comprises: The permission policy is constructed based on attribute-based access control and conditional expressions are formed based on the combination of user attributes, resource attributes and environment attributes; Based on the conditional expression, determine whether the user is qualified to perform the target permission operation.

11. The method according to claim 8, characterized in that The method further comprises: In the event that the authority policy changes, the central authority service device updates the authority file and synchronizes the updated authority file to each business platform through a standardized software development kit.

12. A rights management device, applied to the central rights service device according to any one of claims 1 to 7, characterized in that: include: The sending module is used to send the encrypted activation code carrying metadata information and current attribute information to the central authority service device after the business platform deployment is completed; A generation module, configured for the central authority service device to parse the encrypted activation code, match the corresponding authority file, generate an authority policy, and return authority initialization data to the business platform; The writing module is used for the business platform to write the permission initialization data into the local permission database for calling by the authentication software development tool kit.

13. An electronic device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 8 to 11.

14. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 8 to 11.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 8 to 11 are implemented.

Images