An orderly rights management method based on clock authorization

Abstract

The present application relates to an orderly permission management method based on clock authorization, and relates to the field of computer information security technology, which includes: Step S1: Creation of a business tree table: For projects, sub-projects in projects, and business tasks contained in sub-projects, a business tree table is established based on a pre-ordered traversal tree algorithm model, sub-project nodes are assigned serial numbers based on the chronological order of creation time of sub-project nodes in the business tree, and business task nodes are assigned serial numbers based on the chronological order of creation time of business task nodes in the business tree; Step S2: Creation of a business operation permission code table; Step S3: Creation of task permission codes; Step S4: Task permission processing. The present application can efficiently manage user permissions in an environment with complex business processes, complicated data, and numerous participants.

Description

Technical Field

[0001] The present application relates to the field of computer information security technology, and in particular to an orderly rights management method based on clock authorization. Background Art

[0002] With the shift to cloud-based simulation analysis, network-based simulation data management systems are playing a crucial role in product development. Complex business processes, extensive data, and numerous participants place high demands on the system's authority management design.

[0003] Currently, two widely adopted permission models are role-based access control (RBAC) and attribute-based access control (ABAC). Each has its advantages and disadvantages: RBAC is simple to construct but lacks granularity; ABAC offers superior granularity but is complex to construct. This application proposes a method for orderly permission management based on clock-based authorization, integrating the advantages of both approaches and adding expiration management to permissions. Summary of the Invention

[0004] In order to efficiently manage user rights in an environment with complex business processes, complicated data and a large number of participants, this application provides an orderly rights management method based on clock authorization.

[0005] This application provides an orderly rights management method based on clock authorization, which adopts the following technical solutions:

[0006] A clock-based authorization method for orderly rights management includes the following steps:

[0007] Step S1: Creating a business tree table: For projects, sub-projects within projects, and business tasks contained within sub-projects, a business tree table is created based on a pre-ordered traversal tree algorithm model. Sequence numbers are assigned to sub-project nodes based on the order of their creation time in the business tree, and sequence numbers are assigned to business task nodes based on the order of their creation time in the business tree.

[0008] Step S2: Creation of a business operation permission code table: Create a permission classification table based on permission types, assigning a permission code to each permission. The permission types include update, download, add new business resources, and browse;

[0009] Step S3: Creating a task permission code: Obtain the user account category and the business tasks assigned to the user, and assemble and create a task permission code based on the user account category, the permissions assigned to the business tasks, the system time and the validity period;

[0010] Step S4: Task authority processing: perform authority verification and judgment, and parse, change or destroy the task authority code.

[0011] By adopting the above technical solution, in the system, along with the creation of the project, one or more business tasks can be assigned by the project creator or sub-project creator for each project, the sub-project contained in the project, and the business tasks contained in the sub-project. Each sub-project and business task will generate a task permission code, which is stored in the user permission table and associated with the project node, sub-project node, and business task node in the business tree table. By dividing the operation permissions corresponding to each business task in the business tree table and assigning permission codes, task permission codes can be created based on information such as the user account category, the permissions of the business task assigned to the user, the current system time at the time of creation, and the validity period. Through the setting of the task permission code, the operation permissions can be assigned to the user corresponding to each business task in the business tree table. Different operation permissions can be assigned based on the user account category and the corresponding permission time limit can be set. This can facilitate the allocation of operation permissions for participants in different business processes, and at the same time, the expiration management of permissions can be added.

[0012] Preferably, the step S1 includes the following steps:

[0013] Step S11: Generate a node serial number using an auto-incrementing method based on the creation time of the sub-project node and the business task node;

[0014] Step S12: Record the project name, sub-project name, and business task node serial number into the business tree table.

[0015] Preferably, step S2 includes the following steps:

[0016] Step S21: Preset the operable type permissions for the business task;

[0017] Step S22: Record the business type and operation authority code of the business task into the business operation authority code;

[0018] Step S23: Change the account type and save.

[0019] Preferably, step S3 includes the following steps:

[0020] Step S31: Get the current system time and convert it into binary code;

[0021] Step S32: Obtain the validity period of the set permission and convert it into binary code;

[0022] Step S33: Obtain the user account type and convert it into binary code;

[0023] Step S34: Obtain the business task assigned to the user and convert it into binary code;

[0024] Step S35: Obtain the user's business task authority and convert it into binary code;

[0025] Step S36: assembling the symbol code, the system time binary code, the permission validity period binary code, the account type binary code, the business task binary code, and the business task permission binary code in sequence through bitwise operations to generate a task permission code;

[0026] Step S37: Record the task authority code into the user authority table.

[0027] By adopting the above technical solution, the task permission code contains five pieces of information: the timestamp of the current system at the time of creation, the validity period of the permission, the user account category, the business task corresponding to the user, and the user's business task permission. Based on the task permission code, feedback can be provided on the user's operational permissions and the validity period of the permissions. The operational permissions of the user account can be preset, and at the same time, expiration management can be added to the user account usage time limit.

[0028] Preferably, step S4 includes the following steps:

[0029] Step S41: generating an interval mask;

[0030] Step S42: performing bitwise operation on the task authority code using the interval mask;

[0031] Step S43: Perform corresponding logical processing according to the scenario, which includes account category change, permission verification and expiration processing.

[0032] Preferably, the authority verification judgment includes the following steps:

[0033] Step S4311: Obtain operation information;

[0034] Step S4312: Determine the operation type. If the operation type is a change operation, perform validity period judgment and business code matching judgment in sequence. Based on the judgment result of the validity period and business code matching, allow access to the relevant page operation or reject it; if the operation type is a non-change operation, allow access to the relevant operation page or reject it directly based on the business code matching result.

[0035] By adopting the above technical solution and judging through permission verification, whether the user is allowed to enter the relevant page operation can be determined based on two factors: whether the user's account is valid and whether the business code matches. This can effectively maintain the security of the database and reduce the occurrence of irrelevant business users adding / deleting / modifying.

[0036] Preferably, the change process includes the following steps:

[0037] Step S4321: Obtain information of the account to be changed;

[0038] Step S4322: Determine whether the type of account needs to be changed to a temporary account. If so, set the account validity period to 0 to update the task authority code of the corresponding account and store it in the user authority table; if not, modify the relevant authority code value according to the preset logic.

[0039] Preferably, the expiration processing includes the following steps:

[0040] Step S4331: Start the scheduled task manager and set the trigger according to the validity period;

[0041] Step S4332: When the validity period has expired, the validity period code in the task authority code is automatically set to 0 to update the task authority code of the corresponding account and store it in the user authority table;

[0042] Step S4333: Delete the trigger.

[0043] By adopting the above technical solution, when a business task is established and the task permission code corresponding to the business task is assigned to a user account, a trigger is automatically set according to the validity period of the user account. When the user account's permission exceeds the validity period, the task manager can automatically set the validity period in the task permission code corresponding to the user account to 0 and the value of the changeable type permission code to 0. After that, the task permission code of the expired user account can be updated and recorded in the user permission table, and the trigger can be deleted. By combining and using the task manager and triggers, the task permission code of the user account that has exceeded the validity period can be automatically added to the invalidation management.

[0044] Preferably, the task authority code occupies 128 bits, and the task authority code includes six intervals: a sign bit, a timestamp bit, a validity period bit, an account category bit, a business code bit, and an operation authority bit.

[0045] In summary, the clock-based authorization-based orderly rights management method of the present application has at least one of the following beneficial technical effects:

[0046] 1. The task permission code contains five pieces of information: the current system timestamp when it was created, the validity period of the permission, the user account type, the business task corresponding to the user, and the user's business task permission. Based on the task permission code, feedback can be provided on the user's operational permissions and the validity period of the permissions. This allows the user account's operational permissions to be preset, and at the same time, expiration management can be added to the user account's usage period.

[0047] 2. Through permission verification, whether the user is allowed to access the relevant page operations can be determined based on two factors: whether the user's account is valid and whether the business code matches. This can effectively maintain the security of the database and reduce the occurrence of irrelevant business users adding / deleting / modifying. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of an embodiment of the present application used to illustrate the main steps of the orderly rights management method.

[0049] Figure 2 This is a schematic diagram of an embodiment of the present application used to illustrate the main structure of the task authority code.

[0050] Figure 3 It is a schematic diagram used to illustrate the main process of step S3 in an embodiment of the present application.

[0051] Figure 4 This is a schematic diagram of an embodiment of the present application used to illustrate the main workflow of the task authority code operator. DETAILED DESCRIPTION

[0052] The following combination Figure 1-Figure 4 This application is described in further detail.

[0053] Example

[0054] The embodiment of the present application discloses an orderly permission management method based on clock authorization. It mainly includes a permission manager, a task permission code generator and a task permission code operator. Figure 1-Figure 4 ,The user authority management method of the authority manager specifically includes the following steps:

[0055] Step S1: Create a business tree table: For projects, subprojects within projects, and business tasks within subprojects, assign serial numbers to subproject nodes based on the order of their creation time in the business tree, and assign serial numbers to business task nodes based on the order of their creation time in the business tree;

[0056] Step S2: Creation of a business operation permission code table: Create a permission classification table based on permission types, assigning a permission code to each permission. The permission types include update, download, add new business resources, and browse;

[0057] Step S3: Creating a task permission code: Obtain the user account category and the business tasks assigned to the user, and assemble and create a task permission code based on the user account category, the permissions of the business tasks assigned to the user, the system time and the validity period through a task permission code generator;

[0058] Step S4: Task authority processing: Perform authority verification and judgment through the task authority code operator, and parse, change or destroy the task authority code.

[0059] It should be noted that, in the embodiments of the present application,

[0060] Wherein, step S1 includes the following steps:

[0061] Step S11: Generate a node serial number using an auto-incrementing method based on the creation time of the sub-project node and the business task node;

[0062] Step S12: Record the project name, sub-project name, and business task node serial number into the business tree table.

[0063] Step S2 includes the following steps:

[0064] Step S21: Preset the operable type permissions for the business task;

[0065] Step S22: Record the business type and operation authority code of the business task into the business operation authority code;

[0066] Step S23: Change the account type and save.

[0067] Reference Figure 3 , step S3 includes the following steps:

[0068] Step S31: Get the current system time and convert it into binary code;

[0069] Step S32: Obtain the validity period of the set permission and convert it into binary code;

[0070] Step S33: Obtain the user account type and convert it into binary code;

[0071] Step S34: Obtain the business tasks assigned to the user and convert them into binary code. If there are multiple business tasks assigned, multiple task permission codes are generated accordingly.

[0072] Step S35: Obtain the user's business task authority and convert it into binary code. If there are multiple authorities, use an AND operation;

[0073] Step S36: Assemble the symbol code, system time binary code, permission validity period binary code, account category binary code, business task binary code, and business task permission binary code in sequence through bit operations to generate a task permission code; Step S37: Record the task permission code in the user permission table.

[0074] It should be noted that, in this embodiment, the task authority code occupies 128 bits, and the task authority code includes six intervals: sign bit, timestamp bit, validity period bit, account category bit, business code bit, and operation authority bit.

[0075] Among them, reference Figure 2The sign bit in the task permission code is 1, and the default value is 0 to ensure that the final permission code is a positive integer. The timestamp bit is 41 bits and is used to indicate the time when the user account permission takes effect (that is, the time node when the task permission code is generated), accurate to milliseconds. The validity period bit is 14 bits and is used in conjunction with the timestamp bit to determine whether the user account permission has expired. The validity period is calculated in days, and the maximum validity period is 45 years. The account category is 8 bits and is used to indicate the user's account role. It can be divided into temporary user, super administrator, project administrator, sub-project administrator, business task administrator, and ordinary participant. Different user account categories correspond to default fixed permissions and their validity period allocation is also different. The user's account type is based on the type fixed preset code. The business code bit is 32 bits and consists of the node sequence number of the business tree table. If the user participates in the node, the number is 1, otherwise it is 0. The operation permission bit is 32 bits and includes the operation permissions. It is used to indicate the corresponding assignable permissions on all business nodes of the user account. If a certain permission is possessed, the corresponding permission bit is 1, otherwise it is 0.

[0076] In this embodiment, the validity period of the temporary personnel's task authority code is usually 30 days. The validity period can be appropriately adjusted according to the length of time the temporary personnel need to follow up on the project (or business task), which is not detailed here.

[0077] In the system, along with the creation of a project, the project creator or sub-project creator can assign one or more sub-business tasks to each project, its sub-projects, and the business tasks contained in the sub-projects. Each sub-project and business task will generate a task permission code, which is stored in the user permission table.

[0078] The task permission codes corresponding to sub-project nodes and business task nodes contain information such as timestamp, validity period, operation permissions, and user category. By analyzing the task permission codes, operation permissions can be assigned to user accounts corresponding to business tasks under different sub-projects, and the validity period of operation permissions can be set based on account category, achieving efficient permission management.

[0079] In this embodiment, step S4 mainly includes the following steps:

[0080] Step S41: generating an interval mask;

[0081] Step S42: performing bitwise operation on the task authority code using the interval mask;

[0082] Step S43: Perform corresponding logical processing according to the scenario, which includes account category change, permission verification and expiration processing.

[0083] The permission verification process mainly includes the following steps:

[0084] Step S4311: Obtain operation information;

[0085] Step S4312: Determine the operation type. If the operation type is a change operation, perform validity period judgment and business code matching judgment in sequence. Based on the judgment result of the validity period and business code matching, allow access to the relevant page operation or reject it; if the operation type is a non-change operation, allow access to the relevant operation page or reject it directly based on the business code matching result.

[0086] Reference Figure 4 During the permission verification process, the task permission code operator performs operation verification based on the operation, business code and validity period information input by the user in use. When the user uses a non-change operation and the user's business code matches, the user is allowed to enter the relevant page operation. If the user's business code does not match, the operation is rejected; when the user uses a change operation, if the user is within the validity period and the business code matches, the user is allowed to enter the relevant page operation. If the user's validity period expires or the business code does not match, the operation is rejected.

[0087] Changing the account type mainly includes the following steps:

[0088] Step S4321: Obtain information of the account to be changed;

[0089] Step S4322: Determine whether the type of account needs to be changed to a temporary account. If so, set the account validity period to 0 to update the task authority code of the corresponding account and store it in the user authority table; if not, modify the relevant authority code value according to the preset logic.

[0090] Among them, the specific method of changing the value of the modifiable type permission code is: query which permissions correspond to the add, delete or modify type operations through the task permission table; set the permission code corresponding to add, delete or modify to 0, and set the validity period in the task permission code to 0.

[0091] Reference Figure 3 The specific process of account category change is to obtain the account of the user to be changed and determine the type of account category change. If the account is downgraded to a temporary account, the validity period of the corresponding user account is changed to 30 days, and the permission code corresponding to the add, delete or modify type operations is set to 0; if the account is upgraded to a management account, the user account validity period code is modified, and the permission code corresponding to the add, delete or modify type operations is set to 1.

[0092] Expiration processing mainly includes the following steps:

[0093] Step S4331: Start the scheduled task manager and set the trigger according to the validity period;

[0094] Step S4332: When the validity period has expired, the validity period code in the task authority code is automatically set to 0 to update the task authority code of the corresponding account and store it in the user authority table;

[0095] Step S4333: Delete the trigger.

[0096] For the processing of expired task permissions of temporary user accounts, when the temporary user is created, a validity period code with a validity period of 30 days can be set based on the system timestamp at the time of creation, and the task manager can be started at the same time, and a trigger can be set according to the 30-day validity period; when the validity period reaches or exceeds 30 days, the validity period of the temporary user account is automatically set to 0 through the task permission code operator, and the changeable type permission code value (that is, the permission code corresponding to the add, delete, and modify operations) is set to 0, and the updated task permission code is updated to the user permission table.

[0097] Reference Figure 3 ,During the task authority operation process, the task authority code operator generates an ,interval mask. After performing bit operations on the task authority ,code using the interval mask, corresponding logical processing can be ,performed based on the scenario.

[0098] The above are all preferred embodiments of the present application, and are not intended to limit the scope of protection of the present application in sequence. Therefore, any equivalent changes made based on the structure, shape, and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A method for orderly rights management based on clock authorization, characterized in that: The following steps are involved: Step S1: Creating a business tree table: For projects, sub-projects within projects, and business tasks contained within sub-projects, a business tree table is created based on a pre-ordered traversal tree algorithm model. Sequence numbers are assigned to sub-project nodes based on the order of their creation time in the business tree, and sequence numbers are assigned to business task nodes based on the order of their creation time in the business tree. Step S2: Creation of a business operation permission code table: Create a permission classification table based on permission types, assigning a permission code to each permission. The permission types include update, download, add new business resources, and browse; Step S3: Creating a task permission code: Obtain the user account category and the business tasks assigned to the user, and assemble and create a task permission code based on the user account category, the permissions assigned to the business tasks, the system time and the validity period; Step S4: Task authority processing: perform authority verification and judgment, parse, change or destroy the task authority code; The step S1 comprises the following steps: Step S11: Generate a node serial number using an auto-incrementing method based on the creation time of the sub-project node and the business task node; Step S12: The project name, sub-project name and business task node number are recorded in the business tree table; The step S2 comprises the following steps: Step S21: Preset the operable type permissions for the business task; Step S22: Record the business type and operation authority code of the business task into the business operation authority code; Step S23: Change the account category and save; The step S3 comprises the following steps: Step S31: Get the current system time and convert it into binary code; Step S32: Obtain the validity period of the set permission and convert it into binary code; Step S33: Obtain the user account type and convert it into binary code; Step S34: Obtain the business task assigned to the user and convert it into binary code; Step S35: Obtain the user's business task authority and convert it into binary code; Step S36: assembling the symbol code, the system time binary code, the permission validity period binary code, the account type binary code, the business task binary code, and the business task permission binary code in sequence through bitwise operations to generate a task permission code; Step S37: Record the task authority code into the user authority table.

2. The method for orderly rights management based on clock authorization according to claim 1, characterized in that: The step S4 comprises the following steps: Step S41: generating an interval mask; Step S42: performing bitwise operation on the task authority code using the interval mask; Step S43: Perform corresponding logical processing according to the scenario, which includes account category change, permission verification and expiration processing.

3. The method for orderly rights management based on clock authorization according to claim 2, characterized in that: The authorization verification process includes the following steps: Step S4311: Obtain operation information; Step S4312: Determine the operation type. If the operation type is a change operation, perform validity period judgment and business code matching judgment in sequence. Based on the judgment result of the validity period and business code matching, allow access to the relevant page operation or reject it; if the operation type is a non-change operation, allow access to the relevant operation page or reject it directly based on the business code matching result.

4. The method for orderly rights management based on clock authorization according to claim 3, characterized in that: Change processing includes the following steps: Step S4321: Obtain information of the account to be changed; Step S4322: Determine whether the type of account needs to be changed to a temporary account. If so, set the account validity period to 0 to update the task authority code of the corresponding account and store it in the user authority table; if not, modify the relevant authority code value according to the preset logic.

5. The method for orderly rights management based on clock authorization according to claim 4, characterized in that: Expiration processing includes the following steps: Step S4331: Start the scheduled task manager and set the trigger according to the validity period; Step S4332: When the validity period has expired, the validity period code in the task authority code is automatically set to 0 to update the task authority code of the corresponding account and store it in the user authority table; Step S4333: Delete the trigger.

6. The method for orderly rights management based on clock authorization according to claim 1, characterized in that: The task authority code occupies 128 bits, and the task authority code includes six intervals: sign bit, timestamp bit, validity period bit, account type bit, business code bit, and operation authority bit.

Images