Permission allocation method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a permission allocation method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: displaying a permission allocation page; in response to a preset triggering operation based on the permission allocation page, updating a first permission range of the first permission to a second permission range of referencing a second permission; and in response to a permission allocation operation for the first permission, allocating the first permission with the first permission range to a first object. By means of the technical scheme, the permission distribution mode can be enriched, and the permission distribution and maintenance efficiency can be improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, apparatus, electronic device, storage medium, and program product for allocating permissions. Background Art

[0002] In Human Capital Management (HCM) systems, permission control can be used to manage the information and functions that users can view or use within their permissions, thereby ensuring data security. However, in related technologies, the method of allocating permissions is relatively simple, resulting in low efficiency in permission allocation and maintenance. Summary of the Invention

[0003] The embodiments of the present disclosure provide a permission allocation method, apparatus, electronic device, storage medium, and program product to enrich the permission allocation method and improve the efficiency of permission allocation and maintenance.

[0004] In a first aspect, an embodiment of the present disclosure provides a method for allocating permissions, including:

[0005] Display the permission allocation page;

[0006] In response to a preset trigger operation based on the permission allocation page, updating a first permission scope of the first permission to a second permission scope that references the second permission;

[0007] In response to the permission assignment operation for the first permission, the first permission having the first permission scope is assigned to the first object.

[0008] In a second aspect, an embodiment of the present disclosure further provides a rights allocation device, including:

[0009] Page display module, used to display the permission allocation page;

[0010] a scope updating module, configured to update a first permission scope of a first permission to a second permission scope that references a second permission in response to a preset triggering operation based on the permission allocation page;

[0011] The permission allocation module is configured to allocate the first permission with the first permission scope to the first object in response to a permission allocation operation on the first permission.

[0012] In a third aspect, an embodiment of the present disclosure further provides an electronic device, including:

[0013] one or more processors;

[0014] a memory for storing one or more programs,

[0015] When the one or more programs are executed by the one or more processors, the one or more processors implement the permission allocation method as described in the embodiment of the present disclosure.

[0016] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the permission allocation method as described in the embodiment of the present disclosure is implemented.

[0017] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product. When the computer program product is executed by a computer, the computer implements the permission allocation method as described in the embodiment of the present disclosure.

[0018] The permission allocation method, device, electronic device, storage medium and program product provided by the embodiments of the present disclosure support the permission to be allocated to inherit the permission scope of the already allocated permission. Compared with the technical solution of resetting the permission scope of the to-be-allocated permission independently of the already allocated permission, there is no need to manage and maintain these two permissions separately, which can enrich the permission allocation method, improve the efficiency of permission allocation and maintenance, and reduce the cost of permission allocation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0020] Figure 1 A flowchart of a method for allocating permissions provided in an embodiment of the present disclosure;

[0021] Figure 2 A schematic diagram of a permission allocation interface provided in an embodiment of the present disclosure;

[0022] Figure 3 A schematic diagram showing another permission allocation interface provided in an embodiment of the present disclosure;

[0023] Figure 4 A flowchart of another method for allocating permissions provided by an embodiment of the present disclosure;

[0024] Figure 5 A schematic diagram of a process of allocating a first role and a second role provided in an embodiment of the present disclosure;

[0025] Figure 6 A schematic diagram of a reference relationship between a first role and a second role provided in an embodiment of the present disclosure;

[0026] Figure 7A structural block diagram of a rights allocation device provided in an embodiment of the present disclosure;

[0027] Figure 8 A schematic structural diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0029] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0030] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0031] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0032] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0033] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0034] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0035] Figure 1This is a flowchart of a permission allocation method provided by an embodiment of the present disclosure. The method can be performed by a permission allocation device, wherein the device can be implemented by software and / or hardware and can be configured in an electronic device, typically a computer, mobile phone, or tablet computer. The permission allocation method provided by an embodiment of the present disclosure is applicable to permission configuration scenarios, such as scenarios where permission configuration is performed by referencing the permission scope of an assigned permission.

[0036] Traditional RBAC-based permission control solutions separate users from permissions, assigning users to different roles and granting corresponding permissions to these roles, thereby controlling user access to system resources. However, traditional role-based access control (RBAC) solutions struggle to adapt to rapidly changing system requirements. For example, they cannot dynamically adjust permissions based on specific contextual information, and in particular, they cannot dynamically inherit or append additional access permissions based on a user's already granted permissions.

[0037] In RBAC, once a user is assigned to a specific role, they gain access to the information and capabilities within that role's scope. To grant additional permissions to these users who meet specific criteria, traditional RBAC solutions require creating and managing a separate role and reassigning it to the designated user. This requires administrators to maintain both roles and their assigned logic. Furthermore, if the role assigned to a user changes, administrators must update the logic for both roles separately. Traditional RBAC access control solutions are unable to dynamically adjust to these changes and rely on manual effort to manage permissions, resulting in high maintenance costs.

[0038] In view of this, the embodiment of the present disclosure provides a permission allocation method that supports the new permission to be allocated to inherit the data range of one or more original permissions assigned to each user, which can enrich the permission allocation method and improve the efficiency of permission management and maintenance.

[0039] like Figure 1 As shown, the permission allocation method provided in this embodiment may include:

[0040] S101. Display a rights allocation page.

[0041] The permission allocation page may be a page for performing permission allocation, such as a page for allocating a certain created permission, or a page for selecting one or more permissions and allocating them.

[0042] In this embodiment, the permission allocation page can be displayed. For example, when an allocation page display operation is received from a relevant person (such as a permission management person), the permission allocation page is displayed in response to the allocation page display operation. Figure 2As shown, it is convenient for the permission allocation personnel to allocate permissions based on this permission allocation page.

[0043] Please continue to refer to Figure 2 The permission allocation page may include an attribute condition area 20, a permission area 21, and / or a permission range area 22. The attribute condition area 20 may be used to select the object to be authorized (e.g., user, etc.), such as for setting the screening conditions for the user to be authorized. The permission area 21 may be used to set the permission to be allocated (e.g., the first permission). The permission range area 22 may be used to set the permission range of the permission to be allocated.

[0044] S102: In response to a preset triggering operation based on the permission allocation page, update a first permission scope of the first permission to a second permission scope that references the second permission.

[0045] Among them, the first permission can be understood as the permission to be assigned this time, such as the permission corresponding to the role to be assigned this time, and the number can be one or more. A role is a "label" predefined or dynamically configured by the system, representing the functions or responsibilities of a user in an organization, such as "administrator", "ordinary user", etc. By assigning permissions to roles (rather than directly associating users), batch management and dynamic adjustment of permissions can be achieved, reducing system complexity. This embodiment uses role-based permission allocation as an example for explanation. A role may contain one or more permissions. The second permission can be understood as the permission of the first permission that references its permission scope. In other words, at least part of the permission scope of the second permission is inherited by the permission scope of the first permission.

[0046] The first permission scope can be understood as the permission scope of the first permission, such as the data management scope of the first role to be assigned. The second permission scope can be understood as the permission scope of the second permission, such as the data management scope of the second role corresponding to the second permission. The permission scope of a certain permission (such as the first permission and / or the second permission, etc.) can be understood as the data scope supported by the permission for access and management, such as the data scope of the data that the permission supports the user to access and manage.

[0047] The preset trigger operation may be a trigger operation for instructing to set the first permission scope of the first permission to reference at least a portion of the second permission scope of the second permission. The execution method of the preset trigger operation is not limited. For example, the preset trigger operation may be an operation for triggering a control or editing certain content, such as an operation for adding an object attribute condition corresponding to the second permission, or an operation for referencing the permission scope of the second permission, etc.

[0048] Specifically, in the case of receiving a preset trigger operation based on the permission allocation page, the first permission scope of the first permission can be updated to reference at least part of the second permission scope of the second permission in response to this preset trigger operation. For example, in response to this preset trigger operation, a reference relationship between the first permission scope of the first permission and the second permission scope of the second permission can be established, so that the first permission scope of the first permission inherits at least part of the second permission scope of the second permission.

[0049] S103: In response to the permission assignment operation for the first permission, assign the first permission with the first permission scope to the first object.

[0050] Among them, the permission allocation operation can be a trigger operation for indicating the allocation of the first permission, such as a trigger operation for indicating the allocation of the role corresponding to the first permission to one or more objects. The execution method of the permission allocation operation is not limited. Exemplarily, this permission allocation operation can be an operation of triggering the allocation control displayed in the permission allocation page or an operation of executing a preset allocation gesture in the permission allocation page. The first object can be understood as an object to be assigned the first permission, such as an object to be assigned the first role corresponding to the first permission. The type of the first object is not limited, such as the first object can include but is not limited to users. The first object may or may not be associated with the second object having the second permission. For example, the first object may include and / or exclude at least part of the second object having the second permission. Optionally, the first object includes at least part of the second object having the second permission. For example, at least part of the second object having the second permission can be obtained as the first object to be assigned the first permission. This second object can be understood as an object with the second permission, such as an object that has been assigned the second role corresponding to the second permission.

[0051] Exemplarily, when a permission assignment operation for a first permission is received, the first permission may be assigned to the first object based on a first permission scope of the first permission.

[0052] Taking the role-based permission allocation as an example, after receiving the allocation control 23 (such as Figure 2 In the event of a trigger operation (as shown), it can be determined that a permission assignment operation for the first permission has been received. In response to this permission assignment operation, the data management scope of the second role assigned to the first object is determined. Based on this data management scope, the data management scope of the first role to be assigned to the first object is determined, and the first role with this data management scope is assigned to the first object. Specifically, for the same role, the data management scopes of different users assigned this role can be the same or different, and can be set as needed.

[0053] The permission allocation method provided in this embodiment displays a permission allocation page; in response to a preset trigger operation based on this permission allocation page, updates the first permission scope of the first permission to a second permission scope that references the second permission; and in response to the permission allocation operation for the first permission, allocates the first permission with the first permission scope to the first object. This embodiment utilizes the above-mentioned technical solution to support the permission to be allocated to inherit the permission scope of the already allocated permission. Compared with the technical solution of resetting the permission scope of the permission to be allocated independently of the already allocated permission, there is no need to manage and maintain these two permissions separately, which can enrich the permission allocation method, improve the efficiency of permission allocation and maintenance, and reduce the permission allocation and maintenance costs.

[0054] In some embodiments, the first permission scope includes at least one permission scope entry, and in response to a preset trigger operation based on the permission allocation page, updating the first permission scope of the first permission to a second permission scope that references the second permission includes: in response to a preset trigger operation based on the permission allocation page, adding a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page.

[0055] Among them, the first permission scope may include one or more permission scope entries, and the operational relationship between different permission scope entries can be set as needed. For example, the operation relationship between two permission scope entries can be set to "or" or "and". This permission scope entry can be understood as an entry that constitutes the first permission scope, such as a sub-permission scope. The preset permission scope entry can be a permission scope entry that references the second permission scope of the second permission. For example, the sub-permission scope corresponding to the preset permission scope entry can inherit the second permission scope of the second permission by reference.

[0056] Specifically, when a preset trigger operation based on the permission allocation page is received, a preset permission range entry 30 referencing the second permission range of the second permission can be added to the permission range area 22 of the permission allocation page in response to the preset trigger operation, such as Figure 3 As shown, a reference relationship is established between the first permission scope of the first permission and the second permission scope of the second permission.

[0057] In some embodiments, after a user adds an object attribute condition corresponding to a certain permission (such as a second permission), a permission scope entry referencing the permission scope of this permission can be automatically added to the permission scope area of ​​the permission allocation page, without the user having to add it by editing the permission scope entry, thereby simplifying the operations that the user needs to perform. In this case, optionally, in response to a preset trigger operation based on the permission allocation page, adding a preset permission scope entry referencing the second permission scope in the permission scope area of ​​the permission allocation page includes: in response to an attribute condition adding operation for an object permission attribute condition corresponding to the second permission, adding a preset permission scope entry referencing the second permission scope in the permission scope area of ​​the permission allocation page. For example, in the case of receiving a trigger operation for indicating the addition of an object permission attribute condition corresponding to the second permission, an object permission attribute condition corresponding to the second permission can be added to the attribute condition area of ​​the permission allocation page, and a preset permission scope entry referencing the second permission scope of this second permission can be added to the permission scope area of ​​the permission allocation page, such as Figure 3 shown.

[0058] In some embodiments, when a permission scope entry addition operation is received, a preset permission scope entry referencing the second permission scope of the second permission can be added in the permission scope area of ​​the permission allocation page. For example, when it is detected that a user adds an object attribute condition corresponding to the second permission, the preset permission scope entry referencing the second permission scope of the second permission is not automatically added in the permission scope area of ​​the permission allocation page. Instead, after receiving a permission scope entry addition operation for indicating the addition of a preset permission scope entry, the preset permission scope entry corresponding to the second permission scope of the second permission is added in response to the permission scope entry addition operation to improve the practicality of the added preset permission scope entry.

[0059] Optionally, in response to a preset trigger operation based on the permission allocation page, adding a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page includes: in response to the permission scope entry adding operation based on the permission allocation page, adding a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page.

[0060] For example, when it is detected that the user triggers the scope condition adding control 24 displayed in the authority scope area 22 of the authority allocation page, it can be determined that the authority scope entry adding operation is received. In response to this authority scope entry adding operation, the authority scope entry to be edited is added in the authority scope area 22 of the authority allocation page, such as Figure 2and, upon receiving an edit operation for this permission range entry, editing this permission range entry based on this edit operation, such as editing each attribute information of this permission range entry, obtaining a preset permission range entry 30 for the second permission range that references the second permission, such as Figure 3 shown.

[0061] It should be noted that, in addition to supporting the addition of a permission scope entry referencing the second permission scope in the permission scope area of ​​the permission allocation page, this embodiment may also support the addition of a permission scope entry referencing a permission scope of other assigned permissions other than the second permission, and / or the addition of a permission scope entry that does not reference a permission scope of an assigned permission. When there are multiple permission scope entries, the operational relationship between different permission scope entries may be set as needed.

[0062] In some embodiments, since the first permission scope of the first permission references the second permission scope of the second permission, when the second permission scope of the second permission changes, the first permission scope of the first permission can be automatically updated without relying on manual sorting of the permission management logic and adjusting the first permission scope based on changes in the second permission scope. This can achieve timely updates of the first permission scope and reduce the manpower required to update the first permission scope.

[0063] Optionally, after assigning the first permission with the first permission scope to the first object, it also includes: in response to a permission scope update event of the second permission, updating the first permission scope based on the permission scope update result of the second permission, wherein the permission scope update event is used to update the second permission scope of the second permission.

[0064] The permission scope update event of the second permission may be understood as an event of updating the permission scope of the second permission.

[0065] Exemplarily, when a permission scope update event for a second permission is detected, the first permission scope that references the second permission scope can be updated based on the second permission scope after the second permission scope is updated in response to the permission scope update event. For example, when a permission scope update operation for a second permission is received, the second permission scope of the second permission can be updated; and, in response to the update of the second permission scope, the first permission scope of the first permission can be updated based on the updated second permission scope.

[0066] Figure 4A flow chart of another permission assignment method provided for an embodiment of the present disclosure. The scheme in this embodiment can be combined with one or more optional schemes in the above-mentioned embodiments. Optionally, after the permission assignment boundary is displayed, it also includes: in response to the attribute condition adding operation based on the permission assignment page, adding at least one object attribute condition in the attribute condition area of ​​the permission assignment page, the at least one object attribute condition includes an object permission attribute condition corresponding to the second permission; in response to the permission assignment operation for the first permission, assigning the first permission with the first permission range to the first object, including: in response to the permission assignment operation for the first permission, determining a first object that matches the at least one object attribute condition, and assigning the first permission with the first permission range to the first object.

[0067] Correspondingly, such as Figure 4 As shown, the permission allocation method provided in this embodiment may include:

[0068] S201: Display the permission allocation page.

[0069] S202. In response to an attribute condition adding operation based on the permission allocation page, add at least one object attribute condition in the attribute condition area of ​​the permission allocation page, wherein the at least one object attribute condition includes an object permission attribute condition corresponding to the second permission.

[0070] Among them, the attribute condition adding operation can be a triggering operation for indicating the addition of object attribute conditions in the attribute condition area of ​​the permission allocation page. The execution method of the attribute condition adding operation is not limited. For example, this attribute condition adding operation can be an operation for adding an attribute condition control displayed in the attribute condition area of ​​the trigger permission allocation page, or an operation for performing a preset attribute condition adding gesture, etc. The object attribute condition can be a condition for determining the object to be assigned permissions, such as the attribute condition that the object to be assigned the first permission must meet. The object permission attribute condition can be a condition that the permission attribute of the object to be assigned permissions must meet. For example, the object permission attribute condition corresponding to a certain permission (such as the second permission, etc.) can include that the corresponding object has been assigned this permission or that the corresponding object has not been assigned this permission, etc. The following is an example of the object permission attribute condition corresponding to a certain permission being that the corresponding object has been assigned this permission.

[0071] Specifically, when an attribute condition adding operation based on the permission allocation page is received, one or more object attribute conditions can be added to the attribute condition area of ​​the permission allocation page based on this attribute condition adding operation, so as to filter and determine the first object to which permissions are to be assigned based on the added object attribute condition.

[0072] For example, when it is detected that the user triggers the attribute condition adding control 25 displayed in the attribute condition area 20 of the permission allocation page, it can be determined that the attribute condition adding operation is received. In response to this attribute condition adding operation, the attribute condition to be edited is added in the attribute condition area 22 of the permission allocation page, such as Figure 2 and, upon receiving an edit operation for the attribute condition to be edited, editing the attribute condition based on the edit operation, such as editing each attribute information of the attribute condition to obtain the edited attribute condition 30, such as editing the object authority attribute condition 31 corresponding to the second authority, Figure 3 shown.

[0073] It should be noted that, in addition to supporting the addition of object permission attribute conditions corresponding to the second permission in the attribute condition area of ​​the permission assignment page, this embodiment also supports the addition of other object attribute conditions corresponding to object attributes other than permission attributes (such as department attributes or position attributes). When there are multiple object attribute conditions, the operational relationships between different object attribute conditions can be set as needed.

[0074] S203: In response to a preset triggering operation based on the permission allocation page, update the first permission scope of the first permission to a second permission scope that references the second permission.

[0075] S204: In response to the permission assignment operation for the first permission, determine a first object that matches the at least one object attribute condition, and assign the first permission with a first permission range to the first object.

[0076] Specifically, when a permission allocation operation for the first permission is received, based on the object attribute conditions added in the attribute condition area of ​​the permission allocation page and the operational relationship between the object attribute conditions, objects whose attribute information matches them can be obtained as first objects, and the first permission with a first permission range can be allocated to each first object.

[0077] In some embodiments, since the object permission attribute condition corresponds to the second permission, in other words, the first object references at least part of the second object of the second permission, when the second object of the second permission changes, the first object of the first permission can be automatically updated without relying on manual sorting of the permission management logic and adjusting the first object based on the changes of the second object. This can achieve timely updates of the first object and reduce the manpower required to update the first object.

[0078] Optionally, after assigning the first permission with the first permission scope to the first object, it also includes: responding to an object update event of the second permission, updating the first object based on the object update result of the second permission, wherein the object update event is used to update the second object with the second permission.

[0079] The object update event of the second permission can be understood as an event of updating the second object assigned the second permission.

[0080] Exemplarily, in the case where an object update event of the second permission is detected, the first object of the first permission can be updated based on the second object after the second permission is updated in response to the object update event. For example, in the case where an object update operation for the second permission is received, the second object of the second permission can be updated; and in response to the update of the second object, the first object of the first permission can be updated based on the updated second object, such as assigning the first permission to the newly added second object that meets the object attribute conditions of the first permission, and / or further canceling the first permission of the second object that no longer meets the object attribute conditions of the first permission after the second permission is canceled, and so on.

[0081] Figure 5 A schematic diagram of a process of allocating a first role to a second role provided in an embodiment of the present disclosure is provided. Figure 6 A schematic diagram of a reference relationship between a first role and a second role provided in an embodiment of the present disclosure. Figure 5 and Figure 6 As shown, taking the example of allocating a first permission based on a first role, allocating a second permission based on a second role, the permission scope of the first permission is a first data range accessible to the first role, and the permission scope of the second permission is a second data range accessible to the second role;

[0082] In some optional implementations, it is possible to support selecting a user (ie, second object) who has been assigned a specified role (ie, second role) as the assignee (ie, first object) of a new role (ie, first role).

[0083] For example, in the system, when selecting users who need to be assigned roles, it is possible to support the identification of the required users through multiple attributes. Specifically, this solution supports the identification of the required users through the roles that the users have been assigned before as identification conditions (i.e., object attribute conditions). For example, assuming that the user has been assigned the role of "local human resources business partner (HR Business Partner, BP)" before, the users who have been assigned the role of "local BP" can be easily identified. Moreover, if the user assigned the role of "local BP" changes, this embodiment supports automatic updating of the identified users. In addition, it also supports the addition of other conditions for identifying user attributes to refine the scope of the users to be identified.

[0084] In some optional implementations, it can be supported that when assigning a new role (such as the first role), the inheritors are each assigned the data scope (i.e., the second authority scope) of the original role (such as the second role), and additional data scopes can be added to achieve refined allocation of data scopes.

[0085] For example, in the system, after selecting a new role to be assigned, the data scope of the assigned person in the original role can be inherited. For example, if a user has been previously assigned the "Local BP" role and can view or manage the data scope of "Department A", then the data scope of the department that can be viewed or managed can be easily inherited as "Department A" in the new "Change HR" role to be assigned. Moreover, if the data scope of the "Local BP" role assigned to the user changes from "Department A" to "Department B", this embodiment supports automatically updating the department scope that the user can view and manage to "Department B" when the new "Change HR" role is assigned. In addition, it also supports adding other conditions for the data scope that the user can view or manage when the new role is assigned to refine the data scope that needs to be assigned.

[0086] The permission allocation method provided in this embodiment supports selecting at least some objects that have been assigned the second permission as the assigned objects of the first permission. There is no need to select each assigned object one by one, which can reduce the time required for selecting the assigned objects and further improve the efficiency of permission allocation.

[0087] Figure 7 This is a block diagram of a permission allocation device provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can be configured in an electronic device, typically a computer, a mobile phone or a tablet computer. Permissions can be configured by executing a permission allocation method, such as by referencing the permission range of the assigned permissions. Figure 7 As shown, the authority allocation device provided in this embodiment may include: a page display module 701, a range update module 702 and a authority allocation module 703, wherein:

[0088] The page display module 701 is used to display the permission allocation page;

[0089] A scope updating module 702 is configured to update a first permission scope of a first permission to a second permission scope that references a second permission in response to a preset triggering operation based on the permission allocation page;

[0090] The permission allocation module 703 is configured to allocate the first permission within the first permission range to the first object in response to the permission allocation operation for the first permission.

[0091] The permission allocation device provided in this embodiment displays a permission allocation page through a page display module; updates the first permission range of the first permission to a second permission range that references the second permission through a range update module in response to a preset trigger operation based on this permission allocation page; and allocates the first permission with this first permission range to the first object through the permission allocation module in response to the permission allocation operation for the first permission. This embodiment utilizes the above-mentioned technical solution to support the permission to be allocated to inherit the permission range of the already allocated permission. Compared with the technical solution of resetting the permission range of the permission to be allocated independently of the already allocated permission, there is no need to manage and maintain these two permissions separately, which can enrich the permission allocation method, improve the efficiency of permission allocation and maintenance, and reduce the permission allocation and maintenance costs.

[0092] Optionally, the first object includes at least part of a second object having the second permission.

[0093] Furthermore, the permission allocation device may also include: an attribute condition adding module for adding at least one object attribute condition in the attribute condition area of ​​the permission allocation page in response to an attribute condition adding operation based on the permission allocation page after the permission allocation boundary is displayed, wherein the at least one object attribute condition includes an object permission attribute condition corresponding to the second permission; the permission allocation module 703 may be specifically used to: determine a first object that matches the at least one object attribute condition in response to a permission allocation operation for the first permission, and assign the first permission with a first permission range to the first object.

[0094] Furthermore, the permission allocation device may also include: an object update module, which is used to update the first object based on the object update result of the second permission in response to an object update event of the second permission after allocating the first permission with the first permission range to the first object, wherein the object update event is used to update the second object with the second permission.

[0095] Optionally, the first permission scope includes at least one permission scope entry, and the scope update module 702 can be specifically used to: in response to a preset trigger operation based on the permission allocation page, add a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page.

[0096] Optionally, the scope update module 702 can be specifically used to: in response to an attribute condition adding operation for the object permission attribute condition corresponding to the second permission, add a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page; and / or, in response to an authority scope entry adding operation based on the permission allocation page, add a preset permission scope entry that references the second permission scope in the permission scope area of ​​the permission allocation page.

[0097] Furthermore, the permission allocation device may also include: a range update module, which is used to update the first permission scope based on the permission scope update result of the second permission in response to the permission scope update event of the second permission after the first permission with the first permission scope is allocated to the first object, wherein the permission scope update event is used to update the second permission scope of the second permission.

[0098] The rights allocation device provided in the embodiments of the present disclosure can execute the rights allocation method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of executing the rights allocation method. For technical details not fully described in this embodiment, please refer to the rights allocation method provided in any embodiment of the present disclosure.

[0099] Reference below Figure 8 , which shows a schematic structural diagram of an electronic device (e.g., terminal device 800) suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 8 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0100] like Figure 8As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. Various programs and data required for the operation of the electronic device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0101] Typically, the following devices may be connected to the I / O interface 805: an input device 806 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 808 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The electronic device 800 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0102] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 809, or installed from the storage device 808, or installed from the ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0103] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0104] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0105] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0106] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: displays a permission allocation page; in response to a preset trigger operation based on the permission allocation page, updates the first permission scope of the first permission to a second permission scope that references the second permission; in response to the permission allocation operation for the first permission, allocates the first permission with the first permission scope to the first object.

[0107] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0108] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The units involved in the embodiments described in this disclosure may be implemented in software or hardware, wherein the name of a module does not, in some cases, limit the unit itself.

[0110] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0111] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] According to one or more embodiments of the present disclosure, Example 1 provides a method for allocating permissions, including:

[0113] Display the permission allocation page;

[0114] In response to a preset trigger operation based on the permission allocation page, updating a first permission scope of the first permission to a second permission scope that references the second permission;

[0115] In response to the permission assignment operation for the first permission, the first permission having the first permission scope is assigned to the first object.

[0116] According to one or more embodiments of the present disclosure, Example 2 provides the method according to Example 1, wherein the first object includes at least part of the second object having the second permission.

[0117] According to one or more embodiments of the present disclosure, Example 3 is the method according to Example 2, further comprising, after displaying the permission allocation boundary:

[0118] In response to an attribute condition adding operation based on the permission allocation page, adding at least one object attribute condition in the attribute condition area of ​​the permission allocation page, the at least one object attribute condition including an object permission attribute condition corresponding to the second permission;

[0119] In response to the permission assignment operation for the first permission, assigning the first permission with the first permission scope to the first object includes:

[0120] In response to the permission assignment operation for the first permission, a first object matching the at least one object attribute condition is determined, and the first permission with a first permission range is assigned to the first object.

[0121] According to one or more embodiments of the present disclosure, Example 4 is the method according to Example 2, and further includes, after assigning the first permission with the first permission scope to the first object:

[0122] In response to an object update event of the second permission, the first object is updated based on an object update result of the second permission, wherein the object update event is used to update the second object with the second permission.

[0123] According to one or more embodiments of the present disclosure, Example 5 is the method according to any one of Examples 1-4, wherein the first permission scope includes at least one permission scope entry, and in response to a preset trigger operation based on the permission allocation page, updating the first permission scope of the first permission to a second permission scope that references the second permission includes:

[0124] In response to a preset trigger operation based on the permission allocation page, a preset permission range entry referencing the second permission range is added to the permission range area of ​​the permission allocation page.

[0125] According to one or more embodiments of the present disclosure, Example 6, according to the method of Example 5, wherein, in response to a preset trigger operation based on the permission allocation page, adding a preset permission range entry referencing the second permission range in the permission range area of ​​the permission allocation page includes:

[0126] In response to an attribute condition adding operation for an attribute condition of an object permission corresponding to the second permission, adding a preset permission scope entry referencing the second permission scope in the permission scope area of ​​the permission allocation page; and / or

[0127] In response to the permission range entry adding operation based on the permission allocation page, a preset permission range entry referencing the second permission range is added in the permission range area of ​​the permission allocation page.

[0128] According to one or more embodiments of the present disclosure, Example 7, according to the method of any one of Examples 1-4, further includes, after assigning the first permission with the first permission scope to the first object:

[0129] In response to a permission scope update event of the second permission, the first permission scope is updated based on a permission scope update result of the second permission, wherein the permission scope update event is used to update the second permission scope of the second permission.

[0130] According to one or more embodiments of the present disclosure, Example 8 provides a rights allocation device, including:

[0131] Page display module, used to display the permission allocation page;

[0132] a scope updating module, configured to update a first permission scope of a first permission to a second permission scope that references a second permission in response to a preset triggering operation based on the permission allocation page;

[0133] The permission allocation module is configured to allocate the first permission with the first permission scope to the first object in response to a permission allocation operation on the first permission.

[0134] According to one or more embodiments of the present disclosure, Example 9 provides an electronic device, including:

[0135] one or more processors;

[0136] a memory for storing one or more programs,

[0137] When the one or more programs are executed by the one or more processors, the one or more processors implement the permission allocation method as described in any one of Examples 1-7.

[0138] According to one or more embodiments of the present disclosure, Example 10 provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the permission allocation method as described in any one of Examples 1-7.

[0139] According to one or more embodiments of the present disclosure, Example 11 provides a computer program product. When the computer program product is executed by a computer, the computer implements the permission allocation method described in any one of Examples 1-7.

[0140] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0141] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0142] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for allocating permissions, characterized in that: include: Display the permission allocation page; In response to a preset trigger operation based on the permission allocation page, updating a first permission scope of the first permission to a second permission scope that references the second permission; In response to the permission assignment operation for the first permission, the first permission having the first permission scope is assigned to the first object.

2. The method according to claim 1, characterized in that The first object includes at least a portion of a second object having the second permission.

3. The method according to claim 2, characterized in that After the display permission allocation interface, the following is also included: In response to an attribute condition adding operation based on the permission allocation page, adding at least one object attribute condition in the attribute condition area of ​​the permission allocation page, the at least one object attribute condition including an object permission attribute condition corresponding to the second permission; In response to the permission assignment operation for the first permission, assigning the first permission with the first permission scope to the first object includes: In response to the permission assignment operation for the first permission, a first object matching the at least one object attribute condition is determined, and the first permission with a first permission range is assigned to the first object.

4. The method according to claim 2, characterized in that After allocating the first permission with the first permission range to the first object, the method further includes: In response to an object update event of the second permission, the first object is updated based on an object update result of the second permission, wherein the object update event is used to update the second object with the second permission.

5. The method according to any one of claims 1 to 4, characterized in that: The first permission scope includes at least one permission scope entry, and in response to a preset trigger operation based on the permission allocation page, updating the first permission scope of the first permission to a second permission scope that references the second permission includes: In response to a preset trigger operation based on the permission allocation page, a preset permission range entry referencing the second permission range is added to the permission range area of ​​the permission allocation page.

6. The method according to claim 5, characterized in that The step of adding a preset permission range entry referencing the second permission range in the permission range area of ​​the permission allocation page in response to a preset trigger operation based on the permission allocation page includes: In response to an attribute condition adding operation for an attribute condition of an object permission corresponding to the second permission, adding a preset permission scope entry referencing the second permission scope in the permission scope area of ​​the permission allocation page; and / or In response to the permission range entry adding operation based on the permission allocation page, a preset permission range entry referencing the second permission range is added in the permission range area of ​​the permission allocation page.

7. The method according to any one of claims 1 to 4, characterized in that: After allocating the first permission with the first permission range to the first object, the method further includes: In response to a permission scope update event of the second permission, the first permission scope is updated based on a permission scope update result of the second permission, wherein the permission scope update event is used to update the second permission scope of the second permission.

8. A rights allocation device, characterized in that: include: Page display module, used to display the permission allocation page; a scope updating module, configured to update a first permission scope of a first permission to a second permission scope that references a second permission in response to a preset triggering operation based on the permission allocation page; The permission allocation module is configured to allocate the first permission with the first permission scope to the first object in response to a permission allocation operation on the first permission.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the rights allocation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the rights allocation method according to any one of claims 1 to 7 when executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the rights allocation method according to any one of claims 1 to 7.

Images