Method for managing user authority for operating resources

Abstract

The invention relates to a method for managing user permission for operating resources, and the method comprises the steps: obtaining a first operation permission character string which indicates the user permission for performing first operation on target resources, and an identity label of at least one user which needs to verify or modify the permission for performing the first operation on the target resources, the first operation authority character string comprises a plurality of characters with two values, and the position of each character in the first operation authority character string has a mapping relation with each identity label; a user identity character string is generated based on the identity label of the at least one user, and the user identity character string comprises a plurality of characters with two values, and the number of the characters of the characters is the same as that of the characters of the first operation permission character string; and performing operation on the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user for performing the first operation on the target resource. According to the invention, refined authority management is realized, and the efficiency of user authority management is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method for managing user rights for operating resources. Background Art

[0002] User rights management plays a vital role in the stable operation of businesses. For example, in businesses targeting individuals or enterprises, user rights management ensures smooth business processes, data security, and regulatory compliance. For example, by managing user access rights to data and other resources, user rights management ensures that users can only perform authorized operations. This protects sensitive information from being leaked, prevents data and other resources from being modified erroneously or maliciously, and safeguards business systems from malicious attacks. Summary of the Invention

[0003] In the permission management methods known to the inventors of this disclosure, users with the same attributes (e.g., users with the same operating permissions for the same resource) are typically assigned the same role, and a mapping relationship between resources and roles is established. When verifying a user's operating permissions for a resource, it is necessary to query the role to which the user belongs to obtain the user's operating permissions for the current resource, and then determine whether the user has the current operating permissions for the current resource.

[0004] Such a permission management method may have many problems. For example, in the scenario of fine-grained management of resources, multiple operations and multiple roles are involved, and each role needs to be clearly defined for each operation permission for each resource. However, it may be difficult to extract the common attributes of multiple users to assign the same role to multiple users. Instead, it is necessary to set up multiple roles for each resource and each operation and establish a mapping relationship between each operation of each resource and each role. For example, suppose there are X resources and there are Y1 to Y2 for each resource. X For each resource, there are two situations: one with permission for each operation and the other without permission for each operation. Therefore, a total of 2 (Y1+Y2+…Y X )-power roles. When adding new resources or operations, you need to add the corresponding number of roles and reset the mapping relationships of all roles. In addition, when verifying a user's permission to perform a certain operation on a certain resource, you need to query the user's roles to obtain all the user's operation permissions for all resources, and then determine whether the user has the current operation permission for the current resource. This greatly increases the complexity and difficulty of permission management, reduces management and verification efficiency, and is not suitable for refined management scenarios.

[0005] In view of this, the present disclosure proposes a method, device, electronic device, storage medium and computer program product for managing user permissions to operate resources, which are used to solve the technical problems of the above-mentioned permission management methods in related technologies, such as high management complexity and difficulty, low management and verification efficiency, and unsuitability for refined management scenarios.

[0006] According to one aspect of the present disclosure, a method for managing user rights for operating resources is provided, the method comprising:

[0007] Obtaining a first operation permission string indicating user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified or modified, wherein the first operation permission string includes a plurality of characters having two values, a position of each of the plurality of characters in the first operation permission string having a mapping relationship with each of a plurality of preset identity identifiers, each character having a first value of the two values ​​indicating that the user with the corresponding identity identifier has permission to perform the first operation on the target resource, and each character having a second value of the two values ​​indicating that the user with the corresponding identity identifier does not have permission to perform the first operation on the target resource;

[0008] generating a user identity string based on the identity identifier of the at least one user, wherein the user identity string includes a plurality of characters having the two values, the same number as the number of characters in the first operation permission string, and in the user identity string, characters located at positions corresponding to the identity identifier of each user of the at least one user according to the mapping relationship have the first value, and other characters have the second value;

[0009] An operation is performed on the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource.

[0010] In a possible implementation, the operating the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes:

[0011] Performing an AND operation on the first operation authority character string and the user identity character string to obtain an AND operation result character string;

[0012] The authority of the at least one user to perform the first operation on the target resource is verified according to the AND operation result character string.

[0013] In a possible implementation, verifying the permission of the at least one user to perform the first operation on the target resource based on the AND operation result character string includes:

[0014] In the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, it is determined that the corresponding user has the authority to perform the first operation on the target resource, and when the character is a second value, it is determined that the corresponding user does not have the authority to perform the first operation on the target resource.

[0015] In a possible implementation, the operating the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes:

[0016] Performing an OR operation on the first operation authority character string and the user identity character string to obtain an OR operation result character string;

[0017] The first operation permission character string is modified into the OR operation result character string, thereby enabling the at least one user to have permission to perform the first operation on the target resource.

[0018] In a possible implementation, the operating the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes:

[0019] Subtract the user identity string from the first operation authority string to obtain a subtraction result string;

[0020] The first operation permission character string is modified to the subtraction result character string, thereby canceling the permission of the at least one user to perform the first operation on the target resource.

[0021] In a possible implementation, the method further includes:

[0022] Obtain a second operation permission character string indicating the user's permission to perform a second operation on the target resource;

[0023] Performing an AND operation on the first operation permission character string and the second operation permission character string to obtain an AND operation result character string;

[0024] A user who has the authority to perform both the first operation and the second operation on the target resource is determined according to the AND operation result character string.

[0025] In a possible implementation, determining a user who has permission to perform both the first operation and the second operation on the target resource based on the AND operation result character string includes:

[0026] In the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, it is determined that the corresponding user has the authority to perform the first operation and the second operation on the target resource at the same time, and when the character is a second value, it is determined that the corresponding user does not have the authority to perform the first operation and the second operation on the target resource at the same time.

[0027] According to another aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0028] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, or a non-volatile computer-readable storage medium carrying the computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0030] The above aspects of the present disclosure use a binary operation permission string to indicate the user permissions of multiple users for each operation on each resource, thereby refining the user's operation permissions for resources to the permission of each user for each operation on each resource, thereby achieving refined management of user permissions. In addition, there is no need to group resources and / or divide users into roles, but only to maintain a binary string for each resource and each operation, which improves the management efficiency of user permissions and greatly reduces the complexity and difficulty of management. In addition, when adding new resources or adding new operations, only a binary string needs to be added, which is simple and easy to implement, and improves management efficiency. On the other hand, the operation permissions of at least one user for resources can be verified or modified by performing operations on the operation permission string and the user identity string, which simplifies the verification and modification process, further reduces the complexity and difficulty of management and improves the management and verification efficiency.

[0031] Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0033] Figure 1 A schematic diagram illustrating an application scenario according to an embodiment of the present disclosure is shown.

[0034] Figure 2 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0035] Figure 3 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0036] Figure 4 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0037] Figure 5 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0038] Figure 6 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0039] Figure 7 A structural diagram of an apparatus for managing user rights for operating resources according to an embodiment of the present disclosure is shown.

[0040] Figure 8 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0041] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0042] As used herein, the terms "comprises," "comprising," "having," or variations thereof are open ended and include one or more stated features, integers, elements, steps, parts, or functions, but do not preclude the presence or addition of one or more other features, integers, elements, steps, parts, functions, or groups thereof.

[0043] When an element is referred to as being "connected," "coupled," "responsive" or variations thereof to another element, it can be directly connected, coupled or responsive to the other element or intervening elements may be present.

[0044] Although the terms first, second, third, etc. may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another element / operation. Therefore, without departing from the teachings of the present invention, the first element / operation in some embodiments may be referred to as the second element / operation in other embodiments.

[0045] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0046] In addition, numerous specific details are provided in the following detailed description to better illustrate the present disclosure. Those skilled in the art will appreciate that the present disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main points of the present disclosure.

[0047] User rights management ensures smooth business processes and safeguards the security and integrity of resources. For example, when the resource is data, user rights management can precisely control user access rights to data, preventing unauthorized access and thus protecting sensitive information from being leaked and data from malicious attacks. In terms of maintaining data integrity, user rights management ensures that users can only make authorized modifications to data, preventing erroneous or malicious modifications and maintaining data consistency and accuracy.

[0048] In the related art, when performing user rights management, a role management approach is usually adopted, where multiple users with the same attributes (users with the same operating permissions for the same resource, such as employees belonging to the same department or holding the same position in a company) are assigned to the same role. When it is necessary to verify the current user's operating permissions for a certain resource, the current user's operating permissions for the current resource are obtained by querying the current user's role, and then determining whether the current user has the current operating permissions for the current resource. This permission management approach involves attribute division of resources in the business and attribute division of users, so as to aggregate business resources into different resource groups and aggregate users into different roles, and establish mapping relationships between different roles and different resource groups. Each mapping relationship indicates whether the corresponding role has operating permissions for the corresponding resource group. For example, business resources can be divided into different resource groups based on resource type, such as X1 resources or X2 resources. Accordingly, users can be assigned to managers or ordinary users, and mapping relationships are established, such as X1 resources - managers, X2 resources - managers, X1 resources - ordinary users, and X2 resources - ordinary users. For another example, business resources can be divided into different resource groups based on resource type and the hierarchy of the object to which the resource belongs, such as company-level X1 type resources, group-level X1 type resources, company-level X2 type resources, and group-level X2 type resources. Correspondingly, users can be classified as managers or ordinary users at different levels, such as company-level managers or ordinary users, group-level managers or ordinary users, and mapping relationships can be established, such as company-level X1 type resource-company-level manager, company-level X1 type resource-company-level ordinary user, company-level X1 type resource-group-level manager, company-level X1 type resource-group-level ordinary user, group-level X1 type resource-group-level manager, group-level X1 type resource-group-level ordinary user, group-level X1 type resource-company-level manager, group-level X1 type resource-company-level ordinary user, company-level X2 type resource-company-level manager, company-level X2 type resource-company-level ordinary user, company-level X2 type resource-group-level manager, company-level X2 type resource-group-level ordinary user, group-level X2 type resource-group-level manager, group-level X2 type resource-group-level manager, group-level X2 type resource-group-level ordinary user, group-level X2 type resource-company-level manager, group-level X2 type resource-company-level manager.

[0049] This user rights management method has a simple and clear division of user rights. It reduces the rights management directly for a specific resource and a specific user by extracting the common attributes of different users to form a "role" and the common attributes of different business resources to form a "resource group". However, this user rights management method cannot achieve refined rights management for business resources. For example, when it is necessary to manage each operation permission of each user for each business resource, it may be difficult to extract the common attributes of multiple users to assign the same role to multiple users. Instead, it is necessary to set up multiple roles for each resource and each operation and establish a mapping relationship between each operation of each resource and each role. For example, suppose there are X types of resources and there are Y1 to Y for each resource. X For each resource, there are two situations: one with permission for each operation and the other without permission for each operation. Therefore, a total of 2 (Y1+Y2+…Y X )-power roles. When adding new resources or operations, you need to add the corresponding number of roles and reset the mapping relationships of all roles. In addition, when verifying a user's permission to perform a certain operation on a certain resource, you need to query the user's roles to obtain all the user's operation permissions for all resources, and then determine whether the user has the current operation permission for the current resource. This greatly increases the complexity and difficulty of permission management, reduces management and verification efficiency, and is not suitable for refined management scenarios.

[0050] For example, Figure 1 A schematic diagram of an application scenario according to an embodiment of the present disclosure is shown. Figure 1 As shown, the application scenario includes business resources such as printer 1, printer 2 ... printer N and computer 1, computer 2 ... computer M; wherein N and M are both positive integers.

[0051] If the user authority management method in the above-mentioned related technology is adopted, business resources can be classified into computer resources (including computer 1, computer 2...computer M) and printer resources (including printer 1, printer 2...printer N). At the same time, four roles, namely role K1, role K2, role K3 and role K4, can be set, and a mapping relationship between each role and each type of resource can be established. For example, the mapping relationship can be: role K1 has the authority to access computer resources and printer resources, role K2 only has the authority to access printer resources, role K3 only has the authority to access computer resources, and role K4 does not have the authority to access computer resources and printer resources. For example, when the role K3 is granted to a user, the user only has the authority to access computer resources, that is, the user can access each computer among computer 1, computer 2...computer M, but cannot access each printer among printer 1, printer 2...printer N. Alternatively, when the user is granted role K2, the user only has the permission to access printer resources, that is, the user can access each printer in printer 1, printer 2... printer N, but cannot access each computer in computer 1, computer 2... computer M. If the user permissions need to be further refined, for example, for computer resources, accessing computer 1, accessing computer 2, and accessing computer M are considered M operations, and the user's access operations to computer resources are expected to be specific to M operations of accessing M computers, then it is necessary to further set roles K1(1), role K1(2)... role K1(2 M ) and establish a mapping relationship between each role and each computer (each operation). For example, the mapping relationship can be: role K1(1) only has the permission to access computer 1, role K1(2) only has the permission to access computer 2... role K1(M+1) has the permission to access both computer 1 and computer 2... role K1(2 M ) has the permission to access all computers. The more computers the computer resources include (the larger M is), the more roles need to be set and the more mapping relationships need to be set. For example, actual business (such as data sales business for enterprises) usually involves a large number of computers, and the value of M is generally much greater than 10, so it is necessary to set much greater than 2. 10 (1024) roles. If we consider accessing printers 1 to N as N operations for printer resources, and consider both computer resources and printer resources, we need to set 2 M+Nroles. When adding a new resource and / or an operation, you need to add the corresponding number of roles and reset the mapping relationship of all roles. In addition, when verifying the user's permission to perform a certain operation on a certain resource, it is necessary to query the user's roles to obtain all the user's operation permissions for all resources, and then determine whether the user has the current operation permission for the current resource. This greatly increases the complexity and difficulty of permission management, and the management and verification efficiency is low, which is not suitable for refined management scenarios.

[0052] In order to solve the above technical problems, the present disclosure provides a method for managing user rights to operate on resources. The method associates each resource, each operation and each user, and uses a binary operation permission string to indicate the user rights to perform a certain operation on a certain resource, thereby accurately defining the user's operation rights for resources to the rights of each user to perform each operation on each resource, thereby achieving refined management of user rights. In addition, there is no need to group resources and / or divide users into roles, but only to maintain a binary string for each resource and each operation, which improves the management efficiency of user rights and greatly reduces the complexity and difficulty of management. In addition, when adding new resources or adding new operations, only a binary string needs to be added, which is simple and easy to implement, and improves management efficiency. On the other hand, the operation rights of at least one user for resources can be verified or modified by performing operations on the operation permission string and the user identity string, which simplifies the verification and modification process, further reduces the complexity and difficulty of management and improves management and verification efficiency.

[0053] Exemplarily, the method can be executed by an electronic device such as a terminal device, a server, or a part of an electronic device (such as a processor), wherein the terminal device can be a desktop terminal or a mobile terminal, for example, various types of electronic devices such as a laptop computer, a tablet computer, a desktop computer, a smart phone, a smart speaker, a smart watch, a smart TV, and a car terminal. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms.

[0054] It should be noted that the above Figure 1 The types of resources, the quantity of each resource, and the operations on the resources in the application scenario shown in the figure are only examples. The scenario may also include more or fewer types or quantities of resources and more types of operations, which is not limited to this.

[0055] The following describes in detail a method for managing user permissions for operating resources provided by the present disclosure.

[0056] Figure 2 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown. Figure 2 As shown, the method includes the following steps:

[0057] Step 201: Obtain a first operation permission character string indicating a user permission to perform a first operation on a target resource, and an identity identifier of at least one user who wants to verify or modify the permission to perform the first operation on the target resource.

[0058] The target resource may be any one of one or more resources. The one or more resources may be, for example, computing resources, storage resources, hardware resources, software resources, and other broad categories of resources, or they may be more specific resources such as computers / servers, processors, software, data, services, and the like. The first operation may represent any operation that can be performed on the target resource. Exemplarily, the first operation may include: access operations, setting operations, reading operations, writing operations, modifying operations on data, deleting operations on data, or sharing operations on data, and the like, without limitation. For example, in Figure 1 In the application scenario shown, the target resource can be, for example, any printer among printer 1, printer 2...printer N, and accordingly, the first operation can be, for example, an operation of printing using the printer, an operation of scanning using the printer, an operation of reading data in the printer, an operation of changing the settings of the printer, etc.; or, the target resource can be, for example, any computer among computer 1, computer 2...computer M, and accordingly, the first operation can be, for example, an operation of reading data in the computer, an operation of writing data to the computer, an operation of modifying data in the computer, an operation of deleting data in the computer, an operation of setting the computer, etc.

[0059] The first operation permission string includes multiple characters with two values, and the position of each character in the multiple characters in the first operation permission string has a mapping relationship with each identity identifier in the preset multiple identity identifiers. When each character is the first value of the two values, it indicates that the user of the corresponding identity identifier has the permission to perform the first operation on the target resource, and when each character is the second value of the two values, it indicates that the user of the corresponding identity identifier does not have the permission to perform the first operation on the target resource.

[0060] The user's identity identifier has a unique value, that is, the identity identifiers of different users are different. For example, if the user is an employee of a company, since different employees usually have unique work numbers, the employee's work number can be used as the employee's identity identifier. In this step, obtaining the identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified or modified refers to obtaining at least one identity identifier corresponding to the at least one user. In addition, it should be understood that each of the at least one identity identifier is included in the preset multiple identity identifiers corresponding to the multiple characters in the above-mentioned first operation permission string.

[0061] Exemplarily, the two values ​​of the multiple characters in the first operation permission string may include 0 and 1, where the first value indicating that the user has operation permission may be 1, and the second value indicating that the user does not have operation permission may be 0; or the first value indicating that the user has operation permission may be 0, and the second value indicating that the user does not have operation permission may be 1. Alternatively, the two values ​​of the multiple characters in the first operation permission string may include Y and N, where the first value indicating that the user has operation permission may be Y, and the second value indicating that the user does not have operation permission may be N. For example, taking the first value as 1, the second value as 0, and four preset identity identifiers A, B, C, and D as an example, the first operation permission string may include four characters with two values ​​of 0 and / or 1, and each character from left to right or from right to left is mapped to each identity identifier. For example, the rightmost character corresponds to identity identifier A, the second character from the right corresponds to identity identifier B, the third character from the right corresponds to identity identifier C, and the leftmost character corresponds to identity identifier D. When each character is 1, it indicates that the user of the corresponding identity identifier has permission to perform the first operation on the target resource. When each character is 0, it indicates that the user of the corresponding identity identifier has permission to perform the first operation on the target resource. Specifically, for example, the first operation string can be "1001", and the first character to the fourth character from the right in the string "1001" are mapped to identity identifiers A, B, C, and D in sequence. The first character "1" indicates that the user of identity identifier A has the authority to perform the first operation on the target resource, the second character "0" indicates that the user of identity identifier B does not have the authority to perform the first operation on the target resource, the third character "0" indicates that the user of identity identifier C does not have the authority to perform the first operation on the target resource, and the fourth character "1" indicates that the user of identity identifier D has the authority to perform the first operation on the target resource.

[0062] In one possible implementation, a unique identity identifier can be set for each of a plurality of users as needed to obtain multiple identity identifiers, and each user's permission to perform a first operation on a target resource can be set. Furthermore, for each resource in the plurality of resources and each operation in the plurality of operations, an operation permission string indicating the user's permission to perform a corresponding operation on the corresponding resource is generated. For example, the number of preset identity identifiers can be used as the number of characters in each operation permission string, and a mapping relationship between the position of each character in each operation permission string and each identity identifier is established, so that different characters in the corresponding operation permission string correspond to different identity identifiers. Furthermore, for each operation permission string, the value of each character can be determined based on the permission of the user whose identity identifier corresponds to the position of each character in the operation permission string to perform a corresponding operation on the corresponding resource. If the user whose identity identifier corresponds to the position of the character in the operation permission string has permission to perform a corresponding operation on the corresponding resource, the value of the character is set to a first value; otherwise, the value of the character is set to a second value, thereby pre-generating an operation permission string indicating the user's permission to perform each operation on each resource. Thus, for example, if there are X resources and there are Y1 to Y2 characters for each resource, X In the case of this operation, you only need to set and manage Y1+Y2+…Y X An operation permission string. In the related art, it is necessary to set 2 (Y1+Y2+…Y X )-fold roles, this improves user permission management efficiency while achieving refined management of user permissions, significantly reducing management complexity and difficulty. Furthermore, when adding new resources or operations, only the corresponding operation permission strings need to be added. Compared to related technologies that require adding an exponential number of roles and modifying the mapping relationships of all roles, this further reduces management complexity and difficulty, and improves user permission management efficiency.

[0063] Exemplarily, the operation permission string for each operation of each resource can be stored in local memory or deployed in an external database (such as a redis database). Preferably, since the storage space occupied by the operation permission string is small, the operation permission string can be stored in local memory, thereby avoiding the time and network overhead generated by interacting with the external database, and improving the efficiency of user permission management. Taking the two values ​​of the characters of the operation permission string as 0 and 1 and 50,000 identity identifiers preset as an example, each operation permission string includes 50,000 characters with values ​​of "0" and / or "1". In computers, one character typically occupies one byte of storage space. Therefore, a 50,000-character operation permission string consisting of "0"s and / or "1"s will occupy: 50,000 * 1 byte = 50,000 bytes, or (50,000 / 1024)KB ≈ 48.828125KB, or (48.828125 / 1024)MB ≈ 0.0476837158203125MB. Therefore, a 50,000-character operation permission string will occupy approximately 48.83KB, or approximately 0.0476MB, of storage space. Assuming there are 20 types of resources and 5 operations for each resource, this will only take up approximately 0.0476 × 100 = 4.76MB of storage space. This shows that even if the number of users, resource types, and operation types are large, the storage space occupied by all the operation permission strings for each resource and each operation is very small. In this case, storing the operation permission string in the local memory does not burden the local memory. In addition, directly obtaining the operation permission string from the local memory can avoid the time and network overhead of interacting with the external database, thereby improving the efficiency of user permission management and is therefore preferred.

[0064] As an example, when a user's request to perform a first operation on a target resource is detected, in order to ensure the security of the resource, it is necessary to verify whether the user has the permission to perform the first operation on the target resource. In this scenario, a first operation permission string indicating the user's permission to perform the first operation on the target resource and the identity of at least one user whose permission to perform the first operation on the target resource is to be verified can be obtained. Exemplarily, after detecting at least one user's request to perform an operation on a resource, information such as the resource type, operation type, and the identity of at least one user can be parsed from the request, and for each resource (target resource) and each operation (first operation), a first operation permission string indicating the user's permission to perform the first operation on the target resource is obtained. For example, when two requests are detected, one from user A with identity identifier A to perform a data read operation on computer 1 and one from user B with identity identifier B to perform a data read operation on computer 1, computer 1 is parsed from the two requests as the target resource and the data read operation as the first operation, and the two identities A and B are parsed. Furthermore, the first operation string indicating the user's permission to perform the first operation, i.e., the data read operation, on the target resource, i.e., computer 1, is obtained from local memory, for example.

[0065] As another example, with the development of business and changes in users, it may be necessary to modify the permissions of relevant users to perform a certain operation (first operation) on a certain resource (target resource). In this scenario, a first operation permission string indicating the user permission to perform the first operation on the target resource and the identity of at least one user whose permission to perform the first operation on the target resource is to be modified can be obtained. Exemplarily, after detecting an instruction to modify the permission of at least one user to perform each operation (first operation) on each resource (target resource), information such as the resource type, operation type, and identity of at least one user can be parsed from the instruction, and for each resource (target resource) and each operation (first operation), a first operation permission string indicating the user permission to perform the first operation on the target resource is obtained. For example, when detecting an instruction to modify the permission of user A and user B to perform a data read operation on computer 1, computer 1 is parsed from the instruction as the target resource, the data read operation as the first operation, and the two identities of A and B are parsed. Furthermore, for example, the first operation string indicating the user permission to perform the first operation, i.e., the data read operation, on the target resource, i.e., computer 1, is obtained from the local memory.

[0066] Step 202: Generate a user identity string based on the identity identifier of the at least one user.

[0067] The user identity string includes multiple characters with two values, the same number of characters as the first operation permission string. In the user identity string, the characters located at the corresponding positions of the identity identifier of each user of the at least one user according to the mapping relationship between the identity identifier and the position in the string have the first value, and the other characters have the second value.

[0068] In one possible implementation, the number of characters in the first operation permission string can be used as the number of characters in the user identity string, that is, the length of the user identity string is the same as the length of the first operation permission string. Furthermore, according to the mapping relationship between the position of each character in the first operation permission string and each identity identifier, for each user's identity identifier in at least one user's identity identifier, the character corresponding to the user's identity identifier is determined in the user identity string, and the value of the character is configured as the first value, and the values ​​of other characters in the user identity string (that is, characters other than the characters corresponding to the identity identifier of at least one user) are configured as the second value. In this way, for the same identity identifier, the position of the corresponding character in the generated user identity string is the same as the position of the corresponding character in the first operation permission string, and the value of each character in the user identity character can reflect whether the identity identifier corresponding to the character is related to this permission verification or modification.

[0069] For example, taking the above-mentioned first value as 1, the second value as 0, four identity identifiers (A, B, C, D) as preset, and the first operation permission string as the string "1001" consisting of four characters, in order from right to left, the first character to the fourth character in the string "1001" correspond to the identity identifiers A, B, C, and D respectively. Since the first operation permission string consists of four characters, the user identity string also includes four characters. If the identity identifier of at least one user is identity identifier A, the value of the first character corresponding to identity identifier A is "1", and the values ​​of the other three characters are all "0", and the generated user identity string is "0001"; if the identity identifier of at least one user is identity identifier A and identity identifier C, the value of the first character from the right corresponding to identity identifier A is "1", the value of the third character from the right corresponding to identity identifier C is "1", and the values ​​of the other two characters are all "0", and the generated user identity string is "0101".

[0070] Step 203: Perform an operation on the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource.

[0071] Since the first operation permission string and the user identity string include the same number of characters, a bitwise operation can be performed on the first operation permission string and the user identity string to obtain an operation result string. The operation result string includes a plurality of characters with the same number of characters as the first operation permission string and the user identity string, and the mapping relationship between the position of each character in the operation result string and each identity identifier in the preset multiple identity identifiers is the same as the mapping relationship in the first operation permission string. In addition, since each user's identity identifier in the at least one user's identity identifier belongs to the preset multiple identity identifiers, the permission of at least one user to perform the first operation on the target resource can be verified or modified based on the operation result string.

[0072] The operations performed on the first operation permission string and the user identity string may include different operation modes such as bit operations (AND, OR, NOT, XOR), subtraction operations, etc. It should be understood that the operations in the present disclosure are all bitwise operations, that is, corresponding operations for each character in the string, for example, subtraction operations are bitwise subtraction. The corresponding operation mode can be set for each function according to the needs and the nature of each operation. For example, the first operation permission string and the user identity string can be subjected to an AND operation to verify the authority of at least one user to perform the first operation on the target resource. Or, for example, the first operation permission string and the user identity string can be subjected to an OR operation or a subtraction operation to modify the authority of at least one user to perform the first operation on the target resource.

[0073] For example, taking the above-mentioned first value as 1, the second value as 0, four preset identity identifiers (A, B, C, D), the first operation permission string as "1001", the identity identifiers of at least one user as identity identifier A and identity identifier C, and the generated user identity string as "0101", the first operation permission string "1001" can be operated on the user identity string as "0101" to obtain an operation result string including four characters. In the operation result string, as in the first operation permission string, the first character to the fourth character from right to left correspond to the identity identifiers A, B, C, and D in sequence. Therefore, the operation result string can be used to verify or modify the permission of the users of identity identifiers A and C to perform the first operation on the target resource.

[0074] In this step, the first operation permission string and the user identity string can be operated to verify or modify the permission of each user to perform the first operation on the target resource, thereby realizing refined permission management. When at least one user includes multiple users, it is possible to verify or modify the permission of each of the multiple users to perform the first operation on the target resource at the same time, thereby realizing batch user permission management while realizing refined permission management, greatly improving the efficiency of user permission management. In addition, since the speed of bitwise operation is faster, by operating the first operation permission string and the user identity character, it is possible to more efficiently verify or modify user permissions, further improving the efficiency of user permission management.

[0075] In the above method of the embodiment of the present disclosure, by using a binary operation permission string to indicate the user permissions of multiple users to perform each operation on each resource, the user's operation permissions for resources are accurately refined to the permissions of each user to perform each operation on each resource, thereby realizing refined management of user permissions. In addition, there is no need to group resources and / or divide users into roles, but only to maintain a binary string for each resource and each operation, which improves the management efficiency of user permissions and greatly reduces the complexity and difficulty of management. In addition, when adding new resources or adding new operations, only a binary string needs to be added, which is simple and easy to implement and improves management efficiency. On the other hand, the operation permissions of at least one user for resources can be verified or modified by performing operations on the operation permission string and the user identity string, which simplifies the verification and modification process, further reduces the complexity and difficulty of management and improves management and verification efficiency.

[0076] In addition, in the user authority management method of the above-mentioned related technology, since the divided resource groups, roles and the mapping relationship between the two are usually stored in an external database, in this way, in the process of user authority management, it is necessary to query the role to which the current user belongs, the resource group to which the current resource belongs, and the mapping relationship between the role and the resource group from the external database, and then determine whether the current user has the authority to operate the resource based on the queried information. In this process, obtaining information from the external database usually incurs a large amount of time and network overhead. If an in-memory database is used as a database for storing resource groups, roles and mapping relationships, it will occupy too many memory resources, affecting the use of memory. The operation authority string in the embodiment of the present disclosure occupies less storage space and can be preferably stored in local memory. Therefore, the operation authority string can be directly obtained from the local memory, avoiding the time and network overhead brought by network interaction, thereby improving the efficiency of user authority management.

[0077] The following example verifies the user's permission to perform the first operation on the target resource. Figure 2The method for managing user permissions for operating resources is described in detail below.

[0078] Figure 3 A flow chart of a method for managing user rights to operate on resources according to an embodiment of the present disclosure is shown. Figure 3 As shown, the method includes the following steps:

[0079] Step 301: Acquire a first operation permission character string indicating a user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified.

[0080] Step 302: Generate a user identity string based on the identity identifier of the at least one user.

[0081] Among them, step 301 and step 302 can refer to the above Figure 2 The related descriptions in step 201 and step 202 are not repeated here.

[0082] Step 303: Perform an AND operation on the first operation permission string and the user identity string to obtain an AND operation result string. The AND operation result string includes a plurality of characters having the same number of characters as the first operation permission string and having the two values, and the position of each character in the AND operation result string has the same mapping relationship with each of the plurality of preset identity identifiers as in the first operation permission string.

[0083] Step 304: Verify the permission of the at least one user to perform the first operation on the target resource based on the AND operation result character string.

[0084] Among them, steps 303 and 304 can be used as the above Figure 2 A possible implementation of step 203.

[0085] Since the position of each character in the operation result string and each identity identifier in the preset multiple identity identifiers have the same mapping relationship as in the first operation permission string, and the identity identifier of each user in the at least one user belongs to the preset multiple identity identifiers, for each user in the at least one user, the user's permission to perform the first operation on the target resource can be verified based on the value of the character at the corresponding position of the user's identity identifier in the operation result string.

[0086] In a possible implementation, in this step, verifying the permission of the at least one user to perform the first operation on the target resource based on the AND operation result string may include: in the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value indicating that the user has permission, determining that the corresponding user has permission to perform the first operation on the target resource; and when the character is a second value indicating that the user does not have permission, determining that the corresponding user does not have permission to perform the first operation on the target resource.

[0087] For example, taking the above-mentioned first value as 1 and the second value as 0, four preset identity identifiers (A, B, C, D), the first operation permission string as "1001", the identity identifiers of at least one user as identity identifier A and identity identifier C, and the generated user identity string as "0101" as an example, the first operation permission string "1001" and the user identity string "0101" can be ANDed to obtain the AND operation result string "0001". Since the value of the first character from the right is "1", it is determined that the user of identity identifier A has the authority to perform the first operation on the target resource, and the value of the third character from the right is "0", it is determined that the user of identity identifier C does not have the authority to perform the first operation on the target resource.

[0088] In another example, Figure 1 Taking the application scenario in [1] as an example, assume that the users are 10 employees of a company with work numbers 1 to 10, and the user identities are work numbers 1 to 10, respectively. For example, it can be specified that in the operation permission string, 10 characters are mapped to the 10 users with work numbers 1 to 10, from right to left, with the character "1" indicating the corresponding operation permission and the character "0" indicating the corresponding operation permission not being granted. For example, if employees with work numbers 1, 3, 4, 9, and 10 have data read permission for computer 1, and other employees do not have data read permission for computer 1, an operation permission string "1100001101" indicating the permission to perform data read operations on computer 1 can be generated and stored. Furthermore, if employees with work numbers 1, 2, 4, 7, and 8 have data delete permission for printer 3, and other employees do not have data delete permission for printer 3, an operation permission string "0011001011" indicating the permission to perform data delete operations on printer 3 can be generated and stored.

[0089] In this case, for example, if a request for a data read operation on computer 1 by an employee with work number 3 is detected, the operation permission string "1100001101" indicating the permission to perform the data read operation on computer 1 and the user's identity identifier, i.e., work number 3, can be obtained. Then, based on the user's identity identifier, i.e., work number 3, the user identity string "0000000100" is generated. Furthermore, an AND operation is performed on the operation permission string "1100001101" and the user identity string "0000000100" to obtain the AND operation result string "0000000100". Since the third character from the right corresponding to work number 3 in the operation result string "0000000100" is the value "1" indicating the corresponding permission, it can be determined that the employee with work number 3 has the permission to perform the read operation on computer 1. Thus, the permission verification of the user with work number 3 to perform the data read operation on computer 1 is completed.

[0090] For another example, if a request is detected for employees with employee numbers 2 and 3 to perform a data delete operation on printer 3, the operation permission string "0011001011" indicating permission to perform the data delete operation on printer 3, as well as the user identities, namely employee numbers 2 and 3, can be obtained. Then, based on the user identities, namely employee numbers 2 and 3, the user identity string "0000000110" is generated. Furthermore, an AND operation is performed on the operation permission string "0011001011" and the user identity string "0000000110", resulting in the AND operation result string "0000000010". Since the value of the second character from the right corresponding to employee number 2 in the AND operation result string "0000000010" is "1", and the value of the third character from the right corresponding to employee number 3 is "0", it can be determined that employee number 2 has permission to perform the data delete operation on printer 3, while employee number 3 does not have permission to perform the data delete operation on printer 3. Thus, the permission verification for multiple users with work numbers 2 and 3 to perform data deletion operations on printer 3 is completed.

[0091] In this embodiment, a first operation permission string indicating the user's permission to perform a first operation on a target resource and the identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified are obtained; based on the identity identifier of the at least one user, a user identity string is generated; an AND operation is performed on the first operation permission string and the user identity string to obtain an AND operation result string; and based on the AND operation result string, the permission of the at least one user to perform the first operation on the target resource is verified. In this way, by performing an AND operation on the first operation permission string and the user identity string and verifying the user permission based on the obtained AND operation result string, rapid verification of the user's permission to perform the first operation on the target resource is achieved. In addition, the permission of multiple users to perform the first operation on the target resource can be verified in batches at the same time, thereby improving the efficiency of verifying user permissions.

[0092] The following example takes the modification of the user's permission to perform the first operation on the target resource as an example. Figure 2 The method for managing user permissions for operating resources is described in detail below.

[0093] Figure 4 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown. Figure 4 As shown, the method includes the following steps:

[0094] Step 401: Acquire a first operation permission character string indicating a user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be modified.

[0095] Exemplarily, each of the at least one user does not have permission to perform the first operation on the target resource.

[0096] Step 402: Generate a user identity string based on the identity identifier of the at least one user.

[0097] Among them, step 401 and step 402 can refer to the above Figure 2 The related descriptions in step 201 and step 202 are not repeated here.

[0098] Step 403: Perform an OR operation on the first operation permission string and the user identity string to obtain an OR operation result string. The OR operation result string includes a plurality of characters having the two values, the same number of characters as the first operation permission string, and the position of each character in the OR operation result string has the same mapping relationship with each of the plurality of preset identity identifiers as in the first operation permission string.

[0099] Step 404: Modify the first operation permission character string to the OR operation result character string, thereby enabling the at least one user to have permission to perform the first operation on the target resource.

[0100] Among them, steps 403 and 404 can be used as the above Figure 2 A possible implementation of step 203.

[0101] Exemplarily, for each user who wants to open the permission for the first operation on the target resource, the first operation permission string and the user identity string are ORed. Since the character at the corresponding position of the user who does not have the corresponding permission in the first operation permission string is the second value, the character at the corresponding position of the user in the user identity string for which the permission is to be opened is the first value, and the OR operation result of the second value and the first value is the first value, therefore, through the OR operation of the operation permission string and the user identity string, the character at the corresponding position of the user that originally had the second value can be converted into a character with the first value in the OR operation result string. In addition, since the character at the corresponding position of the user who has the corresponding permission in the first operation permission string is the first value, the character at the corresponding position of the user in the user identity string that does not need to open the permission is the second value, and the OR operation result of the second value and the first value is still the first value, therefore, in the OR operation result string, the character that originally had the first value is still the first value. Therefore, when the first operation permission string is modified to the OR operation result string, relative to the first operation permission string before modification, the character at the corresponding position of the user who needs to open the permission in the modified first operation permission string changes from the second value indicating no permission to the first value indicating permission, while the value of the character at the corresponding position of other users remains unchanged, thereby realizing the permission opening for the user who needs to open the permission to perform the first operation on the target resource, while ensuring that the permissions of other users do not change.

[0102] For example, taking the above-mentioned first value as 1 and the second value as 0, four preset identities (A, B, C, D), the first operation permission string as "1001", the identities of at least one user as identity B and identity C, the user of identity B and the user of identity C both not having the permission to perform the first operation on the target resource, and the generated user identity string as "0110", the first operation permission string "1001" and the user identity string "0110" can be ORed to obtain the ORed result string "1111". The above-mentioned first operation permission string "1001" is modified to the ORed result string "1111". Then, in the updated first operation permission string "1111", the values ​​of the second and third characters from the right corresponding to identity B and identity C change from "0" to "1", indicating that the users of identity B and identity C have the permission to perform the first operation on the target resource, thereby enabling the users of identity B and identity C to perform the first operation on the target resource.

[0103] In another example, Figure 1 Taking the application scenario in [1] as an example, assume that the users are 10 employees of a company with work numbers 1 to 10, and the user identities are work numbers 1 to 10, respectively. For example, it can be specified that in the operation permission string, 10 characters are mapped to the 10 users with work numbers 1 to 10, from right to left, with the character "1" indicating the corresponding operation permission and the character "0" indicating the corresponding operation permission not being granted. For example, if employees with work numbers 1, 3, 4, 9, and 10 have data read permission for computer 1, and other employees do not have data read permission for computer 1, an operation permission string "1100001101" indicating the permission to perform data read operations on computer 1 can be generated and stored. Furthermore, if employees with work numbers 1, 2, 4, 7, and 8 have data delete permission for printer 3, and other employees do not have data delete permission for printer 3, an operation permission string "0011001011" indicating the permission to perform data delete operations on printer 3 can be generated and stored.

[0104] For example, if an instruction is detected to grant permission for a user with employee number 2 to read data from computer 1, the aforementioned permission string "1100001101" and the employee's employee number 2 can be obtained. Then, based on the employee's employee number 2, the user identity string "0000000010" is generated. Furthermore, an OR operation is performed on the permission string "1100001101" and the user identity string "0000000010" to obtain the OR result string "1100001111". The permission string "1100001101" is then modified to the OR result string "1100001111". In this way, the second character from the right corresponding to employee number 2 in the modified data read permission string "1100001111" is "1", indicating that employee number 2 has permission to read data from computer 1, thereby completing the activation of permission for a single user to read data from computer 1. It can be seen that, compared with the data read operation permission string "1100001111" before modification, only the value of the second character from the right has changed in the modified data read operation permission string "1100001101".

[0105] For another example, if a command is detected granting data deletion permission to users with employee numbers 2, 3, and 5 on printer 3, the operation permission string "0011001011" and the employee's employee numbers 2, 3, and 5 are retrieved. Then, based on the employee's employee numbers 2, 3, and 5, the user identity string "0000010110" is generated. Furthermore, an OR operation is performed on the operation permission string "0011001011" and the user identity string "0000000110" to obtain the OR result string "0011011111". The operation permission string "0011001011" is then modified to the OR result string "0011011111". Thus, the values ​​of the second, third, and fifth characters from the right corresponding to users with employee numbers 2, 3, and 5 in the modified operation permission string "0011011111" are "1," indicating that users with employee numbers 2, 3, and 5 have permission to delete data on printer 3. This allows multiple users to perform data deletion operations on printer 3. As can be seen, only the values ​​of the third and fifth characters in the modified operation permission string "0011011111" have changed compared to the original operation permission string "0011001011." Since employee number 2 already had permission, the values ​​of the characters in the corresponding positions remain the same as before.

[0106] In an embodiment of the present disclosure, a first operation permission string indicating the user permission to perform a first operation on a target resource and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be modified are obtained; a user identity string is generated based on the identity identifier of the at least one user; an OR operation is performed on the first operation permission string and the user identity string to obtain an OR operation result string; the first operation permission string is modified to the OR operation result string, thereby enabling the at least one user to perform the first operation on the target resource. In this way, by performing an OR operation on the first operation permission string and the user identity string, user permission is enabled based on the obtained OR operation result string, thereby enabling the user permission to perform the first operation on the target resource to be quickly enabled; in addition, the permission to perform the first operation on the target resource for multiple users can be enabled in batches at the same time, thereby improving the efficiency of enabling user permissions.

[0107] Figure 5 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown. Figure 5 As shown, the method includes the following steps:

[0108] Step 501: Acquire a first operation permission character string indicating a user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be modified.

[0109] Exemplarily, each of the at least one user has permission to perform the first operation on the target resource.

[0110] Step 502: Generate a user identity string based on the identity identifier of the at least one user.

[0111] Among them, step 501 and step 502 can refer to the above Figure 2 The related descriptions in step 201 and step 202 are not repeated here.

[0112] Step 503: Subtract the user identity string from the first operation authority string to obtain a subtraction result string.

[0113] The subtraction result string includes a plurality of characters having the two values, the same number of characters as that of the first operation permission string, and the position of each character in the subtraction result string has a mapping relationship with each identity identifier in the preset plurality of identity identifiers.

[0114] Exemplarily, the first operation permission character string and the user identity character string may be subtracted by the values ​​of characters corresponding to the same identity identifier, thereby achieving subtraction of the user identity character string from the first operation permission character string.

[0115] Step 504: Modify the first operation permission character string to the subtraction result character string, thereby canceling the permission of the at least one user to perform the first operation on the target resource.

[0116] Among them, steps 503 and 504 can be used as the above Figure 2 A possible implementation of step 203.

[0117] Exemplarily, the second value can be "0". For each of the at least one user, since the user originally has the permission to perform the first operation on the target resource, that is, the value of the character at the corresponding position of the user's identity identifier in the first operation permission string before modification is the first value, and since the value of the character at the corresponding position of the user's identity identifier in the user identity string is also the first value, then in the subtraction result string, the value of the character at the corresponding position of the user's identity identifier is the second value "0"; and for other identity identifiers in the preset identity identifiers, since the value of the character at the corresponding position of other identity identifiers in the user identity string is all the second value "0", then in the subtraction result string, the value of the character at the corresponding position of each identity identifier is consistent with the first operation permission string. In this way, the first operation permission string is modified to the subtraction result string. Compared with the first operation permission string before modification, in the modified first operation permission string, the value of the character at the corresponding position of the identity identifier of each user of at least one user is changed from the first value to the second value "0", while the values ​​of the corresponding characters of other identity identifiers remain unchanged.

[0118] For example, taking the first value as 1 and the second value as 0, four identity identifiers (A, B, C, and D) are preset, the first operation permission string is "1110", and the identity identifiers of at least one user are identity identifiers B and identity identifier C. The user of identity identifier B and the user of identity identifier C both have the permission to perform the first operation on the target resource, and the generated user identity string is "0110". For example, the user identity string "0110" can be subtracted from the first operation permission string "1110" to obtain a subtraction result string "1000". The first operation permission string "1110" is modified to the subtraction result string "1000". In this way, in the updated first operation permission string "1000", the value of the second character corresponding to identity identifier B is "0", indicating that the user of identity identifier B does not have the permission to perform the first operation on the target resource, and the value of the third character corresponding to identity identifier C is "0", indicating that the user of identity identifier C does not have the permission to perform the first operation on the target resource, thereby revoking the permission of the user of identity identifier B and the user of identity identifier C to perform the first operation on the target resource.

[0119] In another example, Figure 1Taking the application scenario in [1] as an example, assume that the users are 10 employees of a company with work numbers 1 to 10, and the user identities are work numbers 1 to 10, respectively. For example, it can be specified that in the operation permission string, 10 characters are mapped to the 10 users with work numbers 1 to 10, from right to left, with the character "1" indicating the corresponding operation permission and the character "0" indicating the corresponding operation permission not being granted. For example, if employees with work numbers 1, 3, 4, 9, and 10 have data read permission for computer 1, and other employees do not have data read permission for computer 1, an operation permission string "1100001101" indicating the permission to perform data read operations on computer 1 can be generated and stored. Furthermore, if employees with work numbers 1, 2, 4, 7, and 8 have data delete permission for printer 3, and other employees do not have data delete permission for printer 3, an operation permission string "0011001011" indicating the permission to perform data delete operations on printer 3 can be generated and stored.

[0120] For example, if an instruction to cancel the permission of employee with work number 3 to perform data reading operation on computer 1 is detected, the above-mentioned data reading operation permission string "1100001101" and the employee's work number 3 can be obtained; then, based on the employee's work number 3, the user identity string "0000000100" is generated, and then, the data reading operation permission string "1100001101" is subtracted from the user identity string "0000000100" to obtain the subtraction result string "1100001001", and the data reading operation permission string "1100001101" is modified to the subtraction result string "1100001001". In this way, the value of the third character from the right corresponding to work number 3 in the modified data reading operation permission string "1100001001" is "0", indicating that the employee with work number 3 does not have the permission to perform data reading operation on computer 1; thereby completing the cancellation of the permission of a single employee to perform data reading operation on computer 1. It can be seen that, compared with the data read operation permission string "1100001001" before modification, only the value of the third character of the modified data read operation permission string "1100001101" has changed.

[0121] For another example, if an instruction is detected to cancel the data deletion operation permission of employees with work numbers 1, 2, and 7 on printer 3, the above-mentioned data deletion operation permission string "0011001011" and the employees' work numbers 1, 2, and 7 can be obtained. Then, based on the employees' work numbers 1, 2, and 7, the user identity string "0001000011" is generated. Then, the data deletion operation permission string "0011001011" is subtracted from the user identity string "0001000011" to obtain the subtraction result string "0010001000", and the data deletion operation permission string "0011001011" is modified. The subtraction result string is "0010001000". Thus, in the modified data delete permission string "0010001000", the first character from the right corresponding to employee number 1 is "0", indicating that employee number 1 does not have permission to delete data on printer 3. The second character from the right corresponding to employee number 2 is "0", indicating that employee number 2 does not have permission to delete data on printer 3. The seventh character from the right corresponding to employee number 7 is "0", indicating that employee number 7 does not have permission to delete data on printer 3. This completes the simultaneous removal of multiple employees' permission to delete data on printer 3. It can be seen that compared to the original data delete permission string "0011001011", only the values ​​of the characters corresponding to employee numbers 1, 2, and 7 have changed in the modified data delete permission string "0010001000".

[0122] In an embodiment of the present disclosure, a first operation permission string indicating the user's permission to perform a first operation on a target resource and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be modified are obtained; a user identity string is generated based on the identity identifier of the at least one user; the first operation permission string is subtracted from the user identity string to obtain a subtraction result string; the first operation permission string is modified to the subtraction result string, thereby canceling the permission of the at least one user to perform the first operation on the target resource. In this way, by performing a subtraction operation on the first operation permission string and the user identity string, the user permission is canceled based on the obtained subtraction result string, thereby achieving rapid cancellation of the user's permission to perform the first operation on the target resource; in addition, it is possible to achieve batch cancellation of the permissions of multiple users to perform the first operation on the target resource at the same time, thereby improving the efficiency of canceling user permissions.

[0123] Furthermore, in the above Figure 2 In addition to verifying or modifying the user's permission to perform a first operation on the target resource, the method can also count users who have permission to perform multiple operations on the target resource.

[0124] Figure 6 A flowchart of a method for managing user rights for operating resources according to an embodiment of the present disclosure is shown. Figure 6 As shown, the method includes the following steps:

[0125] Step 601: Obtain a first operation permission character string indicating a user permission to perform a first operation on a target resource, and an identity identifier of at least one user who wants to verify or modify the permission to perform the first operation on the target resource.

[0126] Step 602: Generate a user identity string based on the identity identifier of the at least one user.

[0127] Step 603: Perform an operation on the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource.

[0128] The above steps 601-603 are the same as the above Figure 2 Steps 201-203 are the same and will not be repeated here.

[0129] Step 604: Obtain a second operation permission character string indicating the user's permission to perform a second operation on the target resource.

[0130] In which, the second operation is an operation different from the first operation; the second operation permission string includes multiple characters with two values, and the position of each character in the second operation permission string has a mapping relationship with each identity identifier in the preset multiple identity identifiers. When each character is the first value of the two values, it indicates that the user of the corresponding identity identifier has the authority to perform the second operation on the target resource, and when each character is the second value of the two values, it indicates that the user of the corresponding identity identifier does not have the authority to perform the second operation on the target resource.

[0131] The second operation permission character string includes a plurality of characters having the two values, the same number of characters as that of the first operation permission character string.

[0132] Step 605: Perform an AND operation on the first operation permission character string and the second operation permission character string to obtain an AND operation result character string.

[0133] The AND operation result string includes a plurality of characters having the two values, the same number of characters as that of the first operation permission string, and the position of each character in the AND operation result string has a mapping relationship with each identity identifier in the preset plurality of identity identifiers.

[0134] Step 606: Determine a user who has the authority to perform both the first operation and the second operation on the target resource according to the AND operation result character string.

[0135] In one possible implementation, in step 606, determining the user who has the authority to perform the first operation and the second operation on the target resource at the same time based on the AND operation result string may include: in the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, determining that the corresponding user has the authority to perform the first operation and the second operation on the target resource at the same time, and when the character is a second value, determining that the corresponding user does not have the authority to perform the first operation and the second operation on the target resource at the same time.

[0136] For example, taking the first value as 1, the second value as 0, four identity identifiers (A, B, C, D) as preset, the first operation permission string as "1001", and the second operation permission string as "0101" as an example, the first operation permission string "1001" and the second operation permission string "0101" are ANDed to obtain the AND operation result string "0001". Since the value of the first character is "1", it is determined that the user of identity identifier A has the authority to perform the first operation and the second operation on the target resource at the same time, while users of other identity identifiers do not have the authority to perform the first operation and the second operation on the target resource at the same time.

[0137] In another example, Figure 1Taking the application scenario in [1] as an example, assume that the users are 10 employees of a company with work numbers 1 to 10, and the user identities are work numbers 1 to 10, respectively. For example, it can be specified that in the operation permission string, 10 characters are mapped to the 10 users with work numbers 1 to 10, from right to left, with the character "1" indicating the corresponding operation permission and the character "0" indicating the corresponding operation permission not being granted. For example, if employees with work numbers 1, 3, 4, 9, and 10 have data read permission for computer 1, and other employees do not have data read permission for computer 1, an operation permission string "1100001101" indicating the permission to perform data read operations on computer 1 can be generated and stored. Furthermore, if employees with work numbers 1, 2, 4, 7, and 8 have data delete permission for printer 3, and other employees do not have data delete permission for printer 3, an operation permission string "0011001011" indicating the permission to perform data delete operations on printer 3 can be generated and stored. An AND operation is performed on the data read operation permission string "1100001101" and the data delete operation permission string "0011001011", and the AND operation result string "0000001001" is obtained. Since the value of the first character from the right corresponding to employee number 1 and the value of the fourth character from the right corresponding to employee number 4 in the AND operation result string "0000001001" are both "1", it is determined that employees with employee number 1 and employee number 4 both have the permission to perform data read operations and data delete operations on computer 1; thereby achieving rapid statistics of employees who have the permission to perform data read operations and data delete operations on computer 1.

[0138] In an embodiment of the present disclosure, a first operation permission string indicating the user's permission to perform a first operation on a target resource and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified or modified are obtained; a user identity string is generated based on the identity identifier of the at least one user; an operation is performed on the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource; a second operation permission string indicating the user's permission to perform a second operation on the target resource is obtained; an AND operation is performed on the first operation permission string and the second operation permission string to obtain an AND operation result string; and based on the AND operation result string, a user who has the permission to perform both the first operation and the second operation on the target resource is determined. In this way, on the basis of verifying or modifying the user's permission to perform the first operation on the target resource, it is also possible to quickly count the users who have the permission to perform multiple operations on the target resource at the same time, further improving the efficiency of user permission management.

[0139] It should be understood that the above-mentioned case where 1 is used as the first value to indicate that the user has permission and 0 is used as the second value to indicate that the user does not have permission in each operation permission string is only an example. In fact, the two values ​​of the characters in each operation permission string and user identity string can also adopt other values. For example, Y can be set as the first value to indicate that the user has permission and N can be set as the second value to indicate that the user does not have permission. Accordingly, in the generated user identity string, the character at the corresponding position of the user who needs to verify / modify the permission is set to Y and the characters at other positions are set to N, and the operation permission string and the user identity string are operated. For bitwise operations between strings, for example, it can be stipulated that the results of the AND operation and OR operation of Y and Y are both Y, the result of the AND operation of Y and N is N and the result of the OR operation is Y, the result of the AND operation and OR operation of N and N are both N, the result of the subtraction operation of Y and Y is N, and the result of the subtraction operation of Y and N is Y. Thus, the methods in the above-mentioned embodiments can still be used to manage user permissions for operating resources.

[0140] Based on the same inventive concept of the above method embodiment, an embodiment of the present disclosure further provides a device for managing user rights for operating resources, which can be used to execute the technical solution described in the above method embodiment.

[0141] Figure 7 A structural diagram of a device for managing user rights to operate resources according to an embodiment of the present disclosure is shown. Figure 7As shown, the device includes: an acquisition module 701, which is used to obtain a first operation permission string indicating the user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified or modified, wherein the first operation permission string includes a plurality of characters having two values, and the position of each character in the plurality of characters in the first operation permission string has a mapping relationship with each identity identifier in a preset plurality of identity identifiers, and when each character is the first value of the two values, it indicates that the user of the corresponding identity identifier has the permission to perform the first operation on the target resource, and when each character is the second value of the two values, it indicates that the corresponding identity identifier has the permission to perform the first operation on the target resource. The user does not have the permission to perform the first operation on the target resource; a generation module 702 is used to generate a user identity string based on the identity identifier of the at least one user, wherein the user identity string includes a plurality of characters with the two values ​​that are the same number of characters as the first operation permission string, and in the user identity string, the characters located at the corresponding positions of the identity identifier of each user in the at least one user according to the mapping relationship have the first value, and the other characters have the second value; an operation module 703 is used to operate the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource.

[0142] In an embodiment of the present disclosure, a first operation permission string indicating user permission to perform a first operation on a target resource and an identity of at least one user whose permission to perform the first operation on the target resource is to be verified or modified are obtained, wherein the first operation permission string includes a plurality of characters having two values, and the position of each character in the first operation permission string has a mapping relationship with each identity in a plurality of preset identities, and each character having a first value of the two values ​​indicates that the user with the corresponding identity has permission to perform the first operation on the target resource, and each character having a second value of the two values ​​indicates that the user with the corresponding identity does not have permission to perform the first operation on the target resource; based on the identity of the at least one user, a user identity string is generated, wherein the user identity string includes a plurality of characters having the two values, the same number of characters as the first operation permission string, and in the user identity string, characters located at positions corresponding to the identity of each of the at least one user according to the mapping relationship have the first value, and other characters have the second value; and an operation is performed on the first operation permission string and the user identity string to verify or modify the permission of the at least one user to perform the first operation on the target resource. In this way, the first operation permission string is used to indicate the user permission to perform the first operation on the target resource, thereby accurately allocating the user's operation permission for the resource to the permission of each user to perform each operation on each specific resource, thereby realizing refined management of user permissions, and there is no need to group resources or divide users into roles, thereby improving the efficiency of user permission management; moreover, the method can simultaneously verify or modify the permissions of multiple users to perform the first operation on the target resource, thereby realizing simultaneous batch management of user permissions, thereby further improving the efficiency of user permission management; in addition, the method adopts the method of performing operations on the first operation permission string and the user identity string to verify or modify the permissions, thereby reducing the time consumption of verifying or modifying user permissions, thereby further improving the efficiency of user permission management.

[0143] In one possible implementation, the operation module 703 is also used to: perform an AND operation on the first operation permission string and the user identity string to obtain an AND operation result string; and verify the permission of the at least one user to perform the first operation on the target resource based on the AND operation result string.

[0144] In one possible implementation, the operation module 703 is also used to: in the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, determine that the corresponding user has the authority to perform the first operation on the target resource; and when the character is a second value, determine that the corresponding user does not have the authority to perform the first operation on the target resource.

[0145] In one possible implementation, the operation module 703 is also used to: perform an OR operation on the first operation permission string and the user identity string to obtain an OR operation result string; modify the first operation permission string to the OR operation result string, thereby enabling the at least one user to perform the first operation on the target resource.

[0146] In one possible implementation, the operation module 703 is also used to: subtract the user identity string from the first operation permission string to obtain a subtraction result string; modify the first operation permission string to the subtraction result string, thereby canceling the permission of the at least one user to perform the first operation on the target resource.

[0147] In one possible implementation, the device also includes: a statistical module, used to obtain a second operation permission string indicating the user's permission to perform a second operation on the target resource; perform an AND operation on the first operation permission string and the second operation permission string to obtain an AND operation result string; and determine, based on the AND operation result string, a user who has the permission to perform both the first operation and the second operation on the target resource.

[0148] In one possible implementation, the statistical module is further used to: in the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, determine that the corresponding user has the authority to perform the first operation and the second operation on the target resource at the same time; and when the character is a second value, determine that the corresponding user does not have the authority to perform the first operation and the second operation on the target resource at the same time.

[0149] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments. For the sake of brevity, it will not be repeated here.

[0150] An embodiment of the present disclosure further provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0151] An embodiment of the present disclosure further provides a non-volatile computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0152] An embodiment of the present disclosure further provides a computer program product, including a computer program, or a non-volatile computer-readable storage medium carrying the computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0153] Figure 8 FIG1 shows a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 can be provided as a server or a terminal device. Figure 8 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described method.

[0154] The electronic device 1900 may further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0155] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0156] A computer-readable storage medium can be a tangible device that can hold and store programs / instructions used by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0157] The computer programs (or computer-readable program instructions) described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0158] The computer program (or computer program instructions) for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, by utilizing state information of computer-readable program instructions to personalize and customize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions to implement various aspects of the present disclosure.

[0159] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0160] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine such that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0161] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0162] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and the part of the module, program segment or instruction contains one or more executable instructions for realizing the prescribed logical function. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0163] While various embodiments of the present disclosure have been described above, the above descriptions are illustrative, non-exhaustive, and not intended to be limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for managing user rights to operate resources, characterized in that: The method comprises: Obtaining a first operation permission string indicating user permission to perform a first operation on a target resource, and an identity identifier of at least one user whose permission to perform the first operation on the target resource is to be verified or modified, wherein the first operation permission string includes a plurality of characters having two values, a position of each of the plurality of characters in the first operation permission string having a mapping relationship with each of a plurality of preset identity identifiers, each character having a first value of the two values ​​indicating that the user with the corresponding identity identifier has permission to perform the first operation on the target resource, and each character having a second value of the two values ​​indicating that the user with the corresponding identity identifier does not have permission to perform the first operation on the target resource; generating a user identity string based on the identity identifier of the at least one user, wherein the user identity string includes a plurality of characters having the two values, the same number as the number of characters in the first operation permission string, and in the user identity string, characters located at positions corresponding to the identity identifier of each user of the at least one user according to the mapping relationship have the first value, and other characters have the second value; An operation is performed on the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource.

2. The method according to claim 1, characterized in that The operating the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes: Performing an AND operation on the first operation authority character string and the user identity character string to obtain an AND operation result character string; The authority of the at least one user to perform the first operation on the target resource is verified according to the AND operation result character string.

3. The method according to claim 2, characterized in that Verifying the permission of the at least one user to perform the first operation on the target resource according to the AND operation result character string includes: In the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, it is determined that the corresponding user has the authority to perform the first operation on the target resource, and when the character is a second value, it is determined that the corresponding user does not have the authority to perform the first operation on the target resource.

4. The method according to claim 1, wherein The operating the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes: Performing an OR operation on the first operation authority character string and the user identity character string to obtain an OR operation result character string; The first operation permission character string is modified into the OR operation result character string, thereby enabling the at least one user to have permission to perform the first operation on the target resource.

5. The method according to claim 1, wherein The operating the first operation permission character string and the user identity character string to verify or modify the permission of the at least one user to perform the first operation on the target resource includes: Subtract the user identity string from the first operation authority string to obtain a subtraction result string; The first operation permission character string is modified to the subtraction result character string, thereby canceling the permission of the at least one user to perform the first operation on the target resource.

6. The method according to claim 1, characterized in that The method further comprises: Obtain a second operation permission character string indicating the user's permission to perform a second operation on the target resource; Performing an AND operation on the first operation permission character string and the second operation permission character string to obtain an AND operation result character string; A user who has the authority to perform both the first operation and the second operation on the target resource is determined according to the AND operation result character string.

7. The method according to claim 6, characterized in that The determining, based on the AND operation result character string, a user who has permission to perform the first operation and the second operation on the target resource at the same time includes: In the AND operation result string, for each character located at a corresponding position of the identity identifier of each user among the at least one user, when the character is a first value, it is determined that the corresponding user has the authority to perform the first operation and the second operation on the target resource at the same time, and when the character is a second value, it is determined that the corresponding user does not have the authority to perform the first operation and the second operation on the target resource at the same time.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

9. A non-volatile computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images