Permission record storage method, permission record application method, permission record storage system, permission record application system and electronic equipment

Abstract

The invention relates to the technical field of permission access, and provides a permission record storage method, a permission record application method, a permission record storage system and electronic equipment. According to the method, the target node is selected according to the tree menu, the permission record of the target node is set according to the authorization proportion of the descendant node corresponding to the target node, and the access permission state of the descendant node corresponding to the target node is determined according to the permission record; according to the method, the authorization proportion of the descendant nodes of the target nodes is converted into the authority records of the descendant nodes, the authorization granularity is refined by means of the multi-valued authority logic, part of the target nodes are selected from the tree menu, access permission control of the menu nodes can be achieved without independently configuring authorization information for each menu node, and the access permission control efficiency of the menu nodes is improved. Therefore, redundant permission information is effectively reduced, storage space occupation is reduced, and authorization management is facilitated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of permission access, and particularly relates to a permission record storage method, an application method, a system and electronic equipment. BACKGROUND

[0002] In a modern enterprise application system, as a core navigation element of a user operation interface, a menu is generally organized in a multi-level tree structure, a complete function navigation system is formed through a hierarchical relationship between parent nodes and child nodes, and a role-menu direct mapping mode is used to realize permission control, wherein each node of the tree menu needs to be separately set with access permissions for different user roles, and these authorization information is stored in a discrete record form, so that the basic permission allocation requirements are met through intuitive mapping, which is also a common permission control mode.

[0003] However, since each node of the tree menu needs to be separately configured with user authorization information, in a business scenario with a large number of menu items and a deep menu structure, a large number of repeated operations will occur in the permission configuration process, and the storage amount of the authorization information increases linearly with the number of menu nodes, which not only causes information redundancy and occupies a large space, but also further increases the complexity of the authorization information management. SUMMARY

[0004] In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not a general review, nor is it intended to determine key / important components or delineate the scope of protection of these embodiments, but is intended as a prelude to the detailed description below.

[0005] In view of the above-mentioned disadvantages of the prior art, the present application provides a permission record storage method, an application method, a system and electronic equipment to solve the technical problem of authorization information redundancy.

[0006] The present application provides a permission record storage method, comprising: acquiring a tree menu, wherein the tree menu is composed of a plurality of menu nodes having an upper and lower relationship; selecting target nodes according to the tree menu, wherein the number of the target nodes is less than the number of the menu nodes; counting an authorization proportion of descendant nodes corresponding to the target nodes; setting a permission record corresponding to the target nodes according to the authorization proportion, and storing the permission record, wherein the permission record corresponding to the target nodes is used to determine an access permission state of the descendant nodes corresponding to the target nodes.

[0007] In an embodiment of the present application, the target node is selected according to the tree menu, including: obtaining a user permission table, wherein the user permission table includes user permissions corresponding to each menu node; classifying the menu nodes according to user permissions of child nodes corresponding to the menu nodes to obtain permission tags, wherein the permission tags include a full authorization tag, a partial authorization tag or a no permission tag; if the permission tag of the menu node is the partial authorization tag, determining the target node according to the menu node; if the permission tag of the menu node is the partial authorization tag, and the permission tags of child nodes corresponding to the menu node include at least two of the full authorization tag, the partial authorization tag and the no permission tag, determining a target tag according to the full authorization tag and the no permission tag, and determining the target node corresponding to the target tag according to the child nodes corresponding to the menu node.

[0008] In an embodiment of the present application, the target tag is determined according to the full authorization tag and the no permission tag, including: if the number of the full authorization tags is greater than the number of the no permission tags, determining the no permission tag as the target tag; if the number of the full authorization tags is less than the number of the no permission tags, determining the full authorization tag as the target tag; and if the number of the full authorization tags is equal to the number of the no permission tags, determining the full authorization tag or the no permission tag as the target tag.

[0009] In an embodiment of the present application, the permission record corresponding to the target node is set according to the authorization ratio, including: if the authorization ratio of child nodes corresponding to the target node is equal to 100%, setting the permission record corresponding to the target node as a full selection state; if the authorization ratio of child nodes corresponding to the target node is less than 100% and greater than 0%, setting the permission record corresponding to the target node as a half selection state; and if the authorization ratio of child nodes corresponding to the target node is equal to 0%, setting the permission record corresponding to the target node as an exclusion state.

[0010] The present application also provides an application method of the permission record, including: obtaining the permission record corresponding to the target node according to the storage method of the permission record; in response to a to-be-accessed node, taking the to-be-accessed node and ancestor nodes corresponding to the to-be-accessed node as intermediate nodes, querying permission records of the intermediate nodes in ascending order according to hierarchical distances of the to-be-accessed node and the intermediate nodes to obtain a traceable node with a permission record, wherein the to-be-accessed node is any menu node; and determining an access permission state of the to-be-accessed node according to the permission record corresponding to the traceable node.

[0011] In an embodiment of the present application, if the traceable node and the node to be accessed are the same menu node, determining the access permission state of the node to be accessed according to the permission record corresponding to the traceable node comprises: if the permission record corresponding to the traceable node is in the full selection state or the half selection state, determining the access permission state of the node to be accessed as allowed to access; and if the permission record corresponding to the traceable node is in the exclusion state, determining the access permission state of the node to be accessed as refused to access.

[0012] In an embodiment of the present application, if the traceable node is the parent node of the node to be accessed, determining the access permission state of the node to be accessed according to the permission record corresponding to the traceable node comprises: if the permission record corresponding to the traceable node is in the full selection state, determining the access permission state of the node to be accessed as allowed to access; if the permission record corresponding to the traceable node is in the exclusion state, determining the access permission state of the node to be accessed as refused to access; and if the permission record corresponding to the traceable node is in the half selection state, obtaining the permission record of a sibling node corresponding to the node to be accessed; if the permission record of the sibling node only includes the half selection state, determining the access permission state of the node to be accessed as refused to access; if the permission record of the sibling node includes the full selection state, determining the access permission state of the node to be accessed as refused to access; and if the permission record of the sibling node includes the exclusion state, determining the access permission state of the node to be accessed as allowed to access.

[0013] In an embodiment of the present application, if the traceable node is the ancestor node of the node to be accessed and the traceable node does not include the parent node of the node to be accessed, determining the access permission state of the node to be accessed according to the permission record corresponding to the traceable node comprises: if the permission record corresponding to the traceable node is in the full selection state, determining the access permission state of the node to be accessed as allowed to access; if the permission record corresponding to the traceable node is in the exclusion state, determining the access permission state of the node to be accessed as refused to access; and if the permission record corresponding to the traceable node is in the half selection state, determining the menu node between the traceable node and the node to be accessed as a reference node and determining the access permission state of the node to be accessed according to the access permission state of the reference node.

[0014] The application further provides a storage system of a permission record, comprising: an acquisition module, configured to acquire a tree menu, wherein the tree menu is composed of a plurality of menu nodes having an upper-lower relationship; a selection module, configured to select target nodes according to the tree menu, wherein the number of the target nodes is less than the number of the menu nodes; a statistics module, configured to count an authorized proportion of descendant nodes corresponding to the target nodes; and a storage module, configured to set a permission record corresponding to the target nodes according to the authorized proportion, and store the permission record, wherein the permission record corresponding to the target nodes is used to determine an access permission state of the descendant nodes corresponding to the target nodes.

[0015] The application further provides an electronic device, comprising: a processor and a memory; the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory, so that the electronic device executes the storage method of the permission record, or the application method of the permission record.

[0016] The application has the following beneficial effects: By selecting target nodes according to a tree menu, and setting a permission record of the target nodes according to an authorized proportion of descendant nodes corresponding to the target nodes, and determining an access permission state of the descendant nodes corresponding to the target nodes according to the permission record, compared with a binary permission logic of yes or no of authorization information, the authorized proportion of the descendant nodes of the target nodes is converted into the permission record of the target nodes, and the authorization granularity is refined by means of a multi-value permission logic, and a part of the target nodes are selected from the tree menu, and the access permission control of the menu nodes can be realized without separately configuring authorization information for each menu node, thereby effectively reducing redundant permission information, reducing storage space occupation, and facilitating authorization management. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles behind the application. It is apparent that the accompanying drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0018] In the drawings: Figure 1 is a flowchart of a permission record storage method in an embodiment of the application; Figure 2 is a structural diagram of a tree menu in an embodiment of the application; Figure 3 is a flowchart of a system architecture in an embodiment of the application; Figure 4is a flowchart of an application method of one permission record in an embodiment of the present application; Figure 5 is a flowchart of an application method of another permission record in an embodiment of the present application; Figure 6 is a flowchart of an application method of another permission record in an embodiment of the present application; Figure 7 is a flowchart of an application method of another permission record in an embodiment of the present application; Figure 8 is a flowchart of an application method of another permission record in an embodiment of the present application; Figure 9 is a structural diagram of a storage system of one permission record in an embodiment of the present application; Figure 10 is a structural diagram of one electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The other advantages and effects of the present application can be easily understood by those skilled in the art from the content disclosed in the present specification. The present application can also be implemented or applied by means of other different specific embodiments, and each detail in the present specification can be modified or changed based on different views and applications without departing from the spirit of the present application. The following embodiments and features in the embodiments can be combined with each other without conflict, provided that they do not conflict.

[0020] It should be noted that the diagrams provided in the following embodiments only schematically illustrate the basic concept of the present application, and the drawings only show the components related to the present application, not the number, shape and size of the components when actually implemented. The shape, number and proportion of each component when actually implemented can be arbitrarily changed, and the layout pattern of the components can also be more complex.

[0021] In the following description, a large number of details are discussed to provide a more thorough explanation of the embodiments of the present application, however, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details, and in other embodiments, the known structures and devices are shown in the form of block diagrams rather than in the form of details, to avoid making the embodiments of the present application difficult to understand.

[0022] The terms "first", "second", and the like in the description and in the claims of the present application and above-described drawings are used to distinguish similar objects and are not necessarily used to describe a specific sequential or chronological order. It should be understood that the data thus used can be interchanged, where appropriate, to describe the embodiments of the present application described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion.

[0023] Unless otherwise specified, the term "a plurality of" means two or more.

[0024] In the present application, the character " / " represents an "or" relationship between the objects before and after it. For example, A / B means: A or B.

[0025] The term "and / or" is a description of the association relationship between objects, which means that there can be three relationships. For example, A and / or B means: A or B, or, A and B, three relationships.

[0026] In combination Figure 1 As shown, the present application provides a storage method of permission records, comprising: Step S101, acquiring a tree menu; Wherein, the tree menu is composed of a plurality of menu nodes having a superior-inferior relationship; Step S102, selecting target nodes according to the tree menu; Wherein, the number of target nodes is less than the number of menu nodes; Step S103, counting the authorized proportion of the descendant nodes corresponding to the target nodes; Step S104, setting the permission records corresponding to the target nodes according to the authorized proportion, and storing the permission records; Wherein, the permission records corresponding to the target nodes are used to determine the access permission state of the descendant nodes corresponding to the target nodes.

[0027] By using the storage method of permission records provided by the present application, by selecting target nodes according to the tree menu, and setting the permission records of the target nodes according to the authorized proportion of the descendant nodes corresponding to the target nodes, the access permission state of the descendant nodes corresponding to the target nodes is determined according to the permission records. In this way, compared with the binary permission logic of yes or no about authorization information, by converting the authorized proportion of the descendant nodes of the target nodes into their permission records, the fine-grained authorization granularity is realized by means of multi-value permission logic, and by selecting a part of target nodes from the tree menu, the access permission control of the menu nodes can be realized without separately configuring authorization information for each menu node, thereby effectively reducing redundant permission information, reducing storage space occupation, and facilitating authorization management.

[0028] In combination Figure 2As shown, the present application provides a tree menu; two first-level menus are set under application A, the first-level menus include first-level menu A1 and first-level menu A2; first-level menu A1 has two second-level menus, including second-level menu A1-1 and second-level menu A1-2; second-level menu A1-1 has two third-level menus, including third-level menu A1-1-1 and third-level menu A1-1-2; second-level menu A1-2 has two third-level menus, including third-level menu A1-2-1 and third-level menu A1-2-2; first-level menu A2 has two second-level menus, including second-level menu A2-1 and second-level menu A2-2; second-level menu A2-1 has two third-level menus, including third-level menu A2-1-1 and third-level menu A2-1-2; second-level menu A2-2 has two third-level menus, including third-level menu A2-2-1 and third-level menu A2-2-2.

[0029] In some embodiments, in the tree menu or hierarchical data structure, the hierarchical distance refers to the number of edges from one node to another node, also known as path length, through which the vertical correlation between nodes can be embodied, the influence relationship between nodes can be quantified, and the determination of access permission state can be realized in combination with the authorization record, for example, the hierarchical distance between second-level menu A2-2 and third-level menu A2-2-1 is 1. In some embodiments, the child node of the current node is the next level node of the current node, for example, the child nodes of first-level menu A1 include second-level menu A1-1 and second-level menu A1-2; the descendant node of the current node is all lower level nodes of the current node, for example, the descendant nodes of first-level menu A1 include second-level menu A1-1, second-level menu A1-2, third-level menu A1-1-1, third-level menu A1-1-2, third-level menu A1-2-1, and third-level menu A1-2-2.

[0030] In some embodiments, the parent node of the current node is the upper level node of the current node, for example, the parent node of third-level menu A2-2-1 is second-level menu A2-2; the ancestor node of the current node is all upper level nodes of the current node, for example, in the order of hierarchical distance from small to large, the ancestor nodes of third-level menu A2-2-1 include second-level menu A2-2, first-level menu A2, and application A in turn.

[0031] In some embodiments, the sibling node of the current node is a sibling node with the same parent node, for example, the sibling node of third-level menu A2-2-1 is A2-2-2.

[0032] In combination Figure 3As shown, the present application provides a system architecture, including a role management unit, a menu management unit, an authorization storage unit and a permission judgment unit.

[0033] The role management unit is configured to manage user roles corresponding to the tree menu.

[0034] The menu management unit is configured to maintain the tree menu.

[0035] The authorization storage unit is configured to establish an authorization table between the user roles and the tree menu, to record the authorization records of the menu nodes for different user roles.

[0036] The permission judgment unit is configured to determine the access permission state of the to-be-accessed node according to the authorization table.

[0037] Optionally, the target node is selected according to the tree menu, including: obtaining a user authorization table, wherein the user authorization table includes user authorizations corresponding to each menu node; classifying the menu nodes according to the user authorizations of the descendant nodes corresponding to the menu nodes, to obtain authorization tags, wherein the authorization tags include a full authorization tag, a partial authorization tag or a no authorization tag; if the authorization tag of the menu node is the partial authorization tag, the target node is determined according to the menu node; if the authorization tag of the menu node is the partial authorization tag, and the authorization tags of the descendant nodes corresponding to the menu node include at least two of the full authorization tag, the partial authorization tag and the no authorization tag, a target tag is determined according to the full authorization tag and the no authorization tag, to determine the target node corresponding to the target tag according to the descendant nodes corresponding to the menu node.

[0038] In some embodiments, the user can select the target node according to the user role; if the authorization record of the selected target node is set to the exclusion state, the target node cannot be accessed by the user, and in the sibling nodes corresponding to the target node, the sibling nodes corresponding to the half-selected state are accessed according to the half-selected state, and the sibling nodes without authorization records are accessed according to the full-selected state; if the authorization record of the selected target node is set to the full-selected state, the target node can be accessed by the user, and in the sibling nodes corresponding to the target node, the sibling nodes corresponding to the half-selected state are accessed according to the half-selected state, and the sibling nodes without authorization records are accessed according to the exclusion state.

[0039] In some embodiments, if the user authorization table corresponding to the tree menu is obtained, the target node is determined from each menu node according to the user authorization in the user authorization table, to realize the automatic conversion of the user authorization table to the authorization record table.

[0040] In some embodiments, the user permission table corresponding to the tree menu is shown in Table 1, wherein the first-level menu A1, the first-level menu A2, the second-level menu A1-1, the second-level menu A1-2, the second-level menu A2-2, the third-level menu A1-1-1, the third-level menu A1-2-1, the third-level menu A1-2-2, and the third-level menu A2-2-1 all need to be set with user permissions, and the second-level menu A2-1, the third-level menu A1-1-2, the third-level menu A2-1-1, the third-level menu A2-1-2, and the third-level menu A2-2-2 all do not have user permissions; based on the user permission table, the menu nodes with the full authorization label include the third-level menu A1-1-1, the third-level menu A1-2-1, the third-level menu A1-2-2, the third-level menu A2-2-1, and the second-level menu A1-2, the menu nodes with the partial authorization label include the second-level menu A1-1, the second-level menu A2-2, the first-level menu A1, and the first-level menu A2, and the menu nodes with the no authorization label include the third-level menu A1-1-2, the third-level menu A2-1-1, the third-level menu A2-1-2, the third-level menu A2-2-2, and the second-level menu A2-1; the full authorization label is determined as the target label, and the target nodes meeting the conditions obtained according to the permission label include the first-level menu A1, the first-level menu A2, the second-level menu A1-1, the second-level menu A1-2, the second-level menu A2-2, the third-level menu A1-1-1, and the third-level menu A2-2-1; compared with the user permission table of 14 user permissions, the number of authorization records is 7, which can reduce the storage space and reduce the redundancy of permission information, and at the same time, the automatic conversion of the authorization record table is realized according to the user permission table, which is convenient for permission management and improves the efficiency of permission management.

[0041] Table 1

[0042] Optionally, the target label is determined according to the full authorization label and the no authorization label, including: if the number of full authorization labels is greater than the number of no authorization labels, the no authorization label is determined as the target label; if the number of full authorization labels is less than the number of no authorization labels, the full authorization label is determined as the target label; and if the number of full authorization labels is equal to the number of no authorization labels, the full authorization label or the no authorization label is determined as the target label.

[0043] In some embodiments, if the number of child nodes of the same menu node is 5, including child node A, child node B, child node C, child node D and child node E; the permission tags of child node A, child node B and child node C are all full authorization tags, the permission tag of child node D is a partial authorization tag, and the permission tag of child node E is a no permission tag; since the permission tag of child node D is a partial authorization tag, child node D is the target node; since the number of full authorization tags is 3 and the number of no permission tags is 1, child node E corresponding to the no permission tag is the target node; therefore, among child node A, child node B, child node C, child node D and child node E, child node D and child node E are generated as target nodes to generate permission records, and child node A, child node B and child node C do not exist permission records.

[0044] Optionally, the permission record corresponding to the target node is set according to the authorization ratio, including: if the authorization ratio of the descendant nodes corresponding to the target node is equal to 100%, the permission record corresponding to the target node is set to the full selection state; if the authorization ratio of the descendant nodes corresponding to the target node is less than 100% and greater than 0%, the permission record corresponding to the target node is set to the half selection state; if the authorization ratio of the descendant nodes corresponding to the target node is equal to 0%, the permission record corresponding to the target node is set to the exclusion state.

[0045] In some embodiments, if there are authorized nodes and unauthorized nodes in the same level of menu nodes, only the full selection state or the exclusion state is recorded, and each menu node does not need to be set.

[0046] In this way, compared with the yes or no binary permission logic of the authorization information, by converting the authorization ratio of the descendant nodes of the target node into the three-value logic of the full selection state (ALL_SELECTED), the half selection state (PARTIAL_SELECTED) and the exclusion state (EXCLUDED), the permission information table is simplified through the permission record table, and the storage space occupation of the permission is reduced.

[0047] In combination with Figure 4 the application also provides an application method of the permission record, including: Step S401, according to the storage method of the permission record, obtaining the permission record corresponding to the target node; Step S402, in response to the to-be-accessed node, taking the to-be-accessed node and the ancestor nodes corresponding to the to-be-accessed node as intermediate nodes, according to the hierarchical distance corresponding to the to-be-accessed node and each intermediate node, querying the permission records of each intermediate node in ascending order to obtain the traceability node with the permission record; Wherein, the to-be-accessed node is any menu node; In step S403, the access permission state of the to-be-accessed node is determined according to the permission record corresponding to the traceable node.

[0048] By using the application method of the permission record, the target node is selected according to the tree menu, the permission record of the target node is set according to the authorized proportion of the descendant nodes corresponding to the target node, when the access request of the to-be-accessed node is received, the to-be-accessed node and all ancestor nodes thereof are taken as intermediate nodes, the traceable nodes with the permission record are determined from the intermediate nodes in ascending order according to the hierarchical distance between the to-be-accessed node and each intermediate node, and the access permission state of the to-be-accessed node is determined according to the permission record of the traceable node. In this way, compared with the binary permission logic of the authorization information, the authorized granularity is refined by converting the authorized proportion of the descendant nodes of the target node into the permission record thereof by means of the multi-value permission logic, and by selecting a part of the target nodes from the tree menu, it is not necessary to configure the authorization information for each menu node, the access permission state of the to-be-accessed node is determined according to the permission record obtained by tracing, so that the redundant permission information is effectively reduced, the storage space occupation is reduced, and the authorization management is facilitated.

[0049] Optionally, if the traceable node and the to-be-accessed node are the same menu node, the access permission state of the to-be-accessed node is determined according to the permission record corresponding to the traceable node, and the access permission state of the to-be-accessed node is determined as allowed to access if the permission record corresponding to the traceable node is in the full selection state or the half selection state, and the access permission state of the to-be-accessed node is determined as refused to access if the permission record corresponding to the traceable node is in the exclusion state.

[0050] In combination with Figure 5 As shown in the figure, the application provides an application method of a permission record, which comprises the following steps: In step S501, if the traceable node and the to-be-accessed node are the same menu node, the permission record corresponding to the traceable node is obtained. In step S502, it is judged whether the permission record corresponding to the traceable node is in the full selection state or the half selection state, if yes, the step S503 is jumped to, and if no, the step S504 is jumped to. In step S503, the access permission state of the to-be-accessed node is determined as allowed to access.

[0051] In step S504, the access permission state of the to-be-accessed node is determined as refused to access.

[0052] Optionally, if the tracing node is a parent node of the to-be-accessed node, the access permission state of the to-be-accessed node is determined according to the permission record corresponding to the tracing node, including: if the permission record corresponding to the tracing node is the all-selected state, the access permission state of the to-be-accessed node is determined as allowed to access; if the permission record corresponding to the tracing node is the exclusion state, the access permission state of the to-be-accessed node is determined as refused to access; if the permission record corresponding to the tracing node is the half-selected state, the permission record of a brother node corresponding to the to-be-accessed node is acquired; if the permission record of the brother node only includes the half-selected state, the access permission state of the to-be-accessed node is determined as refused to access; if the permission record of the brother node includes the all-selected state, the access permission state of the to-be-accessed node is determined as refused to access; if the permission record of the brother node includes the exclusion state, the access permission state of the to-be-accessed node is determined as allowed to access.

[0053] In combination Figure 6 As shown in the drawings, the application provides an application method of a permission record, including: Step S601, if the tracing node is a parent node of the to-be-accessed node, the permission record corresponding to the tracing node is acquired. Step S602, it is judged whether the permission record corresponding to the tracing node is the all-selected state, if yes, step S603 is jumped, if not, step S604 is jumped. Step S603, the access permission state of the to-be-accessed node is determined as allowed to access.

[0054] Step S604, it is judged whether the permission record corresponding to the tracing node is the exclusion state, if yes, step S605 is jumped, if not, step S606 is jumped. Step S605, the access permission state of the to-be-accessed node is determined as refused to access.

[0055] Step S606, the permission record of a brother node corresponding to the to-be-accessed node is acquired. Step S607, it is judged whether the permission record of the brother node only includes the half-selected state, if yes, step S605 is jumped, if not, step S608 is jumped. Step S608, it is judged whether the permission record of the brother node includes the all-selected state, if yes, step S605 is jumped, if not, step S603 is jumped.

[0056] Optionally, if the traceability node is an ancestor node of the to-be-accessed node and the traceability node does not include the parent node of the to-be-accessed node, the access permission state of the to-be-accessed node is determined according to the permission record corresponding to the traceability node, including: if the permission record corresponding to the traceability node is the full selection state, the access permission state of the to-be-accessed node is determined as allowed to access; if the permission record corresponding to the traceability node is the exclusion state, the access permission state of the to-be-accessed node is determined as refused to access; if the permission record corresponding to the traceability node is the half selection state, the menu node between the traceability node and the to-be-accessed node is determined as a reference node, and the access permission state of the to-be-accessed node is determined according to the access permission state of the reference node.

[0057] In combination with Figure 7 As shown in the accompanying drawings, the application provides an application method of a permission record, including: Step S701, if the traceability node is an ancestor node of the to-be-accessed node and the traceability node does not include the parent node of the to-be-accessed node, the permission record corresponding to the traceability node is obtained. Step S702, it is judged whether the permission record corresponding to the traceability node is the full selection state, if yes, jump to step S703, if not, jump to step S704. Step S703, the access permission state of the to-be-accessed node is determined as allowed to access.

[0058] Step S704, it is judged whether the permission record corresponding to the traceability node is the exclusion state, if yes, jump to step S705, if not, jump to step S706. Step S705, the access permission state of the to-be-accessed node is determined as refused to access.

[0059] Step S706, the access permission state corresponding to the reference node is obtained. Wherein, the reference node is a menu node between the traceability node and the to-be-accessed node, and the reference node is a child node of the traceability node. Step S707, it is judged whether the access permission state corresponding to the reference node is allowed to access, if yes, jump to step S703, if not, jump to step S705.

[0060] Optionally, according to the hierarchical distance corresponding to each intermediate node and the to-be-accessed node, each intermediate node is traversed in ascending order to obtain the traceability node with the permission record, including: the to-be-accessed node is determined as a current node; in response to the current node, it is judged whether the current node has the permission record; if the current node has the permission record, the current node is determined as the traceability node; if the current node does not have the permission record, the parent node of the current node is determined as a new current node.

[0061] In some embodiments, the permission record table is shown in Table 2, where the target nodes are the first-level menu B, the first-level menu C, the second-level menu B3, the second-level menu B4, the second-level menu C4, and the second-level menu C5, the permission record of the first-level menu B is in the half-selected state, the permission record of the first-level menu C is in the half-selected state, the permission record of the second-level menu B3 is in the exclusion state, the permission record of the second-level menu B4 is in the exclusion state, the permission record of the second-level menu C4 is in the full-selected state, and the permission record of the second-level menu C5 is in the full-selected state.

[0062] Table 2

[0063] In some embodiments, based on the permission record table of Table 2, in response to the node to be accessed being the second-level menu C3, it is determined in turn that the second-level menu C3 has no permission record, the permission record of the parent node corresponding to the second-level menu C3 is in the half-selected state, and the permission records of the sibling nodes corresponding to the second-level menu C3 are all in the full-selected state, and the access permission state of the second-level menu C3 is determined to be denied access.

[0064] In some embodiments, based on the permission record table of Table 2, in response to the node to be accessed being the third-level node C31, it is determined in turn that the third-level node C31 has no permission record, the parent node corresponding to the third-level node C31 has no permission record, the permission record of the trace node corresponding to the third-level node C31 is in the half-selected state, and the access permission state of the reference node (i.e., the second-level menu C3) between the third-level node C31 and the trace node is denied access, and the access permission state of the third-level node C31 is determined to be denied access.

[0065] In some embodiments, based on the permission record table of Table 2, in response to the node to be accessed being the second-level menu B2, it is determined in turn that the second-level menu B2 has no permission record, the permission record of the parent node corresponding to the second-level menu B2 is in the half-selected state, and the permission records of the sibling nodes corresponding to the second-level menu B2 are all in the exclusion state, and the access permission state of the second-level menu C3 is determined to be allowed access.

[0066] In some embodiments, based on the permission record table of Table 2, in response to the node to be accessed being the third-level node B21, it is determined in turn that the third-level node B21 has no permission record, the parent node corresponding to the third-level node B21 has no permission record, the permission record of the trace node corresponding to the third-level node B21 is in the half-selected state, and the access permission state of the reference node (i.e., the second-level menu B2) between the third-level node B21 and the trace node is allowed access, and the access permission state of the third-level node B21 is determined to be allowed access.

[0067] In some embodiments, based on the permission record table in Table 2, in response to the to-be-accessed node being the third-level menu B41, it is determined in turn that the third-level node B41 does not have a permission record, the permission record of the parent node corresponding to the third-level node B41 is in the exclusion state, and the access permission state of the third-level menu B41 is determined as denied access.

[0068] In some embodiments, based on the permission record table in Table 2, in response to the to-be-accessed node being the third-level menu C41, it is determined in turn that the third-level node C41 does not have a permission record, the permission record of the parent node corresponding to the third-level node C41 is in the all-selected state, and the access permission state of the third-level menu C41 is determined as allowed access.

[0069] In this way, relying on the hierarchical structure of the menu, the traceable node is determined from bottom to top by the recursive method, the access permission state of the to-be-accessed node is determined by the permission record of the traceable node, and the permission conflicts between different levels are reduced.

[0070] Optionally, the method further includes: obtaining a permission record table, wherein the permission record table includes one or more user roles, target nodes corresponding to the user roles respectively, and permission records between the user roles and the target nodes; if a target user selects a to-be-accessed node, obtaining a target role corresponding to the target user to extract the permission record corresponding to the target role from the permission record table according to a matching result between the target role and each user role; searching from the permission record corresponding to the target role in combination with the tree menu to obtain a permission record of a traceable node, and determining an access permission state of the to-be-accessed node according to the permission record of the traceable node.

[0071] In some embodiments, the permission record is generated in a triple format, the triple including a node identifier corresponding to a menu node, a role identifier corresponding to a user role, and a permission record corresponding to the menu node for the user role, wherein the permission record includes an all-selected state, a half-selected state, and an exclusion state, the all-selected state indicating that the menu node and its descendant nodes all have user permissions, the half-selected state indicating that the descendant nodes of the menu node have both authorized nodes and unauthorized nodes, and the exclusion state indicating that the menu node and its descendant nodes all do not have user permissions.

[0072] In combination with Figure 8 As shown in the accompanying drawings, the present application provides an application method of a permission record, including: Step S801: obtaining a current user role and a to-be-accessed node corresponding to the current user role; Step S802: querying a permission record table according to the current user role; Step S803: constructing a query path according to a tree menu, traversing ancestor nodes corresponding to the to-be-accessed node according to the query path, and determining a traceable node; Step S804, determining the access permission state of the to-be-accessed node according to the permission record corresponding to the traceability node; Step S805, displaying the tree menu on the front-end device according to the access permission state, so that the user accesses the to-be-accessed node.

[0073] In combination Figure 9 As shown in the drawings, the present application provides a permission record storage system, comprising an acquisition module 901, a selection module 902, a statistical module 903 and a storage module 904.

[0074] The acquisition module 901 is configured to acquire a tree menu, wherein the tree menu is composed of a plurality of menu nodes having a superior-inferior relationship.

[0075] The selection module 902 is configured to select target nodes according to the tree menu, wherein the number of the target nodes is less than the number of the menu nodes.

[0076] The statistical module 903 is configured to count the authorized proportion of the descendant nodes corresponding to the target nodes.

[0077] The storage module 904 is configured to set the permission record corresponding to the target nodes according to the authorized proportion, and store the permission record, wherein the permission record corresponding to the target nodes is used to determine the access permission state of the descendant nodes corresponding to the target nodes.

[0078] By using the permission record storage system provided by the present application, the target nodes are selected according to the tree menu, and the permission record of the target nodes is set according to the authorized proportion of the descendant nodes corresponding to the target nodes, and the access permission state of the descendant nodes corresponding to the target nodes is determined according to the permission record. In this way, compared with the binary permission logic of the authorization information, the authorized proportion of the descendant nodes of the target nodes is converted into the permission record of the target nodes, and the authorization granularity is refined by means of the multi-value permission logic, and a part of the target nodes are selected from the tree menu, and the access permission control of the menu nodes can be realized without separately configuring the authorization information for each menu node, thereby effectively reducing the redundant permission information, reducing the storage space occupation, and facilitating the authorization management.

[0079] The present application also provides an electronic device, comprising a processor and a memory; the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned method.

[0080] Figure 10 The structure of the computer system of the electronic device suitable for realizing the embodiments of the present application is shown. It should be noted that, Figure 10 The computer system 1000 of the electronic device shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0081] As Figure 10 shown, the computer system 1000 includes a central processing unit (CPU) 1001 which can perform various appropriate actions and processes, such as executing the methods in the above-described embodiments, according to a program stored in a read-only memory (ROM) 1002 or a program loaded into a random access memory (RAM) 1003 from the storage section 1008. In the RAM 1003, various programs and data required for the operation of the system are also stored. The CPU 1001, the ROM 1002, and the RAM 1003 are connected to each other through a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0082] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as necessary. A removable recording medium 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 1010 as necessary, so that a computer program read out therefrom is installed in the storage section 1008 as necessary.

[0083] The electronic device disclosed in the embodiment includes a processor, a memory, a transceiver and a communication interface. The memory and the communication interface are connected with the processor and the transceiver and complete communication with each other. The memory is used for storing a computer program. The communication interface is used for communication. The processor and the transceiver are used for running the computer program, so that the electronic device executes each step of the method.

[0084] The above description and drawings are illustrative of embodiments of the present disclosure and are not intended to be limiting. Other embodiments can include structural, logical, electrical, process, and other changes. Embodiments are merely representative of possible variations. Individual components and functions are optional and the order of operations can vary. Portions and sub-combinations of some embodiments can be included or replaced in or by other embodiments. Also, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. As used in the description of the embodiments and the claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. Similarly, the term "and / or" as used herein refers to any and all possible combinations of one or more of the associated listed items. Additionally, as used in this application, the term "comprises" and variations thereof do not intend to preclude the presence or addition of one or more other items to those stated in the compositions, integers, steps, operations, elements, and / or components. Without more limitations, an element defined by the phrase "comprises a..." does not exclude the presence of additional identical elements in the process, method, or apparatus including the element. In this document, each embodiment focuses on the differences from other embodiments, and the same or similar parts between embodiments can be referred to each other. For the method, product, etc. disclosed by the embodiments, if it corresponds to the method part disclosed by the embodiments, the relevant part can be referred to the description of the method part.

[0085] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0086] In the embodiments disclosed herein, the disclosed methods, products (including but not limited to devices, apparatuses, etc.) can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some of the components can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms. The unit illustrated as a separate component can or can not be physically separate, and can or can not be a physical component. Some or all of the units can be selected according to actual needs to implement the embodiments. In addition, the units in the application can be integrated into a processing unit, or each unit can exist physically as a separate entity, or two or more units can be integrated into a unit.

[0087] The flowcharts and block diagrams in the drawings show the architectural, functional and operational aspects of possible implementations of systems, methods and computer program products according to the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a portion of code that contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions noted in the blocks can occur in a different order than that shown in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the drawings, the operations or steps corresponding to different blocks can also occur in an order different from that disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. Each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for storing permission records, characterized in that, include: Obtain a tree-shaped menu, wherein the tree-shaped menu consists of multiple menu nodes with a hierarchical relationship; Select a target node from the tree menu, wherein the number of target nodes is less than the number of menu nodes; Calculate the authorization ratio of the descendant nodes corresponding to the target node; The permission record corresponding to the target node is set according to the authorization ratio, and the permission record is stored. The permission record corresponding to the target node is used to determine the access permission status of the descendant nodes corresponding to the target node.

2. The method for storing permission records according to claim 1, characterized in that, Selecting a target node from the tree menu includes: Obtain the user permission table, wherein the user permission table includes the user permissions corresponding to each of the menu nodes; The menu node is classified according to the user permissions of its descendant nodes to obtain permission tags, wherein the permission tags include fully authorized tags, partially authorized tags, or no permission tags; If the permission label of the menu node is a partially authorized label, then the target node is determined based on the menu node; If the permission label of the menu node is a partially authorized label, and the permission labels of the child nodes corresponding to the menu node include at least two of the following: fully authorized label, partially authorized label, and no permission label, then a target label is determined based on the fully authorized label and the no permission label, so as to determine the target node corresponding to the target label based on the child nodes corresponding to the menu node.

3. The method for storing permission records according to claim 2, characterized in that, A target tag is determined based on fully authorized tags and no-authorization tags, including: If the number of fully authorized tags is greater than the number of unauthorized tags, then the unauthorized tags are identified as target tags; If the number of fully authorized tags is less than the number of unauthorized tags, then the fully authorized tags are determined as target tags; If the number of fully authorized tags is equal to the number of unauthorized tags, then either the fully authorized tags or the unauthorized tags are determined as target tags.

4. The method for storing permission records according to any one of claims 1 to 3, characterized in that, Based on the authorization ratio, set the permission record corresponding to the target node, including: If the authorization ratio of the descendant nodes corresponding to the target node is equal to 100%, then the permission record corresponding to the target node is set to the selected state. If the authorization ratio of the descendant nodes corresponding to the target node is less than 100%, and the authorization ratio of the descendant nodes corresponding to the target node is greater than 0%, then the permission record corresponding to the target node is set to a half-selected state. If the authorization ratio of the descendant nodes corresponding to the target node is 0%, then the permission record corresponding to the target node is set to an excluded state.

5. A method for applying permission records, characterized in that, include: According to the method for storing permission records as described in any one of claims 1 to 4, the permission record corresponding to the target node is obtained; In response to the node to be accessed, the node to be accessed and its corresponding ancestor node are taken as intermediate nodes. Based on the hierarchical distance between the node to be accessed and each of the intermediate nodes, the permission records of each of the intermediate nodes are queried in ascending order to obtain the source node with permission records. The node to be accessed is any menu node. The access permission status of the node to be accessed is determined based on the permission record corresponding to the source node.

6. The method for applying permission records according to claim 5, characterized in that, If the source node and the node to be accessed are the same menu node, the access permission status of the node to be accessed is determined according to the permission record corresponding to the source node, including: If the permission record corresponding to the source node is in a state of full selection or half selection, then the access permission status of the node to be accessed is determined to be allowed access. If the permission record corresponding to the source node is in an excluded state, then the access permission status of the node to be accessed will be determined as access denied.

7. The method for applying permission records according to claim 5, characterized in that, If the source node is the parent node of the node to be accessed, the access permission status of the node to be accessed is determined according to the permission record corresponding to the source node, including: If the permission record corresponding to the source node is in the selected state, then the access permission status of the node to be accessed is determined to be allowed. If the permission record corresponding to the source node is in an excluded state, then the access permission status of the node to be accessed is determined to be denied access. If the permission record corresponding to the source node is in a half-selected state, then obtain the permission record of the sibling node corresponding to the node to be accessed; If the permission record corresponding to the sibling node only includes a half-selected state, then the access permission status of the node to be accessed is determined to be access denied. If the permission record corresponding to the sibling node includes a "select all" state, then the access permission status of the node to be accessed will be determined as "access denied". If the permission record corresponding to the sibling node includes an exclusion status, then the access permission status of the node to be accessed is determined to be allowed access.

8. The method for applying permission records according to claim 5, characterized in that, If the source node is an ancestor node of the node to be accessed, and the source node does not include the parent node of the node to be accessed, the access permission status of the node to be accessed is determined according to the permission record corresponding to the source node, including: If the permission record corresponding to the source node is in the selected state, then the access permission status of the node to be accessed is determined to be allowed. If the permission record corresponding to the source node is in an excluded state, then the access permission status of the node to be accessed is determined to be denied access. If the permission record corresponding to the source node is in a half-selected state, then the menu node between the source node and the node to be accessed is determined as a reference node, and the access permission status of the node to be accessed is determined according to the access permission status of the reference node.

9. A storage system for access control records, characterized in that, include: The acquisition module is used to acquire a tree menu, wherein the tree menu consists of multiple menu nodes with a hierarchical relationship; The selection module is used to select a target node according to the tree menu, wherein the number of target nodes is less than the number of menu nodes; The statistics module is used to calculate the authorization ratio of the descendant nodes corresponding to the target node; The storage module is used to set the permission record corresponding to the target node according to the authorization ratio, and to store the permission record, wherein the permission record corresponding to the target node is used to determine the access permission status of the descendant nodes corresponding to the target node.

10. An electronic device, characterized in that, include: Processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to cause the electronic device to perform the permission record storage method as described in any one of claims 1 to 4, or the permission record application method as described in any one of claims 5 to 8.

Images