Authority control method and device, data management system, equipment and storage medium

Abstract

The invention relates to an authority control method and device, a data management system, equipment and a storage medium. The method comprises the following steps: collecting fingerprint data corresponding to each touch operation from the first detection of the touch operation for a main operation interface of a system; according to the fingerprint data collected this time and fingerprint data collected before this time, determining a user state corresponding to the touch operation this time; under the condition of determining that the user state corresponding to the touch operation is a user change state, determining an authority level corresponding to the fingerprint data collected at the time; according to the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected before this time, a permission system corresponding to the touch operation this time is regulated and controlled. In the operation process, the user is dynamically identified, the permission level of the user is dynamically matched, and the permission system is adjusted, so that the purpose of adjusting the operation permission along with the change of the identity of the user in the operation process is achieved, and the data security is improved.

Description

Technical Field

[0001] This application relates to the field of information processing technology, and in particular to an access control method, apparatus, data management system, device, and storage medium. Background Technology

[0002] Data management systems are deployed in many scenarios, and to protect their data security, access control mechanisms are commonly implemented. The mainstream access control methods are mostly password-based verification systems: pre-setting fixed passwords or temporarily assigning dynamic passwords, and verifying the user's legitimacy based on the entered password. However, password-based verification systems have high security risks, such as data security risks arising from password leaks or password cracking. To address these security risks, biometric verification systems (such as fingerprint and facial recognition) have been introduced to replace password verification. Because biometric features are unique, user legitimacy is verified based on pre-entered biometric characteristics. While biometric verification systems improve system security to some extent, they still have significant limitations in access control. This is because existing access control only applies as an access control measure during the login phase. After successful login, subsequent operations do not require further access verification. This one-time verification, all-access control model fails to dynamically verify identity changes during multi-user collaborative operations, making it impossible to guarantee security during operations. For example, if a staff member is verified during the login process but then temporarily leaves during subsequent operations, and an unknown person continues to perform the operation, the existing access control model will not verify the unknown person, thus failing to protect the system's data security. Summary of the Invention

[0003] This application provides access control methods, devices, data management systems, equipment, and storage media to address the problem that existing access control models only appear as an access control measure during the login phase. In multi-user collaborative operation scenarios, they do not dynamically verify identity changes during the operation process, which can easily lead to data security issues.

[0004] To address the aforementioned technical problems, the technical solution of this application is provided through the following embodiments:

[0005] This application provides an access control method, comprising: collecting fingerprint data corresponding to each touch operation from the first detection of a touch operation on the system's main operating interface; determining the user state corresponding to the current touch operation based on the currently collected fingerprint data and previously collected fingerprint data; determining the access level corresponding to the currently collected fingerprint data if the user state corresponding to the current touch operation is determined to be a user change state; and adjusting the access control system corresponding to the current touch operation based on the access level corresponding to the currently collected fingerprint data and the access level corresponding to the previously collected fingerprint data.

[0006] Specifically, determining the user state corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously includes: if the fingerprint data collected this time is different from the fingerprint data collected previously, determining the user state corresponding to the current touch operation as a user change state; if the fingerprint data collected this time is the same as the fingerprint data collected previously, determining the user state corresponding to the current touch operation as a user hold state.

[0007] The method further includes: maintaining the permission system unchanged when it is determined that the user state corresponding to the current touch operation is the user hold state.

[0008] The step of adjusting the permission system corresponding to the current touch operation based on the permission level of the fingerprint data collected this time and the permission level of the fingerprint data collected previously includes: maintaining the permission system unchanged when the permission level of the fingerprint data collected this time is equal to the permission level of the fingerprint data collected previously; switching to the permission system corresponding to the permission level of the fingerprint data collected this time when the permission level of the fingerprint data collected this time is greater than the permission level of the fingerprint data collected previously; and adjusting the permission system based on the effective permission opening window when the permission level of the fingerprint data collected this time is less than the permission level of the fingerprint data collected previously.

[0009] The step of adjusting the permission system based on the effective permission opening window includes: when the current time is within the effective permission opening window and the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operation before activating the effective permission opening window, switching to the permission system that allows access when activating the effective permission opening window; when the current time is outside the effective permission opening window, or when the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the touch operation before activating the permission opening window, adjusting to the permission system corresponding to the permission level of the fingerprint data collected this time.

[0010] Before adjusting the permission system based on the valid permission opening window, the method further includes: detecting a setting operation for activating a preset permission opening window; determining the permission level of the fingerprint data corresponding to the setting operation; and, if the permission level of the fingerprint data corresponding to the setting operation is greater than or equal to the permission level of the fingerprint data corresponding to each of the preceding touch operations, determining the permission opening window as a valid permission opening window and setting the allowed access permission system in the valid permission opening window.

[0011] The process of collecting fingerprint data corresponding to each touch operation also includes: if the stop time of the touch operation is detected to be longer than the preset security protection time, returning to the main operation interface of the system and re-detecting the first touch operation for the main operation interface of the system.

[0012] This application embodiment also provides an access control device, including: a data acquisition module, used to acquire fingerprint data corresponding to each touch operation from the first detection of a touch operation on the system's main operating interface; a first determination module, used to determine the user state corresponding to the current touch operation based on the fingerprint data acquired this time and the fingerprint data acquired previously; a second determination module, used to determine the access level corresponding to the fingerprint data acquired this time when it is determined that the user state corresponding to the current touch operation is a user change state; and an access control module, used to control the access control system corresponding to the current touch operation based on the access level corresponding to the fingerprint data acquired this time and the access level corresponding to the fingerprint data acquired previously.

[0013] This application also provides a data management system that applies the access control method described in any of the above embodiments.

[0014] This application embodiment also provides an access control device, including: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus, wherein the processor is configured to execute an access control program stored in the memory to implement the access control method described in any of the above claims.

[0015] This application also provides a computer-readable storage medium storing computer-executable instructions, which are executed to implement the access control method described in any of the above claims.

[0016] Compared with the prior art, the technical solution provided in this application has the following advantages: The method provided in this application can start from the first detection of a touch operation on the main operating interface of the system, and collect fingerprint data corresponding to each touch operation; determine the user state corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously; if it is determined that the user state corresponding to the current touch operation is a user change state, determine the permission level corresponding to the fingerprint data collected this time; and adjust the permission system corresponding to the current touch operation based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously. In order to solve the problem that the existing permission management mode only appears as an access control method during the login stage, and cannot guarantee data security in multi-user collaborative operation scenarios without dynamic verification of identity changes during the operation process, this application dynamically identifies whether the user has changed by detecting the fingerprint data corresponding to each touch operation during the operation process, and dynamically matches the user's permission level when the user changes, and adjusts the permission system according to the change of permission level during the operation process, thereby achieving the purpose of adjusting operation permissions as the user's identity changes during the operation process, and improving the data security of the data management system during the operation process. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0020] Figure 1 This is a flowchart of an access control method according to an embodiment of this application;

[0021] Figure 2 This is a flowchart illustrating the steps for setting the permission access window according to an embodiment of this application;

[0022] Figure 3 This is a flowchart of a window control permission system based on valid permissions according to an embodiment of this application;

[0023] Figure 4 This is a structural diagram of an access control device according to an embodiment of this application;

[0024] Figure 5 This is a structural diagram of an access control device according to an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0027] This application provides an access control method. This application is executed within a data management system. The types of data management systems include, but are not limited to, network management systems, operation and maintenance systems, and equipment management systems. The application scenarios of this application include, but are not limited to, industrial scenarios, internet scenarios, and IoT scenarios.

[0028] like Figure 1 The diagram shown is a flowchart of an access control method according to an embodiment of this application.

[0029] Step S110: Starting from the first detection of a touch operation on the system's main operating interface, collect fingerprint data corresponding to each touch operation.

[0030] The first detected touch operation targeting the system's main interface refers to the detection of the user's first touch operation starting from the system's main interface. After navigating to the system's main interface, this first detected touch operation targeting the system's main interface can be defined as the first detected touch operation targeting the system's main interface and used as the starting point for a permission management process.

[0031] The system's main interface is the default one. This main interface can be the operating system login page or the operating system homepage that appears after logging in.

[0032] Touch operation refers to the actions performed as the touch point moves from the moment it touches down to the moment it lifts up. During a single touch operation, the fingerprint data collected from the touch point remains unchanged.

[0033] Fingerprint data refers to the unique biometric feature of a fingerprint. Fingerprint data can be used to identify a unique user. During a touch operation, the fingerprint data of the user performing the touch operation can be collected when the touch point is detected.

[0034] Step S120: Determine the user status corresponding to this touch operation based on the fingerprint data collected this time and the fingerprint data collected previously.

[0035] The fingerprint data collected this time refers to the fingerprint data corresponding to the current touch operation.

[0036] The fingerprint data collected previously refers to the fingerprint data corresponding to each touch operation preceding the first detected touch operation on the system's main interface. For example, the fingerprint data collected previously includes: the fingerprint data corresponding to the first touch operation, the fingerprint data corresponding to the second touch operation, ..., and the fingerprint data corresponding to the touch operation preceding the current touch operation.

[0037] User state refers to the change in user status between two consecutive touch operations. User state includes two categories: user-changed state and user-held state. A user-changed state indicates a change in the operator between the current touch operation and the previous touch operation. A user-held state indicates no change in the operator between the current touch operation and the previous touch operation.

[0038] Specifically, if the fingerprint data collected this time differs from the previously collected fingerprint data, it can be determined that the user state corresponding to this touch operation is a changed user state. If the fingerprint data collected this time is the same as the previously collected fingerprint data, it can be determined that the user state corresponding to this touch operation is a retained user state. By identifying the user state of each touch operation, it is possible to identify in real time whether the operator has changed, overcoming the limitation of traditional permission management models that cannot detect user switching during operation, and providing a decision-making basis for subsequent dynamic permission adjustment.

[0039] Furthermore, since there are no user touch operation records before the first detection of a touch operation on the system's main operating interface, when the first touch operation on the system's main operating interface is detected, it can be determined that the user state corresponding to this touch operation is the user hold state.

[0040] Step S130: If it is determined that the user status corresponding to this touch operation is a user change status, determine the permission level corresponding to the fingerprint data collected this time.

[0041] Permission level refers to the level of operational permissions that the user corresponding to the fingerprint data has.

[0042] For example, permission levels include: ordinary user permission level, engineering user permission level, and manufacturer user permission level.

[0043] For example, permission levels include: visitor user permission levels and administrator user permission levels.

[0044] Specifically, standard fingerprint data corresponding to multiple users can be pre-collected and stored, and permission levels can be set for each user. After collecting the fingerprint data corresponding to the current touch operation, the collected fingerprint data can be matched with each of the pre-stored standard fingerprint data. The permission level corresponding to the standard fingerprint data that matches the collected fingerprint data can be determined.

[0045] Furthermore, to facilitate fingerprint data management and improve fingerprint matching speed, users with the lowest access level do not need to pre-collect and store standard fingerprint data and set corresponding access levels. When matching the fingerprint data collected this time with each pre-stored standard fingerprint data, if there is no standard fingerprint data that matches the fingerprint data collected this time, then the access level corresponding to the fingerprint data collected this time can be determined as the lowest access level.

[0046] When a user change is detected, the embodiments of this application immediately determine the permission level of the new user in order to provide a basis for subsequent permission control and prevent users with lower permission levels from inheriting the operational capabilities of users with higher permission levels.

[0047] Step S140: Adjust the permission system corresponding to the current touch operation based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously.

[0048] The permission system refers to the subsystem in a data management system that consists of system data and system functions corresponding to permission levels.

[0049] For example, the permission system corresponding to the ordinary user permission level refers to the permission system that allows users to operate on some system data and some system functions, the permission system corresponding to the engineering user permission level refers to the permission system that allows engineering users to operate on some system data and some system functions, and the permission system corresponding to the manufacturer user permission level can be all system data and all system functions.

[0050] Furthermore, different permission levels can correspond to different permission systems, or a permission system with a high permission level can include a permission system with a low permission level.

[0051] For example, the permission levels, from lowest to highest, are: ordinary user permission level, engineering user permission level, and manufacturer user permission level; the permission system corresponding to the engineering user permission level includes the permission system corresponding to the ordinary user permission level, and the permission system corresponding to the manufacturer user permission level includes the permission system corresponding to the engineering user permission level.

[0052] In this embodiment, after collecting the fingerprint data corresponding to the current touch operation, the system does not directly switch to the permission system corresponding to the permission level of the collected fingerprint data. Instead, it needs to combine the permission level corresponding to the collected fingerprint data with the permission level corresponding to the previously collected fingerprint data to comprehensively determine the permission system corresponding to the current touch operation. How this embodiment specifically determines the permission system corresponding to the current touch operation will be described later and will not be elaborated upon here.

[0053] In this embodiment, after determining the user state corresponding to the current touch operation, if the user state is determined to be a changed user state, the permission level corresponding to the fingerprint data collected this time is determined; based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously, the permission system corresponding to the current touch operation is adjusted. In this embodiment, if the user state corresponding to the current touch operation is determined to be a kept user state, the permission system remains unchanged. Maintaining the permission system unchanged means that the permission system remains the same as the permission system of the previous touch operation, and the operation interface remains the operation interface last displayed in the previous touch operation.

[0054] In this embodiment, fingerprint data corresponding to each touch operation is collected starting from the first detected touch operation on the system's main interface. Based on the collected fingerprint data and previously collected fingerprint data, the user state corresponding to the current touch operation is determined. If the user state corresponding to the current touch operation is determined to be a changed user state, the permission level corresponding to the collected fingerprint data is determined. Based on the permission level corresponding to the collected fingerprint data and the permission level corresponding to the previously collected fingerprint data, the permission system corresponding to the current touch operation is adjusted. To address the problem that existing permission management models only appear as an access control method during the login phase, and in multi-user collaborative operation scenarios, do not dynamically verify identity changes during operation, thus failing to guarantee data security, this embodiment dynamically identifies whether the user has changed by detecting the fingerprint data corresponding to each touch operation during operation. When the user changes, the user's permission level is dynamically matched, and the permission system is adjusted according to the changes in permission level during operation. This achieves the goal of adjusting operation permissions as the user's identity changes during operation, improving the data security of the data management system during operation.

[0055] To make the embodiments of this application clearer, the preparatory work for executing the permission control method of this application will be described below.

[0056] In this embodiment of the application, the data management system has multiple user types. For example, user types include, but are not limited to, ordinary users, engineering users, and manufacturer users. Ordinary users are those who use the data management system. Engineering users are those who maintain and operate the data management system. Manufacturer users are those who develop the data management system.

[0057] In a data management system, permission levels are set for each user type. Different permission levels mean different operational permissions, visible user interfaces, and configurable interface parameters within the data management system; in other words, different permission levels correspond to different permission systems.

[0058] For example, the permission levels, from lowest to highest, are: ordinary users, engineering users, and manufacturer users. Ordinary users have user-level operation permissions and can view and operate the user-level operation interface in the data management system. Engineering users have engineering-level operation permissions and, in addition to user-level permissions, can also view and operate the engineering-level operation interface in the data management system. Manufacturer users have manufacturer-level operation permissions and, in addition to engineering-level permissions, can also view and operate the manufacturer-level operation interface in the data management system.

[0059] In this embodiment of the application, before executing the permission control method of this embodiment, fingerprint data of each user can be collected as standard fingerprint data, and a corresponding permission level can be set for each user; the standard fingerprint data and the corresponding permission level of the user are stored in a preset storage space for subsequent query.

[0060] Furthermore, since the number of users with the lowest permission level is the largest, while the number of users with higher permission levels above the lowest permission level is relatively small, it is possible to collect fingerprint data only from users with higher permission levels and set permission levels for these users. Subsequently, users whose fingerprint data cannot match the standard fingerprint data will be defaulted to users with the lowest permission level.

[0061] For example, since there are the most ordinary users and relatively few engineering users and manufacturer users, in order to save storage space, reduce system computation, and improve user identification speed, only fingerprint data of engineering users and manufacturer users can be collected. Unfamiliar users (i.e., users whose fingerprint data cannot match standard fingerprint data) can be identified as ordinary users and determined to have the lowest privilege level below engineering users and manufacturer users.

[0062] In this embodiment of the application, after executing the permission control method of this embodiment, the role (permission level) of each user can be determined when different users perform touch operations in the data management system. Then, the operation permissions can be adjusted according to the changes in the user's role so that the current operation interface can be adapted to the current user's role. This avoids opening high-permission operation interfaces to users with low permission levels, thus preventing security issues in the data management system.

[0063] To make the embodiments of this application clearer, the specific implementation process of the permission control method of the embodiments of this application will be described below.

[0064] In this embodiment of the application, fingerprint data corresponding to each touch operation can be collected starting from the first detection of a touch operation on the system's main operating interface.

[0065] The system's main interface can be the system's login page or the homepage displayed after logging in.

[0066] When the main system interface is the homepage displayed after login, the system can begin detecting the first touch operation on the main interface after successful login and redirection; and / or, it can begin detecting the first touch operation on the main interface after redirection from other interfaces. Furthermore, redirection from other interfaces to the main interface includes, but is not limited to: changes in permission levels, confirmation that the touch operation has been completed, and confirmation that the duration of the touch operation's pause exceeds the preset security protection duration.

[0067] The data management system uses a touchscreen. From the first detected touch operation on the system's main interface, fingerprint data corresponding to each touch operation is collected and recorded on the touchscreen. Furthermore, upon detecting the first touch operation on the system's main interface, the system begins recording the fingerprint data and operation data corresponding to each touch operation in a log file. The logging is complete when the user interface has switched back to the system's main interface. Before the next first touch operation on the system's main interface is detected, the log file can be cleared or a new log file can be generated.

[0068] In this embodiment of the application, during the process of collecting fingerprint data corresponding to each touch operation, the user state corresponding to the current touch operation can be determined based on the fingerprint data collected this time and the fingerprint data collected previously.

[0069] User states can be categorized into two types: user hold state and user change state. User hold state means the user performing the current touch operation is the same as the user performing the previous touch operation. User change state means the user performing the current touch operation is different from the user performing the previous touch operation.

[0070] If the user state corresponding to this touch operation is determined to be a user-held state, the permission system remains unchanged.

[0071] If it is determined that the user status corresponding to this touch operation is a user change status, the permission level corresponding to the fingerprint data collected this time is determined; based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously, the permission system corresponding to this touch operation is adjusted.

[0072] The following describes how to adjust the permission system corresponding to the current touch operation based on the permission level of the fingerprint data collected this time and the permission level of the fingerprint data collected previously.

[0073] When a touch operation on the system's main interface is detected for the first time, since there is no recorded fingerprint data corresponding to the previous touch operation, and the permission level corresponding to the previously collected fingerprint data cannot be determined, the user state corresponding to this touch operation can be directly determined to be the user-held state, and the system can be switched to the permission level corresponding to the currently collected fingerprint data. For example: after successfully logging into the system's main interface, when a regular user performs their first touch operation, because there is no matching standard fingerprint data in the system, the user-level interface can be displayed, and engineering-level and manufacturer-level parameters will not appear in the user-level interface; or, when an engineering user performs their first touch operation, both the user-level and engineering-level interfaces can be displayed, and manufacturer-level parameters will not appear in the engineering-level interface; or, when a manufacturer user performs their first touch operation, the user-level, engineering-level, and manufacturer-level interfaces can be displayed.

[0074] When a touch operation targeting the system's main interface is subsequently detected, the permission level corresponding to the current touch operation can be determined by comparing the permission level corresponding to the fingerprint data collected this time with the permission level corresponding to the fingerprint data collected previously.

[0075] Among these options, the permission system can remain unchanged if the permission level corresponding to the fingerprint data collected this time is equal to the permission level corresponding to the fingerprint data collected previously.

[0076] For example: the fingerprint data collected this time corresponds to the same ordinary user permission level as the previously collected fingerprint data; or, the fingerprint data collected this time corresponds to the same engineering user permission level as the previously collected fingerprint data; or, the fingerprint data collected this time corresponds to the same manufacturer user permission level as the previously collected fingerprint data. In these cases, the permission levels corresponding to the two touch operations do not change, thus maintaining the permission system and allowing the next user to continue operating within its corresponding permission system.

[0077] Specifically, if the permission level corresponding to the fingerprint data collected this time is greater than the permission level corresponding to the fingerprint data collected previously, the system can switch to the permission system corresponding to the permission level of the fingerprint data collected this time.

[0078] For example, the fingerprint data collected this time corresponds to the engineering user permission level, while the fingerprint data collected previously corresponds to the ordinary user permission level. Alternatively, the fingerprint data collected this time corresponds to the manufacturer user permission level, while the fingerprint data collected previously corresponds to the ordinary user permission level or the engineering user permission level. In order to avoid providing a high-permission operation interface to users with low permission levels, it is necessary to switch the current permission system to the permission system corresponding to the permission level of the fingerprint data collected this time when the permission level decreases.

[0079] Among these features, when the permission level corresponding to the fingerprint data collected this time is lower than the permission level corresponding to the fingerprint data collected previously, the permission system can be adjusted based on the effective permission opening window.

[0080] A valid permission open window refers to a window whose current permission open status is valid. A permission open window is a period of time during which permissions are granted. This period can be a pre-set time period, or a time period set by a user with higher privileges for a user with lower privileges.

[0081] The following provides two methods for controlling the permission system by opening windows with valid permissions. Those skilled in the art should understand that these two methods are merely illustrative of embodiments of this application and are not intended to limit the scope of this application.

[0082] Method 1: At least one permission-opening window can be pre-set, and a corresponding permission level can be set for each permission-opening window. If the permission level corresponding to the fingerprint data collected this time is lower than the permission level corresponding to the fingerprint data collected previously, the end value of each permission-opening window is read to determine whether there is a permission-opening window that includes the current time. If there is a permission-opening window that includes the current time, it is determined as a valid permission-opening window, and the system is switched to the permission system corresponding to the valid permission-opening window. If there is no permission-opening window that includes the current time, the system is switched to the permission system corresponding to the permission level of the fingerprint data collected this time.

[0083] For example, in scenarios where maintenance time is strictly managed, in order to complete debugging work within a short and fixed maintenance period, permission-opening windows can be pre-set according to the required maintenance period. This allows ordinary users to operate the high-level operation interface during the maintenance period, avoiding the waste of maintenance time by frequently setting permission-opening windows during the maintenance period.

[0084] Method two allows for dynamically setting permission access windows, and then adjusting the permission system based on these dynamically set windows. Specifically, this can be combined with... Figure 2 and Figure 3The process of opening a window to control permissions based on valid permissions is described through the various steps of this process. Figure 2 This is a flowchart illustrating the steps for setting permissions for an open window according to an embodiment of this application. Figure 3 This is a flowchart of a window control permission system based on valid permissions according to an embodiment of this application.

[0085] Step S210: Before controlling the permission system based on the valid permission open window, detect the setting operation used to activate the preset permission open window.

[0086] The permission granting window refers to the time period during which permissions need to be granted to subsequent users.

[0087] The settings operation refers to the touch operation used to activate the permission opening window and make the permission opening window effective.

[0088] Specifically, a permission opening window setting can be set in the operation interface, and an activation control can be set in this permission opening window setting. When the activation control is triggered, the permission opening window set in the permission opening window setting takes effect. Therefore, when a click operation targeting the activation control is detected, it is determined that a setting operation for activating the permission opening window has been detected.

[0089] Step S220: Determine the permission level of the fingerprint data corresponding to the setting operation.

[0090] Step S230: Determine whether the permission level of the fingerprint data corresponding to the setting operation is greater than the permission level of the fingerprint data corresponding to each of the preceding touch operations; if yes, proceed to step S240; if no, proceed to step S250.

[0091] Step S240: If it is determined that the permission level of the fingerprint data corresponding to the setting operation is greater than or equal to the permission level of the fingerprint data corresponding to each of the preceding touch operations, the permission opening window is determined to be a valid permission opening window and the allowed opening permission system is set in the valid permission opening window.

[0092] Allowing open permission systems refers to the permission system displayed in the valid permission open window.

[0093] The permission system that allows access can be either a permission system that sets the permission level corresponding to the operation, or a permission system that sets a lower permission level than the operation.

[0094] For example, manufacturer users can configure their access permissions to allow the display of manufacturer-level or engineering-level access systems in the open window; engineering users can configure their access permissions to allow the display of engineering-level access systems in the open window. By configuring these access permissions, users with lower access levels can temporarily access the interface of users with higher access levels.

[0095] Step S250: If, among the permission levels of the fingerprint data corresponding to each touch operation prior to the setting operation, the permission level of the fingerprint data corresponding to the setting operation is determined to be lower than the permission level of the fingerprint data corresponding to at least one touch operation, then the permission opening window is determined to be an invalid permission opening window. When the permission opening window is determined to be invalid, it is discarded, and a preset prompt message can be issued to indicate that the permission opening window setting has failed.

[0096] Furthermore, an effective permission open window refers to a permission open window set by the user with the highest known permission level in the known touch operation, starting from the first detection of a touch operation on the system's main operating interface, and the time period has not yet ended.

[0097] Specifically, starting with the first detected touch operation on the system's main interface, the permission level of the fingerprint data corresponding to each touch operation before the setting operation is determined. If the permission level corresponding to the setting operation is greater than or equal to the permission levels corresponding to each of the previous touch operations, the permission opening window is determined to be a valid permission opening window. At this point, the permission system settings can be allowed according to the permission system selection command. The permission system selection command carries the permission system information selected by the user. Of course, it is also possible not to set the permission system to be allowed. If the permission system is not set, the permission system corresponding to the operation's permission level can be set as the allowed permission system by default.

[0098] Furthermore, since there may have been other settings with the same permission level as this one that also set up an open window for valid permissions before this setting operation, the open window for valid permissions set now can be used to replace the previously set open window for valid permissions.

[0099] For example: This time, a manufacturer user sets up an open window with valid permissions. However, before this, another manufacturer user also set up an open window with valid permissions. In this case, the open window with valid permissions set up this time will replace the previously set open window with valid permissions.

[0100] Furthermore, since there may have been other settings with valid permission opening windows that were set before this setting operation, which have a lower permission level than the one corresponding to this setting operation, it can be determined that the previously set valid permission opening window is invalid.

[0101] For example: This time, the manufacturer user sets the effective permissions to open the window. However, before this, the engineering user had already set the effective permissions to open the window. In this case, it is determined that the effective permissions set by the engineering user are invalid.

[0102] Furthermore, in order to ensure that the user with the highest level of privilege has actual control, after collecting the fingerprint data corresponding to the touch operation and determining the privilege level corresponding to the fingerprint data, if it is determined that there is a valid permission opening window set by a setting operation with a lower privilege level than the touch operation, then it can be determined that the valid permission opening window is invalid.

[0103] For example, if the user with the highest access level is identified as the primary controller, then based on the fingerprint data corresponding to the current setup operation and previous touch operations, and assuming that a regular user, an engineering user, and a manufacturer user are all present, only the manufacturer user can set the valid access window. If a regular user and an engineering user are identified as present, and the engineering user has already set the valid access window, then when the manufacturer user's presence is detected, the valid access window set by the engineering user will be invalidated.

[0104] Step S310: When opening the window control permission system based on valid permissions, read the current time.

[0105] The current time can be the current system time of the data operating system.

[0106] Step S320: Determine whether the current time is within the valid permission open window; if yes, proceed to step S330; if no, proceed to step S350.

[0107] Step S330: Determine whether the fingerprint data corresponding to this touch operation is the same as the fingerprint data corresponding to the touch operation before activating the valid permission to open the window; if yes, proceed to step S340; if no, proceed to step S350.

[0108] In multi-user operation scenarios, it can be assumed that the users corresponding to each touch operation before activating the valid permission opening window are all users recognized by each user, i.e., users who can operate the data management system. If the user corresponding to the current touch operation is among the users recognized by each user, then the user corresponding to the current touch operation is indeed recognized by each user. If the user corresponding to the current touch operation is not among the users recognized by each user, then the user corresponding to the current touch operation may not be a user recognized by each user. To address this issue, this application embodiment needs to determine whether the user corresponding to the current touch operation is a user recognized by each user by determining whether the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operations before activating the valid permission opening window.

[0109] Furthermore, since the operation is continuous, when a user with a lower permission level needs to operate the interface of a user with a higher permission level, the user with the higher permission level will immediately set up an effective permission opening window for the user with the lower permission level. That is to say, the touch operations between the two users are adjacent. Therefore, in this embodiment of the application, when determining whether the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operation before activating the effective permission opening window, it can be determined whether the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the last touch operation before activating the effective permission opening window.

[0110] For example, when activating a window with valid permissions during the Tth touch operation, it is necessary to determine whether the fingerprint data corresponding to the T+1th touch operation is the same as the fingerprint data corresponding to the T-1th touch operation.

[0111] Step S340: Switch to the allowed open permission system set when activating the effective permission open window.

[0112] In this embodiment of the application, after the effective permission opening window ends, switch to the main system operation interface or switch to the permission system corresponding to the permission level of the fingerprint data collected this time.

[0113] For example, fingerprint recognition identifies a regular user as the first to operate the screen. At this point, only the user-level interface is displayed; the engineering-level and manufacturer-level interfaces are not shown. After the regular user's operation, an engineering user is identified as the next to operate the screen. This can be identified as an after-sales debugging scenario. Therefore, the engineering user can set the effective permission window, and only the engineering user can set this. For example, if the effective permission window is set to 5 minutes, since no system-wide permission settings have been configured, the user remains on the engineering-level interface for 5 minutes. During these 5 minutes, the regular user has engineering-level permissions and can operate the engineering-level interface. After the 5 minutes expire, the system automatically returns to the main interface. To continue using engineering-level permissions, the engineering user needs to set the effective permission window again.

[0114] Step S350: Adjust the permission system to the permission level corresponding to the fingerprint data collected this time. Simultaneously with adjusting the permission system to the permission level corresponding to the fingerprint data collected this time, it can be determined that the valid permission opening window is invalid.

[0115] In this embodiment, a user with a high level of privilege can grant access to the high-level operation interface for the user preceding them (a user with a low level of privilege). If the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the last touch operation before activating the valid permission opening window, it means that after the user with a high level of privilege granted permissions to the user preceding them, the user preceding them did not perform any operation, but instead switched to another user. In this case, it is necessary to display the permission system according to the permission level of the other user and determine that the valid permission opening window has become invalid.

[0116] Furthermore, the permission system adjusted to the permission level corresponding to the fingerprint data collected this time includes: comparing the permission level corresponding to the current touch operation with the permission level corresponding to the setting operation of activating a valid permission open window; if the permission level corresponding to the current touch operation is the same as the permission level corresponding to the setting operation of activating a valid permission open window, maintaining the current operation interface; if the permission level corresponding to the current touch operation is different from the permission level corresponding to the setting operation of activating a valid permission open window, switching to the operation interface of the permission system corresponding to the current touch operation's permission level. Switching to the operation interface of the permission system corresponding to the current touch operation's permission level can be: switching to the system's main operation interface. This is because the system's main operation interface belongs to the permission system of all permission levels, and touch operations can continue from the system's main operation interface.

[0117] For example, fingerprint recognition can be used to determine that engineering users operate the screen first, followed by regular users, thus identifying an after-sales debugging scenario. Using fingerprint recognition, if the regular user is identified as a new user who has not previously operated the system, security protection will be immediately activated and the system will return to the main interface, regardless of whether the engineering user has set a valid access period. Specifically: when a new regular user is detected, if a valid access window has been set, it will be deactivated, and the system will return to the main interface; if no valid access window has been set, the new regular user will be prohibited from operating the engineering-level interface and will be redirected to the main interface, restricting their access to only the user-level interface. If the regular user has previously operated the system, they can operate the engineering-level interface within the valid access window; when the valid access window expires, the system will return to the main interface.

[0118] In other words, if the user is currently within the effective permission opening window, and the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operation before activating the effective permission opening window, the system that allows access to permissions set when activating the effective permission opening window is switched to. Furthermore, if the user is currently within the effective permission opening window, and the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the last touch operation before activating the effective permission opening window, the system that allows access to permissions set when activating the effective permission opening window is switched to.

[0119] In other words, if the current time is outside the effective permission opening window, or if the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the touch operation before activating the permission opening window, the permission system will be adjusted to the permission level corresponding to the currently collected fingerprint data. Furthermore, when adjusting the permission system based on the effective permission opening window, if the current time is outside the effective permission opening window, or if the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the last touch operation before activating the permission opening window, the permission system will be adjusted to the permission level corresponding to the currently collected fingerprint data.

[0120] In this embodiment, since users may temporarily leave or not perform any operations while using the data system, this embodiment provides a security protection mechanism. Specifically, if the duration of the touch operation is detected to be longer than a preset security protection duration, the system can return to the main operation interface and re-detect the first touch operation on the main operation interface.

[0121] The security protection duration can be set by a user with any permission level, or by the user with the highest permission level in the previous touch operation, or by a user with a permission level other than the lowest permission level in the previous touch operation. For example, the security protection duration setting can be displayed only in the permission system corresponding to the highest permission level; based on this security protection duration setting, the security protection duration can be set, so that ordinary users and engineering users below the manufacturer user will not be able to set the security protection duration.

[0122] The duration of this security protection can be an empirical value or a value obtained through experimentation. For example, the security protection duration can be 3 minutes. By setting the security protection duration, if there is no touch operation for an extended period and the security protection duration is reached, the current operation interface will jump back to the main system operation interface, and the initial touch operation on the main system operation interface will be re-detected, and the collection and recording of fingerprint data corresponding to each touch operation will resume.

[0123] In this embodiment, since not all content is important when displaying the data management system's interface on a touchscreen, the permission control method of this embodiment can be executed in a preset display area on the touchscreen. Specifically: starting from the first detection of a touch operation on the system's main interface, fingerprint data corresponding to each touch operation is collected in the preset display area; based on the collected fingerprint data and previously collected fingerprint data, the user state corresponding to the current touch operation is determined; if the user state corresponding to the current touch operation is determined to be a user change state, the permission level corresponding to the collected fingerprint data is determined; and based on the permission level corresponding to the collected fingerprint data and previously collected fingerprint data, the permission system corresponding to the current touch operation is adjusted.

[0124] Compared to traditional permission management models that only verify identity during the login phase and cannot dynamically verify identity changes during multi-user collaborative operations, this application provides a mechanism of continuous fingerprint collection and dynamic permission control. Fingerprint data is continuously collected from the moment the first touch operation on the system's main interface is detected. User changes are identified in real time by comparing fingerprints from previous and subsequent operations. After a user change is identified, the permission level of the new user is determined, and the permission system is adjusted in real time according to the changes in permission level. This prevents users with lower permission levels from inheriting the operational capabilities of users with higher permission levels, prevents the risk of abuse of rights, and avoids data security issues caused by user switching or permission abuse during operation.

[0125] This application also provides an access control device. For example... Figure 4 The diagram shown is a structural diagram of an access control device according to an embodiment of this application.

[0126] The access control device includes:

[0127] The data acquisition module 410 is used to collect fingerprint data corresponding to each touch operation, starting from the first detection of a touch operation on the system's main operating interface.

[0128] The first determining module 420 is used to determine the user status corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously.

[0129] The second determining module 430 is used to determine the permission level corresponding to the fingerprint data collected this time when it is determined that the user status corresponding to the current touch operation is a user change status.

[0130] The permission control module 440 is used to control the permission system corresponding to the current touch operation based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously.

[0131] The functions of the apparatus described in this application embodiment have been described in the above method embodiments. Therefore, for any parts not detailed in the description of this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.

[0132] This application also provides an access control device, such as... Figure 5 The diagram shown is a structural diagram of an access control device according to an embodiment of this application.

[0133] The access control device includes a processor 510, a communication interface 520, a memory 530, and a communication bus 540. The processor 510, communication interface 520, and memory 530 communicate with each other via the communication bus 540.

[0134] Memory 530 is used to store computer programs.

[0135] In one embodiment of this application, when the processor 510 executes a program stored in the memory 530, it implements the permission control method provided in any of the foregoing method embodiments, including: starting from the first detection of a touch operation on the system's main operating interface, collecting fingerprint data corresponding to each touch operation; determining the user state corresponding to the current touch operation based on the currently collected fingerprint data and the fingerprint data collected previously; if it is determined that the user state corresponding to the current touch operation is a user change state, determining the permission level corresponding to the currently collected fingerprint data; and adjusting the permission system corresponding to the current touch operation based on the permission level corresponding to the currently collected fingerprint data and the permission level corresponding to the fingerprint data collected previously.

[0136] Specifically, determining the user state corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously includes: if the fingerprint data collected this time is different from the fingerprint data collected previously, determining the user state corresponding to the current touch operation as a user change state; if the fingerprint data collected this time is the same as the fingerprint data collected previously, determining the user state corresponding to the current touch operation as a user hold state.

[0137] The method further includes: maintaining the permission system unchanged when it is determined that the user state corresponding to the current touch operation is the user hold state.

[0138] The step of adjusting the permission system corresponding to the current touch operation based on the permission level of the fingerprint data collected this time and the permission level of the fingerprint data collected previously includes: maintaining the permission system unchanged when the permission level of the fingerprint data collected this time is equal to the permission level of the fingerprint data collected previously; switching to the permission system corresponding to the permission level of the fingerprint data collected this time when the permission level of the fingerprint data collected this time is greater than the permission level of the fingerprint data collected previously; and adjusting the permission system based on the effective permission opening window when the permission level of the fingerprint data collected this time is less than the permission level of the fingerprint data collected previously.

[0139] The step of adjusting the permission system based on the effective permission opening window includes: when the current time is within the effective permission opening window and the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operation before activating the effective permission opening window, switching to the permission system that allows access when activating the effective permission opening window; when the current time is outside the effective permission opening window, or when the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the touch operation before activating the permission opening window, adjusting to the permission system corresponding to the permission level of the fingerprint data collected this time.

[0140] Before adjusting the permission system based on the valid permission opening window, the method further includes: detecting a setting operation for activating a preset permission opening window; determining the permission level of the fingerprint data corresponding to the setting operation; and, if the permission level of the fingerprint data corresponding to the setting operation is greater than or equal to the permission level of the fingerprint data corresponding to each of the preceding touch operations, determining the permission opening window as a valid permission opening window and setting the allowed access permission system in the valid permission opening window.

[0141] The process of collecting fingerprint data corresponding to each touch operation also includes: if the stop time of the touch operation is detected to be longer than the preset security protection time, returning to the main operation interface of the system and re-detecting the first touch operation for the main operation interface of the system.

[0142] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the access control method provided in any of the foregoing method embodiments. Since the access control method has already been described in detail above, any omissions in this embodiment's description can be found in the relevant descriptions in the foregoing embodiments, and will not be repeated here.

[0143] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0144] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0145] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0146] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for access control, characterized in that, include: Starting from the first detected touch operation on the system's main interface, fingerprint data is collected for each touch operation. Based on the fingerprint data collected this time and the fingerprint data collected previously, the user status corresponding to this touch operation is determined; If it is determined that the user status corresponding to this touch operation is a user change status, the permission level corresponding to the fingerprint data collected this time is determined; Based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously, the permission system corresponding to this touch operation is adjusted.

2. The method according to claim 1, characterized in that, The process of determining the user state corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously includes: If the fingerprint data collected this time is different from the fingerprint data collected previously, the user status corresponding to this touch operation is determined to be a user change status. If the fingerprint data collected this time is the same as the fingerprint data collected previously, the user state corresponding to this touch operation is determined to be the user hold state.

3. The method according to claim 2, characterized in that, The method further includes: If the user state corresponding to this touch operation is determined to be a user-held state, the permission system remains unchanged.

4. The method according to claim 1, characterized in that, The step of adjusting the permission system corresponding to the current touch operation based on the permission level corresponding to the fingerprint data collected this time and the permission level corresponding to the fingerprint data collected previously includes: If the permission level corresponding to the fingerprint data collected this time is the same as the permission level corresponding to the fingerprint data collected previously, the permission system will remain unchanged. If the permission level corresponding to the fingerprint data collected this time is greater than the permission level corresponding to the fingerprint data collected previously, switch to the permission system corresponding to the permission level of the fingerprint data collected this time. If the permission level corresponding to the fingerprint data collected this time is lower than the permission level corresponding to the fingerprint data collected previously, the permission system is adjusted based on the effective permission opening window.

5. The method according to claim 4, characterized in that, The aforementioned window opening based on valid permissions, and the permission control system, includes: If the current time is within the effective permission opening window, and the fingerprint data corresponding to the current touch operation is the same as the fingerprint data corresponding to the touch operation before activating the effective permission opening window, switch to the permission system set when activating the effective permission opening window; If the current time is outside the effective permission opening window, or if the fingerprint data corresponding to the current touch operation is different from the fingerprint data corresponding to the touch operation before activating the permission opening window, the permission system will be adjusted to the permission level corresponding to the fingerprint data collected this time.

6. The method according to claim 4, characterized in that, Before the description of opening a window based on valid permissions and controlling the permission system, the following is also included: Detect the settings operation used to activate the window with preset permissions; Determine the permission level of the fingerprint data corresponding to the setting operation; If it is determined that the permission level of the fingerprint data corresponding to the setting operation is greater than or equal to the permission level of the fingerprint data corresponding to each of the preceding touch operations, the permission opening window is determined to be a valid permission opening window and the allowed opening permission system is set in the valid permission opening window.

7. The method according to any one of claims 1-6, characterized in that, The process of collecting fingerprint data corresponding to each touch operation also includes: If the duration of the touch operation is detected to be longer than the preset safety protection duration, the system returns to the main operation interface and re-detects the first touch operation on the main operation interface.

8. An access control device, characterized in that, include: The data acquisition module is used to collect fingerprint data corresponding to each touch operation, starting from the first detection of a touch operation on the system's main operating interface. The first determining module is used to determine the user status corresponding to the current touch operation based on the fingerprint data collected this time and the fingerprint data collected previously. The second determining module is used to determine the permission level corresponding to the fingerprint data collected this time when it is determined that the user status corresponding to this touch operation is a user change status; The permission control module is used to adjust the permission system corresponding to the current touch operation based on the permission level of the fingerprint data collected this time and the permission level of the fingerprint data collected previously.

9. A data management system, characterized in that, The data management system applies the access control method described in any one of claims 1-7.

10. An access control device, characterized in that, include: At least one communication interface; At least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; At least one memory connected to the at least one bus, wherein the processor is configured to execute a permission control program stored in the memory to implement the permission control method according to any one of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which are executed to implement the access control method according to any one of claims 1-7.

Images