Authority management method, electronic equipment and storage medium
The graphical interface and dynamic permission allocation of the permission management platform solve the complexity of cross-system permission management, achieve efficient and secure permission management, simplify permission configuration and verification processes, and improve system security and response speed.
Patent Information
- Application Number
- CN202511285524.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-09
- Publication Date
- 2026-01-06
AI Technical Summary
Traditional access control methods are ill-suited to the dynamic access requirements across systems, resulting in low security and efficiency in inter-system interactions, as well as high maintenance costs and increased complexity.
This paper provides a permission management method that uses a permission management platform to obtain access permission information for various application systems, uses a graphical interface for permission configuration and verification, supports dynamic permission allocation, and ensures that only authorized application systems can perform corresponding operations.
It simplifies the access control process, reduces security vulnerabilities, improves the security and compliance of inter-system interactions, and enhances the system's flexibility and responsiveness.
Smart Images
Figure CN121278697A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a permission management method, electronic device, and storage medium. Background Technology
[0002] With the rapid development of information technology, enterprise information system architectures are becoming increasingly complex. In the information technology (IT) environment of modern enterprises, different business systems are usually developed and maintained by different technical teams. These business systems need to frequently exchange data and call functions to achieve collaborative work of business processes.
[0003] However, this cross-system interaction introduces complexity into access control. Traditional access control methods are typically designed based on user roles within a single system, making it difficult to adapt to dynamic access requirements across systems and to meet the security and efficiency needs of inter-system interactions. Summary of the Invention
[0004] This invention provides a permission management method, electronic device, and storage medium for providing an efficient, flexible, and secure cross-system call permission management solution to meet the refined permission control requirements of enterprises in complex IT environments.
[0005] In a first aspect, an embodiment of the present invention provides a permission management method, the method comprising:
[0006] Obtain access permission information for each application system;
[0007] In response to a call request initiated by the application system on the calling side, the system performs permission verification on the application system on the calling side based on the calling permission information of the application system on the calling side.
[0008] Based on the permission verification results, determine whether the application system on the calling side is allowed to perform operations related to this call.
[0009] As an optional implementation, the call permission information includes call rules; before obtaining the call permission information of each application system, it also includes:
[0010] Display the permission configuration interface;
[0011] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0012] As an optional implementation, the method further includes:
[0013] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0014] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0015] As an optional implementation, the method further includes:
[0016] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0017] As an optional implementation, permission verification is performed on the application system on the calling side based on the calling permission information of the application system on the calling side, including:
[0018] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0019] As an optional implementation, the method further includes:
[0020] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0021] Secondly, an embodiment of the present invention provides a permission management system, including a permission management platform and multiple application systems, wherein:
[0022] The permission management platform is used to obtain the access permission information of each application system;
[0023] The application system on the calling side initiates the call request;
[0024] The permission management platform is used to verify the permissions of the application system on the calling side based on the calling permission information of the application system on the calling side, and determine whether the application system on the calling side is allowed to perform operations related to this call based on the permission verification result.
[0025] As an optional implementation, the application system integrates the software development kit of the permission management platform;
[0026] When the application system starts, it obtains its latest access permission information from the permission management platform based on the software development kit of the permission management platform.
[0027] Thirdly, an electronic device provided by an embodiment of the present invention includes a processor and a memory, wherein the memory is used to store a program executable by the processor, and the processor is used to read the program in the memory and perform the following steps:
[0028] Obtain access permission information for each application system;
[0029] In response to a call request initiated by the application system on the calling side, the system performs permission verification on the application system on the calling side based on the calling permission information of the application system on the calling side.
[0030] Based on the permission verification results, determine whether the application system on the calling side is allowed to perform operations related to this call.
[0031] As an optional implementation, the call permission information includes call rules; before obtaining the call permission information of each application system, the processor is further configured to execute:
[0032] Display the permission configuration interface;
[0033] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0034] As an optional implementation, the processor is further configured to execute:
[0035] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0036] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0037] As an optional implementation, the processor is further configured to execute:
[0038] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0039] As an optional implementation, the processor is specifically configured to execute:
[0040] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0041] As an optional implementation, the processor is further configured to execute:
[0042] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0043] Fourthly, embodiments of the present invention also provide a permission management device, the device comprising:
[0044] The permission acquisition module is used to obtain access permission information for each application system;
[0045] The permission verification module is used to respond to a call request initiated by the application system on the calling side and to verify the permissions of the application system on the calling side based on the call permission information of the application system on the calling side.
[0046] The call judgment module is used to determine whether the application system on the caller's side is allowed to perform operations related to this call based on the permission verification result.
[0047] As an optional implementation, the call permission information includes call rules; before obtaining the call permission information of each application system, the permission acquisition module is further used for:
[0048] Display the permission configuration interface;
[0049] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0050] As an optional implementation, the permission acquisition module is further used for:
[0051] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0052] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0053] As an optional implementation, the permission acquisition module is further used for:
[0054] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0055] As an optional implementation, the permission verification module is specifically used for:
[0056] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0057] As an optional implementation, the permission verification module is further used for:
[0058] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0059] Fifthly, embodiments of the present invention also provide a computer storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the steps of the method described in any of the first aspects above.
[0060] In a sixth aspect, this application provides a computer program product comprising: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of the first aspects.
[0061] These or other aspects of this application will become more apparent in the following description of embodiments.
[0062] The permission management method provided in this embodiment offers a global perspective for monitoring and managing the access permission information of all connected application systems. In this way, technical personnel can define and adjust the calling rules between various application systems from a central location, thereby simplifying the permission management process and reducing potential security vulnerabilities. When application systems call each other, permission verification is performed first to ensure that only authorized application systems can perform the corresponding operations, thus guaranteeing the security and compliance of interactions between application systems. Attached Figure Description
[0063] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0064] Figure 1 A flowchart illustrating the implementation of the permission management method provided in this embodiment of the invention;
[0065] Figure 2 A management flowchart of a permission management platform provided in an embodiment of the present invention;
[0066] Figure 3 A flowchart illustrating the implementation of permission synchronization and verification in an embodiment of the present invention;
[0067] Figure 4 A schematic diagram of the structure of a permission management system provided in an embodiment of the present invention;
[0068] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention;
[0069] Figure 6 This is a schematic diagram of the structure of a permission management device provided in an embodiment of the present invention. Detailed Implementation
[0070] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0071] In this embodiment of the invention, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.
[0072] The application scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems. In the description of this invention, unless otherwise stated, "multiple" means two or more.
[0073] Before introducing the permission management method provided in the embodiments of this application, for ease of understanding, the technical background of the embodiments of this application will be described in detail below.
[0074] Existing technical solutions typically employ separate authentication strategies, usually applied during API calls, especially in scenarios requiring authentication. In such cases, each system independently implements its own authorization mechanisms based on its security requirements and design principles. These mechanisms may include, but are not limited to, encryption techniques and the use of authorized application IDs to ensure that only authenticated requests are processed. When a system (referred to as the "interface system") needs to call a service provided by another system (the "called system"), it must comply with all security specifications and requirements set by the latter. This means that before initiating any form of communication, the interface system must complete necessary authentication steps, such as proving itself as a legitimate user through API (Application Programming Interface) keys, OAuth (Open Authorization) tokens, or other forms of identity credentials. Once it obtains the appropriate access permissions, the interface system can send requests to the target service according to the established protocol and wait to receive responses from the other system. Implementing independent authorization mechanisms means that each system needs to develop and maintain its own security logic, which not only increases development costs and time but may also lead to inconsistencies in security standards between different systems. If multiple systems use different authentication methods (such as OAuth, API keys, etc.), the interfacing system needs to write specific code for each case to handle the authentication process, which further increases the system's complexity. Requires an authentication step for every request, which can negatively impact system performance. Especially when encryption technologies or complex authentication processes are involved, additional computational resource consumption is unavoidable. For service calls in high-concurrency scenarios, frequent authentication operations can lead to longer response times, affecting user experience. Furthermore, maintaining multiple authentication mechanisms also means a greater operational burden and potential points of failure.
[0075] In today's IT environment, inter-system interaction and data sharing are crucial components of enterprise operations. However, such cross-system calls and data exchanges are often accompanied by complex access control issues. Different systems may be built on different technical architectures and security standards, making the unified management and control of access permissions between these heterogeneous systems extremely complex. Furthermore, with changing business needs and system upgrades, access control settings require frequent updates, which not only increases the management workload but also raises security risks due to configuration errors.
[0076] To address the aforementioned technical issues, this application provides a permission management method. This method offers a global perspective for monitoring and managing the access permission information of all connected application systems. In this way, technicians can define and adjust the calling rules between various application systems from a central location, thereby simplifying the permission management process and reducing potential security vulnerabilities. When application systems call each other, permission verification is performed first to ensure that only authorized application systems can perform the corresponding operations, thus guaranteeing the security and compliance of interactions between application systems.
[0077] like Figure 1 As shown, the permission management method provided in this embodiment can be applied to a permission management platform. The specific implementation process of this method is as follows:
[0078] Step 100: Obtain the access permission information of each application system;
[0079] In implementation, users configure the call permission information for each application system on the permission management platform, which stores and manages this information. Optionally, the call permission information in this embodiment includes, but is not limited to, call rules and call subject (the object initiating the call request) information. The call subject information includes, but is not limited to, any one or more of the following: subject identifier, subject authentication configuration, etc. Subject identifiers include, for example, application system ID (identifier), application service number, application vendor information, application authentication type, etc. Subject authentication configurations are verification rules used to ensure the authenticity of the subject's identity, including authentication methods: password authentication (password encryption algorithm, validity period), token authentication (token type, validity period, refresh rules), certificate authentication (certificate authority, certificate validity period), and biometric authentication (fingerprint / face verification interface permissions). Call rules include, but are not limited to, any one or more of the following: call access rules, call behavior constraint rules, and post-call result processing rules, etc. Among them, the call admission rules are used to define whether the caller's identity is legitimate, whether the caller has the right to initiate the call, and whether the call is initiated in a trusted environment; the call behavior constraint rules are used to define whether the caller has the right to execute the target operation, whether the call parameters meet the predefined security standards, and whether the call frequency exceeds the limit; the post-call result processing rules are used to define the feedback method after the call is successful / failed, and the call behavior tracing mechanism.
[0080] Optionally, each application system in this embodiment integrates the software development kit (SDK) of the permission management platform. When the application system starts, it uses the SDK of the permission management platform to obtain its latest access permission information from the permission management platform.
[0081] In some embodiments, the access permission information includes access rules; before obtaining the access permission information of each application system, this embodiment also performs the following process:
[0082] Displays the permission configuration interface; responds to the user's drag-and-drop operation in the permission configuration interface, configures the calling rules for each application system, and stores the configured calling rules.
[0083] Optionally, the permission configuration interface displays the identification information of each application system. Users can configure the calling rules between application systems by dragging and dropping the identification information of each application system. The identification information includes, but is not limited to, icons and / or text. In implementation, the permission management platform provides a permission configuration interface, where users can easily define and adjust the calling rules between application systems. The graphical permission configuration interface allows for drag-and-drop permission configuration, effectively reducing the complexity of the operation.
[0084] The permission management platform provided in this embodiment is a centralized authorization management platform. Various application systems can register on this platform, and technical personnel can allocate call permission information between application systems according to business needs. This permission management platform is responsible for storing and managing the registration information and call permission information of all connected application systems. This call permission information is integrated into the SDK of the permission management platform of each application system. When an application system starts, it synchronizes the latest call permission information from the permission management platform. This permission management platform provides a global perspective for monitoring and managing the permission configuration of all connected systems. In this way, technical personnel can define and adjust the call rules between systems in a central location, thereby simplifying the permission management process and reducing potential security vulnerabilities.
[0085] During implementation, each application system can register on the permission management platform, which stores the registration information of each application system.
[0086] Step 101: In response to the call request initiated by the application system on the caller side, perform permission verification on the application system on the caller side based on the call permission information of the application system on the caller side.
[0087] In practice, when various application systems call each other, the SDK of the permission management platform of the calling application system will first perform permission verification on the application system to ensure that only authorized systems can perform the corresponding operations, thereby ensuring the security and compliance of the interaction between application systems.
[0088] In some embodiments, permission verification of the application system on the calling side is performed based on the calling permission information of the application system on the calling side in the following manner:
[0089] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0090] In practice, when the application system on the calling side initiates a call request, the SDK of the permission management platform is used to verify whether the application system on the calling side has the right to execute the target operation and whether the call parameters meet the predefined security standards, so as to ensure that only authorized target operations can be executed.
[0091] Step 102: Determine whether the application system on the calling side is allowed to perform operations related to this call based on the permission verification result.
[0092] Optionally, the permission verification results can be recorded and stored for subsequent auditing and analysis. In implementation, when the permission verification passes, the calling application system is allowed to execute operations related to the current call, and can continue with subsequent related operations. When the permission verification fails, the calling application system is immediately stopped from executing operations related to the current call, and the relevant error data is sent to the calling application system. This not only helps to quickly locate the problem but also provides a basis for further remedial measures. Simultaneously, all permission verification results are recorded for subsequent auditing and analysis.
[0093] In some embodiments, if the permission verification result is abnormal, the current permission verification is immediately terminated, and the abnormal data is sent to the application system on the calling side.
[0094] This embodiment also provides a flexible error handling mechanism. If an anomaly is detected during the permission verification process (such as insufficient user permissions or attempting to access restricted resources), the permission management platform's SDK can immediately terminate the current operation and return detailed error information to the application system on the calling side. This not only helps to quickly locate the problem but also provides a basis for further remedial measures. Simultaneously, all permission verification results are recorded for subsequent auditing and analysis.
[0095] In some embodiments, the permission management platform of this embodiment also supports dynamic permission allocation, allowing permission settings to be quickly updated according to real-time business needs to adapt to the ever-changing environment. Specific implementation methods are shown in any one or more combinations below:
[0096] Method 1: In response to the update command of the application system's business requirements, update the application system's call permission information according to the updated business requirements;
[0097] During implementation, when the business requirements of the application system change, the system's access permission information can be automatically updated based on these real-time changes, allowing for rapid updates to access permission configurations to adapt to the ever-changing environment. The access management platform also supports dynamic permission allocation, enabling quick adjustments to permission settings based on real-time business needs and environmental changes, enhancing the flexibility and responsiveness of the application system.
[0098] Method 2: In response to the user's update operation on the application system's access permission information, update the application system's access permission information.
[0099] During implementation, users can also reconfigure application system access permission information on the permission management platform according to current business needs. The permission management platform stores the updated access permission information, and when each application system starts, the access permission information is automatically synchronized through the platform's SDK, ensuring that the access permission information of each application system is up-to-date. When business logic or security policies change, administrators can update the access rules instantly through the permission management platform without having to modify the configuration of each application individually, greatly simplifying maintenance work.
[0100] In some embodiments, the following steps may also be performed:
[0101] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0102] In implementation, integrating the permission management platform's SDK into each application system is a crucial step in achieving fine-grained permission control and dynamic permission management. Through this mechanism, each application system automatically retrieves the latest permission information from the centralized authorization management platform upon startup. When each application system starts, the SDK automatically synchronizes the latest access permission information stored on the permission management platform with the latest access permission information for each application system. This ensures that all application systems involved in inter-system interaction always have the latest access permission information, thus avoiding security issues caused by outdated access permission information.
[0103] like Figure 2 As shown in the figure, this embodiment also provides a management process for a permission management platform, as detailed below:
[0104] Step 200: Create a permission management platform;
[0105] Step 201: Determine whether the permission management platform has global monitoring and control capabilities. If yes, proceed to step 202a; otherwise, proceed to step 202b.
[0106] Step 202a: In response to the update instruction of the application system's business requirements, update the application system's call permission information according to the updated business requirements;
[0107] Step 203a: The permission management platform stores the updated access permission information of each application system;
[0108] Step 204a: In response to the application system's startup command, send the latest access permission information to the corresponding application system;
[0109] In practice, a permission management platform with global monitoring and control capabilities can simplify the complexity of permission management, support dynamic permission allocation, and adapt to real-time changes in business needs.
[0110] Step 202b: Display the permission configuration interface;
[0111] Step 203b: In response to the user's drag-and-drop operation on the permission configuration interface, configure the calling rules for each application system and store the configured calling rules.
[0112] Step 204b: Provide logging and reporting functions to help users track permission change history and promptly identify and address potential security issues.
[0113] During implementation, the access control platform features an intuitive and user-friendly interface, provides drag-and-drop access control settings, and offers logging and reporting capabilities to help administrators track access control history and promptly identify and address potential security issues.
[0114] The core function of the permission management platform in this embodiment is to store and manage the registration information and access permission information of all connected application systems. Through this platform, enterprises can gain a global perspective to monitor and control the interaction behavior between various application systems. Technical personnel can easily define and adjust the calling rules between different application systems using this platform, ensuring that only authorized operations can be executed. The platform also supports dynamic permission allocation, allowing for rapid updates to access permission information based on real-time business needs to adapt to a constantly changing environment. The platform also features an intuitive and user-friendly interface—the permission configuration interface—which allows technical personnel, even without a strong technical background, to easily learn how to configure and manage various permissions. Users can use a drag-and-drop interface for permission settings, greatly reducing operational complexity. Furthermore, the platform provides detailed logging and reporting functions to help administrators track permission change history and promptly identify and address potential security issues. In addition to its basic functions, the permission management platform also boasts strong scalability and compatibility. It adopts a modular architecture design, allowing for easy integration of new systems and services without requiring large-scale modifications to the existing architecture.
[0115] like Figure 3 As shown in the figure, this embodiment also provides an implementation process for permission synchronization and verification, as detailed below:
[0116] Step 300: The permission management platform stores the access permission information of each application system;
[0117] Step 301: The permission management platform synchronizes the latest access permission information to each application system in real time;
[0118] Step 302: The permission management platform determines whether the access permission information has been updated. If so, proceed to step 301; otherwise, proceed to step 303.
[0119] Step 303: The permission management platform responds to the call request initiated by the application system on the caller side, and performs permission verification on the application system on the caller side based on the call permission information of the application system on the caller side.
[0120] Step 304: Determine if the permission verification passes. If yes, proceed to step 305; otherwise, proceed to step 306.
[0121] Step 305: The application system on the calling side continues to execute subsequent operations related to this call;
[0122] Step 306: Immediately terminate the current permission verification and send the abnormal data to the application system on the calling side.
[0123] This embodiment integrates the SDK of the permission management platform into each application system. Each application system automatically obtains the latest call permission information from the centralized permission management platform upon startup. This real-time synchronization ensures that all application systems participating in inter-system interactions always have the latest call permission configurations, thus avoiding security issues caused by outdated call permission information. When business logic or security policies change, administrators can update the call rules instantly through the permission management platform without modifying the configuration of each application individually, greatly simplifying maintenance. During inter-application system calls, the caller first performs permission verification through the integrated permission management platform SDK. This verification process includes verifying whether the caller has the right to execute the target operation and checking whether the call parameters meet predefined security standards. Only after all these checks pass will the transaction be allowed to continue. This design not only ensures that each call is explicitly authorized but also enhances the security of the entire application system. Even in the face of complex business scenarios and ever-changing external threats, this multi-layered protection mechanism can effectively protect the application system from unauthorized access and potential attacks. This embodiment also provides a flexible error handling mechanism. If any anomalies are detected during the permission verification process (such as insufficient user permissions or attempting to access restricted resources), the permission management platform's SDK can immediately terminate the current operation and return detailed error information to the caller. This not only helps to quickly locate the problem but also provides a basis for further remedial measures. Simultaneously, all permission verification results are recorded for subsequent auditing and analysis.
[0124] The access control method provided in this embodiment offers two key advantages. First, it provides centralized management and dynamic adjustment capabilities. Through a unified access control platform, enterprises can monitor and control the access configurations of all systems accessing the platform from a central location. This simplifies the access control process and reduces security vulnerabilities caused by decentralized access control. Simultaneously, the platform supports dynamic access control allocation, enabling rapid updates to access settings based on real-time business needs and environmental changes. This flexibility allows application systems to quickly adapt to constantly changing external conditions and internal policies, enhancing system flexibility and responsiveness, and improving enterprise responsiveness and operational efficiency. Second, it offers scalability and compatibility. The modular system architecture design allows new application systems and services to be easily integrated into the existing access control platform, ensuring its scalability and compatibility. These features work together to build a secure, reliable, flexible, and efficient IT environment for enterprises, helping to reduce maintenance costs and improve the stability and continuity of overall business operations.
[0125] This embodiment designs a highly efficient and flexible permission synchronization mechanism to ensure that each application system can obtain the latest permission information from the permission management platform in a timely and accurate manner upon startup. Considering the security of communication between application systems, it is essential to ensure that all permission verification processes are secure and reliable, preventing any unauthorized access or data leakage. The system's scalability and compatibility need to be considered to ensure that new systems and services can be seamlessly integrated into the existing permission management framework. To address these challenges, this embodiment employs advanced encryption technology, efficient data synchronization strategies, and a modular system architecture design to ensure that the permission management method provided in this embodiment can meet high security standards while delivering excellent performance and a good user experience.
[0126] Based on the same inventive concept, this invention also provides an access control system. The principle of this system in solving the problem is similar to that of the method. Therefore, the implementation of this system can refer to the implementation of the method, and the repeated parts will not be described again.
[0127] like Figure 4 As shown, the system includes a permission management platform 400 and multiple application systems 401, among which:
[0128] The permission management platform 400 is used to obtain the access permission information of each application system 401;
[0129] The application system on the calling side initiates a 401 call request;
[0130] The permission management platform 400 is used to perform permission verification on the application system 401 on the calling side based on the calling permission information of the application system 401 on the calling side, and determine whether the application system 401 on the calling side is allowed to perform operations related to this call based on the permission verification result.
[0131] As an optional implementation, the application system 401 integrates the software development kit of the permission management platform 400;
[0132] When the application system 401 starts, it obtains its latest access permission information from the permission management platform 400 based on the software development kit of the permission management platform 400.
[0133] This embodiment establishes a centralized permission management platform, which is responsible for storing and managing the registration information and access permission information of all connected application systems. The platform provides a user-friendly interface, allowing technical personnel to easily define and adjust the calling rules between various application systems. Furthermore, the platform supports dynamic permission allocation, enabling rapid updates to access permission information based on real-time business needs and environmental changes, enhancing system flexibility and responsiveness. This embodiment also provides a permission synchronization and verification mechanism, integrating the permission management platform's SDK into each application system. When an application system starts, the SDK automatically synchronizes the latest access permission information from the platform. During inter-application system calls, the caller first performs permission verification through the SDK; only after successful verification can subsequent transaction operations proceed. This design ensures that every call is authorized, thereby improving the security of the application system.
[0134] As an optional implementation, the access permission information includes access rules; before obtaining the access permission information of each application system, the access permission management platform 400 is further configured to:
[0135] Display the permission configuration interface;
[0136] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0137] As an optional implementation, the permission management platform 400 is also used for:
[0138] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0139] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0140] As an optional implementation, the permission management platform 400 is specifically used for:
[0141] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0142] As an optional implementation, the permission management platform 400 is also used for:
[0143] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0144] Based on the same inventive concept, this embodiment of the invention also provides an electronic device. Since this electronic device is the same as the electronic device in the method of this embodiment of the invention, and the principle of solving the problem by this electronic device is similar to that of this method, the implementation of this electronic device can refer to the implementation of the method, and the repeated parts will not be described again.
[0145] like Figure 5 As shown, the electronic device includes a processor 500 and a memory 501. The memory 501 stores programs executable by the processor 500. The processor 500 reads the programs from the memory 501 and performs the following steps:
[0146] Obtain access permission information for each application system;
[0147] In response to a call request initiated by the application system on the calling side, the system performs permission verification on the application system on the calling side based on the calling permission information of the application system on the calling side.
[0148] Based on the permission verification results, determine whether the application system on the calling side is allowed to perform operations related to this call.
[0149] As an optional implementation, the call permission information includes call rules; before obtaining the call permission information of each application system, the processor 500 is further configured to execute:
[0150] Display the permission configuration interface;
[0151] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0152] As an optional implementation, the processor 500 is further configured to perform:
[0153] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0154] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0155] As an optional implementation, the processor 500 is further configured to perform:
[0156] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0157] As an optional implementation, the processor 500 is specifically configured to perform:
[0158] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0159] As an optional implementation, the processor 500 is further configured to perform:
[0160] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0161] Based on the same inventive concept, this embodiment of the invention also provides an access control device. Since this device is the same as the device in the method of this embodiment of the invention, and the principle of the device in solving the problem is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.
[0162] like Figure 6 As shown, the device includes:
[0163] The permission acquisition module 600 is used to obtain access permission information for each application system.
[0164] The permission verification module 601 is used to respond to the call request initiated by the application system on the caller side and to verify the permission of the application system on the caller side based on the call permission information of the application system on the caller side.
[0165] The judgment module 602 is invoked to determine whether the application system on the calling side is allowed to perform operations related to this call based on the permission verification result.
[0166] As an optional implementation, the call permission information includes call rules; before obtaining the call permission information of each application system, the permission acquisition module 600 is further configured to:
[0167] Display the permission configuration interface;
[0168] In response to user drag-and-drop operations in the permission configuration interface, the calling rules for each application system are configured and the configured calling rules are stored.
[0169] As an optional implementation, the permission acquisition module 600 is further configured to:
[0170] In response to an update command from the application system's business requirements, the system updates the application system's access permission information according to the updated business requirements; and / or,
[0171] In response to a user's update operation on the application system's access permission information, the access permission information of the application system is updated.
[0172] As an optional implementation, the permission acquisition module 600 is further configured to:
[0173] In response to the application system's startup command, the application system's access permission information is sent to the application system.
[0174] As an optional implementation, the permission verification module 601 is specifically used for:
[0175] Based on the calling permission information of the application system on the calling side, verify whether the application system on the calling side has the right to execute the target operation, and whether the calling parameters meet the predefined security standards.
[0176] As an optional implementation, the permission verification module 601 is further used for:
[0177] If the permission verification result is abnormal, the current permission verification will be terminated immediately, and the abnormal data will be sent to the application system on the calling side.
[0178] Based on the same inventive concept, this disclosure provides a computer storage medium comprising: computer program code, which, when executed on a computer, causes the computer to perform any of the permission management methods discussed above. Since the principle by which the computer storage medium solves the problem is similar to that of the permission management method, the implementation of the computer storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.
[0179] In specific implementation, computer storage media can include: Universal Serial Bus Flash Drive (USB), portable hard drive, Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk or optical disk, and other storage media that can store program code.
[0180] Based on the same inventive concept, this disclosure also provides a computer program product, which includes computer program code that, when executed on a computer, causes the computer to perform any of the permission management methods discussed above. Since the principle by which the above-described computer program product solves the problem is similar to that of the permission management method, the implementation of the above-described computer program product can be referred to the implementation of the method, and repeated details will not be elaborated further.
[0181] Computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0182] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.
[0183] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 Devices that specify the functions in one or more boxes.
[0184] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction device, which is implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0185] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0186] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A rights management method, characterized by, The method comprises: obtaining the calling permission information of each application system; in response to the application system on the calling side initiating a calling request, performing permission verification on the application system on the calling side according to the calling permission information of the application system on the calling side; determining whether to allow the application system on the calling side to perform an operation related to the current calling according to the permission verification result.
2. The method of claim 1, wherein, The calling permission information comprises a calling rule; before obtaining the calling permission information of each application system, the method further comprises: displaying a permission configuration interface; in response to a drag operation of a user on the permission configuration interface, configuring the calling rule of each application system, and storing the configured calling rule.
3. The method of claim 1, wherein, The method further comprises: in response to an update instruction of a business requirement of an application system, updating the calling permission information of the application system according to the updated business requirement; and / or in response to a user's update operation on the calling permission information of an application system, updating the calling permission information of the application system.
4. The method of claim 1, wherein, The method further comprises: in response to a start instruction of an application system, sending the calling permission information of the application system to the application system.
5. The method of claim 1, wherein, According to the calling permission information of the application system on the calling side, the permission verification on the application system on the calling side comprises: according to the calling permission information of the application system on the calling side, verifying whether the application system on the calling side has the right to perform a target operation and whether the calling parameter meets a predefined security standard.
6. The method of claim 1, wherein, The method further comprises: if the permission verification result is abnormal, immediately terminating the current permission verification and sending abnormal data to the application system on the calling side.
7. A rights management system, characterized by The method further comprises: the permission management platform is used for obtaining the calling permission information of each application system; the application system on the calling side initiates a calling request; the permission management platform is used for performing permission verification on the application system on the calling side according to the calling permission information of the application system on the calling side, and determining whether to allow the application system on the calling side to perform an operation related to the current calling according to the permission verification result.
8. The system of claim 7, wherein, The application system integrates the software development kit of the permission management platform; when the application system is started, the software development kit of the permission management platform is used to obtain the latest calling permission information of the application system from the permission management platform.
9. An electronic device, comprising: The electronic device comprises a processor and a memory, the memory is used to store a program executable by the processor, and the processor is used to read the program in the memory and perform the steps of the method of any one of claims 1-6.
10. A computer storage medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the steps of the method of any one of claims 1-6.