Data resource permission management method and system, authentication method and change method

Abstract

The application provides a data resource permission management method and system, an authentication method and a change method. The management method comprises the following steps: after receiving a permission application of a data resource, searching for a data resource ID and a data resource type ID corresponding to the data resource in a permission system, determining whether a permission subject corresponding to the permission application exists and whether the data resource type is registered in the permission system; determining corresponding data resource operation attributes, data resource operation rules and authorization decision rules according to the data resource ID and the data resource type ID; judging whether there is an authorization record belonging to the permission application, and performing permission examination on the permission application according to a judgment result and the data resource operation rules; and granting corresponding permissions to the permission subject according to the authorization decision rules. The application improves the security in the data resource permission management process.

Description

Technical Field

[0001] This application belongs to the field of data management technology, and relates to a data resource access control method, and in particular to a data resource access control method, system, authentication method and modification method. Background Technology

[0002] Data access control is a core component of access control. Its core principle is to ensure that, while guaranteeing data security, users can only access the minimum set of data necessary to complete their work. Data resource access control management consists of two parts: data authorization (including user-initiated permission requests and passively granted permissions) and data authentication. The subjects of permissions include, but are not limited to, users who have obtained permissions directly or indirectly through accounts, organizations, or positions. The objects of permissions are the data resource entities for which data operation permissions have been granted.

[0003] Data authorization refers to further constraints on the specific data scope that a user can manipulate, based on the user's existing permissions for a certain function (such as access to pages, buttons, etc.).

[0004] Discretionary Access Control (DAC) is a widely adopted method for managing data resource permissions due to its high flexibility, ease of understanding and use, and fine-grained management. However, this method has problems such as permission transfer and permission spread (or permission bloat), which leads to weakened security, easy loss of permission control, and high pressure on the authentication process calculation system, thus limiting the scope of application of the DAC method. Summary of the Invention

[0005] The purpose of this application is to provide a data resource access control method, system, authentication method, and modification method to solve the problem of reduced security caused by access control transfer and propagation in the prior art.

[0006] Firstly, this application provides a data resource access control method, the method comprising:

[0007] After receiving a permission request for a data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system. The data resource type ID is obtained by registering the data resource in the permission system.

[0008] Determine whether the permission subject corresponding to the permission request exists, and whether the data resource type has been registered in the permission system;

[0009] After confirming that the permission subject exists and that the data resource type has completed registration, the corresponding data resource operation rules and authorization decision rules are determined based on the data resource ID, the data resource type ID, and the data resource operation ID.

[0010] After determining that the permission application meets the preset requirements based on the data resource operation attributes, it is determined whether there is an authorization record belonging to the same category as the permission application, and the permission application is approved based on the determination result and the data resource operation rules.

[0011] After the permission approval is completed, the corresponding permissions are granted to the permission subject according to the authorization decision rules.

[0012] In one embodiment of the first aspect, determining whether there is an authorization record belonging to the same category as the permission request, and approving the permission request based on the determination result and the data resource operation rules, includes:

[0013] Obtain the operation permission and validity period information of the permission request, and determine whether there is a first authorization record in the permission system that is identical to the operation permission and the validity period information;

[0014] After determining that the first authorization record does not exist, it is determined whether a second authorization record exists in the permission system that has the same operation permission but different validity period information;

[0015] After determining that the second authorization record does not exist, the permission application is subject to permission approval and management in accordance with the data resource operation rules.

[0016] In one embodiment of the first aspect, the step of managing the permission application according to the data resource operation rules includes:

[0017] Obtain the operation request priority in the permission request and the built-in operation priority corresponding to the data resource, and determine whether the operation request priority is greater than the built-in operation priority;

[0018] When it is determined that the priority of the operation request is greater than or equal to the built-in operation priority, a permission upgrade request is made in the permission system.

[0019] When the priority of the operation request is determined to be lower than the priority of the built-in operation, the permission system issues a permission downgrade prompt and issues a permission downgrade request after the user confirms.

[0020] In one embodiment of the first aspect, the built-in operation priorities, in descending order, include all Owners, ReadWrite, Readonly, and Guest.

[0021] In one embodiment of the first aspect, the step of managing the permission application according to the data resource operation rules further includes:

[0022] When it is determined that there exists a first authorization record that is identical to the operation permission and the validity period information of the permission request, the interface idempotency processing is directly executed.

[0023] After determining that there exists a second authorization record that has the same operation permission as the permission request but different validity period information, the validity period of the second authorization record is changed to the validity period corresponding to the permission request, and the permission approval is completed.

[0024] In one embodiment of the first aspect, granting the corresponding permissions to the permission subject according to the authorization decision rule includes:

[0025] Read the authorization decision rules corresponding to the data resources corresponding to the permission request;

[0026] The permission request is sent to each resource owner of the data resource for individual approval and the corresponding individual approval result is obtained;

[0027] Based on the data resource operation authorization decision rules, all individual approval results are processed to obtain the final decision result;

[0028] Based on the decision result, the permission request is granted, and the result of the permission granting process is logged.

[0029] In one embodiment of the first aspect, the authorization decision rules include approval by any one owner, approval by more than half of the owners, and approval by all owners.

[0030] Secondly, the present invention also provides a data access authorization method, applied to the above-mentioned data resource access control method, wherein the authorization method includes:

[0031] When the authorized subject performs data resource operations, obtain the data resource ID and data resource type ID of the data resource operation, and check the current login account status of the authorized subject;

[0032] After confirming that the current login account is in a normal state, the scope of the permission subject is obtained, which includes the login account, the organization to which the account belongs, the parent organization and institution of the organization to which the account belongs;

[0033] Based on the subject scope, the data resource ID, and the data resource type ID, match the corresponding historical authorization records in the permission system;

[0034] After successfully matching the required historical authorization record, the data resource operation with the permission subject is returned based on the historical authorization record; otherwise, the operation permission for the data resource operation is not returned.

[0035] In one embodiment of the second aspect, when there are multiple historical authorization records, each historical authorization record is prioritized and the historical authorization record with the highest priority is retained.

[0036] Thirdly, the present invention also provides a data permission modification method, applied to the above-mentioned data resource permission management method, wherein the modification method includes:

[0037] Monitor permission change events in real time within the permission system;

[0038] When it is determined that the permission change event exists, the event type of the permission change event and the corresponding permission subject are obtained;

[0039] Based on the event type, change the data permissions of the permission subject.

[0040] In one embodiment of the third aspect, changing the data permissions of the permission subject according to the event type includes:

[0041] When the event type of the permission change event is employee departure, determine whether the employee to be departing has a target data resource as the sole valid owner;

[0042] If the target data resource exists, a high-level alarm will be automatically triggered, and the supervisor of the employee to be leaving will be set as the owner of the target data resource.

[0043] The alarm will stop after the superior authority designates a new owner for the target data resource.

[0044] In one embodiment of the third aspect, the step of changing the data permissions of the permission subject according to the event type further includes:

[0045] When the event type is job transfer, the account data permissions of the authorized subject are retained, the data permissions granted to the authorized subject by the original organization and original position are deleted, and the data permissions obtained by the authorized subject in the new organization and new position are granted.

[0046] When the event type is onboarding, automatically grant the data permissions to the subject with the required permissions based on their organization and position.

[0047] When the event type is departmental adjustment, the permission subject automatically inherits all data permissions granted to its organization, which includes at least one of institutions, administrative groups, and virtual groups.

[0048] Fourthly, the present invention also discloses a data resource access control system, the system comprising:

[0049] The information search module is used to, after receiving a permission request for a data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system. The data resource type ID is obtained by registering the data resource in the permission system.

[0050] The confirmation module is used to determine whether the permission subject corresponding to the permission request exists, and whether the data resource type has been registered in the permission system.

[0051] The information acquisition module is used to determine the corresponding data resource operation rules and authorization decision rules based on the data resource ID, the data resource type ID and the data resource operation ID after confirming that the permission subject exists and the data resource type has completed registration;

[0052] The approval module is used to determine whether there is an authorization record belonging to the same category as the permission application after determining that the permission application meets the preset requirements based on the data resource operation attributes, and to approve the permission application based on the judgment result and the data resource operation rules.

[0053] The decision-making module is used to grant the corresponding permissions to the permission subject according to the authorization decision rules after the permission approval is completed.

[0054] Fifthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the above-described data resource access control method, the above-described data access authentication method, or the above-described data access modification method.

[0055] As described above, the data resource access control method, system, authentication method, and modification method described in this application have the following beneficial effects:

[0056] This invention configures corresponding data resource type IDs for data resources. When a user requests permissions, the corresponding data resource operation attributes, data resource operation rules, and authorization decision rules are determined based on the data resource ID and data resource type ID of the permission request. This facilitates subsequent permission approval based on the data resource operation rules and authorization based on the authorization decision rules. Since the data resource operation rules have multiple different priorities, duplicate authorizations can be avoided during specific authorizations, reducing permission spread. Furthermore, authorization can be achieved by modifying authorization records, greatly reducing the computational burden during authorization. At the same time, the authorization decision rules enable authorization processing for different situations of permission requests, exhibiting good dynamic adaptability and providing dynamic and adaptive security barriers for operations of varying sensitivities, further improving the security of permission management. Attached Figure Description

[0057] Figure 1 The flowchart shown is a data resource access control method described in an embodiment of this application.

[0058] Figure 2 This diagram illustrates the specific execution process of the data resource access control method described in this application embodiment.

[0059] Figure 3 This diagram illustrates the specific execution process of the data permission authentication method described in this application embodiment.

[0060] Figure 4 The diagram shown is a structural block diagram of the data resource access control system described in an embodiment of this application. Detailed Implementation

[0061] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0062] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0063] See Figures 1 to 4 The following embodiments of this application provide a data resource permission management method, system, authentication method, and modification method. This invention configures corresponding data resource type IDs for data resources. When a user requests permissions, the corresponding data resource operation attributes, data resource operation rules, and authorization decision rules are determined based on the data resource ID and data resource type ID of the permission request. This facilitates subsequent permission approval based on the data resource operation rules and authorization based on the authorization decision rules. Furthermore, since data resource operation rules have multiple different priorities, duplicate authorizations can be avoided during specific authorization processes, reducing permission spread. Authorization can also be achieved by modifying authorization records, greatly reducing the computational burden during authorization. Simultaneously, the authorization decision rules enable different authorization processing for permission requests, exhibiting good dynamic adaptability and providing dynamic and adaptive security barriers for operations of varying sensitivities, further improving the security of permission management.

[0064] The technical solutions in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0065] like Figure 1 As shown in the figure, this embodiment provides a data resource access control method, which includes the following steps:

[0066] S100. After receiving the permission request for the data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system. The data resource type ID is obtained by registering the data resource in the permission system.

[0067] In this embodiment, the permission application for the data resource includes user-initiated permission application and data resource owner-initiated permission grant to user. When the system receives the permission application for the corresponding data resource, it first searches for the data resource ID and data resource type ID corresponding to the data resource in the permission system to facilitate subsequent permission management operations for the data resource.

[0068] Each of the data resources is registered in the permission system and generates a globally unique data resource type ID. Each data resource also corresponds to at least one data resource operation ID. The data resource operation ID corresponds to the data resource operation attribute of the registered data resource, which facilitates the recording of each data resource based on the data resource ID and data resource type ID.

[0069] It should be noted that the naming of the data resource type ID is determined according to the core business meaning corresponding to the data resource. For example, if the data resource corresponds to the sales order amount, then the data resource type ID is determined to be the sales order amount.

[0070] Furthermore, to address scenarios where complex business entities may possess multiple attributes and be subject to multiple sets of permission rules, since data resources registered on the permission system may have more than one data resource type, meaning a single data resource can be defined and managed by multiple data resource types simultaneously, the same data resource can be subject to permission operations based on different data resource type IDs, and remains completely independent due to its affiliation to different data resource types, maintaining excellent scalability.

[0071] S200. Determine whether the permission subject corresponding to the permission application exists, and whether the data resource type has been registered in the permission system.

[0072] refer to Figure 2 After the permission system accepts the permission request, it first checks whether the authorization subject corresponding to the current permission request exists and whether the data resource type ID has been registered in the permission system. This ensures that the subsequent permission management process can proceed normally and avoids the problem of authorization failure due to the data resource type ID not being registered or the permission subject corresponding to the permission request not existing.

[0073] S300. After confirming that the permission subject exists and the data resource type has completed registration, determine the corresponding data resource operation rules and authorization decision rules based on the data resource ID, the data resource type ID and the data resource operation ID.

[0074] In this embodiment, after a data resource is registered in the permission system, the permission system will configure corresponding data resource operation attributes, data resource operation rules, and authorization decision rules for each data resource. These information correspond one-to-one with the data resource and are stored in the permission system so that permission can be configured according to the data resource operation attributes in the future.

[0075] The data resource operation attributes include basic identification attributes, user experience attributes, security policy attributes, and process control attributes. The basic identification attributes include:

[0076] Operation code and name: A globally unique operation identifier (such as ReadOnly) and its standard name (such as "read-only"), used for precise identification and processing of permission logic within the system.

[0077] Operation Aliases: To address the inconsistency between built-in operation terminology and business system terminology, this solution supports setting aliases for operations (e.g., displaying the built-in ReadOnly as "Browse" or "View" on the interface). This design effectively bridges the semantic gap between systems, enhancing user readability and experience.

[0078] Enable or disable: Boolean flag used to configure whether built-in system operations are effective under the current data resource type.

[0079] User experience optimization attributes include:

[0080] Operation Instructions: A textual description of the specific function of this operation in the business system. It is used as a prompt when a user applies for permission or when the resource owner grants permission, to help the user understand the operation.

[0081] Default Recommendation: A boolean flag indicating whether to select this option by default when a user requests permissions or the resource owner grants them. This design simplifies the user's operation steps in authorization scenarios.

[0082] Default validity period: The default validity period when granting permissions, which must be less than the maximum validity period. This is used to automatically fill in permissions when a user requests them or when a resource owner grants them, reducing user input and aligning with usage habits in most scenarios.

[0083] Security policy attributes include:

[0084] Maximum validity period: The maximum authorization period stipulated by the system. Based on the principle of data value decay, the system restricts the maximum validity period to no more than 180 days. This rule provides differentiated security policy configuration capabilities for different data resource operations, while providing a global safety net at the system level, fundamentally solving the security risks caused by permanent permissions.

[0085] Process control attributes include:

[0086] Allow Request: A Boolean flag that determines whether the user is allowed to request permission. It can be used to restrict request channels for high-risk permissions such as "owner" or "administrator".

[0087] Grant Permission: A Boolean flag that determines whether the data resource owner is allowed to grant permissions to other users. It can be used to restrict certain operations that can only be authorized by users themselves.

[0088] S400. After determining that the permission application meets the preset requirements based on the data resource operation attributes, determine whether there is an authorization record belonging to the same category as the permission application, and approve the permission application based on the determination result and the data resource operation rules.

[0089] In this embodiment, after determining that the permission application complies with the validity period rule based on the data resource operation attribute, that is, the validity period of the permission application is within the maximum validity period of the data resource operation attribute, it is further determined whether there is an authorization record in the past that is the same as the current permission application, and then the permission application is approved based on the judgment result and the data resource operation rule.

[0090] In some other embodiments, determining whether there is an authorization record belonging to the same category as the permission request, and approving the permission request based on the determination result and the data resource operation rules, includes:

[0091] Obtain the operation permission and validity period information of the permission request, and determine whether there is a first authorization record in the permission system that is identical to the operation permission and the validity period information;

[0092] After determining that the first authorization record does not exist, it is determined whether a second authorization record exists in the permission system that has the same operation permission but different validity period information;

[0093] After determining that the second authorization record does not exist, the permission application is subject to permission approval and management in accordance with the data resource operation rules.

[0094] In this embodiment, to determine whether a record with the same authorization as the current permission request exists in the past authorization records, the operation permissions and validity period information of the current permission request are first obtained. The operation information refers to the operation performed on the requested data resource. Then, it is determined whether a first authorization record with the same operation permissions and validity period information as the current permission request exists in the permission system. If it exists, it can be directly configured, thus simplifying the authorization process. If it does not exist, it is further determined whether a second authorization record with the same operation permissions but a different validity period exists. If it exists, only the validity period in the authorization record needs to be changed to the validity period of the current permission request, further simplifying the authorization process. If the second authorization record also does not exist, that is, if no record with the same operation permissions or validity period information as the current permission request exists in the past authorization records, then permission approval management is required for the current permission request.

[0095] During the approval process for permission requests, the system searches the authorization records for authorization records to determine if there are any authorization records with the same permission operations or validity periods as the permission requests. This facilitates subsequent permission configuration based on the authorization records and effectively reduces the computational burden of real-time authentication.

[0096] Furthermore, the authorization records mentioned in this application are not exactly the same authorization records. The authorizing entities may be different. For example, the authorization record may be authorized to an organization, but the permission application may be made by the corresponding user account. Such records should also be regarded as "the same authorization records". This solution does not make any special restrictions on this, and will not be elaborated here.

[0097] In other embodiments, the step of managing the permission application according to the data resource operation rules includes:

[0098] Obtain the operation request priority in the permission request and the built-in operation priority corresponding to the data resource, and determine whether the operation request priority is greater than the built-in operation priority;

[0099] When it is determined that the priority of the operation request is greater than or equal to the built-in operation priority, a permission upgrade request is made in the permission system.

[0100] When the priority of the operation request is determined to be lower than the priority of the built-in operation, the permission system issues a permission downgrade prompt and issues a permission downgrade request after the user confirms.

[0101] In this embodiment, when permission approval management is required for permission requests based on resource operation rules, the first step is to obtain the operation request priority of the current permission request and the built-in operation priority corresponding to the data resource, and then determine whether the operation request priority is greater than the built-in operation priority. The operation request priority refers to the priority of the operation permission requested in the current permission request. When it is determined that the current operation request priority is greater than or equal to the built-in operation priority, it is determined that the current permission request is requesting a permission upgrade, and the permission upgrade request is directly submitted in the permission system. Conversely, if the operation request priority is less than the built-in operation priority, it is determined that the current permission request is requesting a permission downgrade, and the permission system sends a permission downgrade prompt to the applicant. After the user confirms, a permission downgrade request is issued to facilitate subsequent permission granting based on the authorization decision rules.

[0102] In the authorization process, the permission system prioritizes and applies priority rules. If a user already has low-level operation permissions and requests a higher-level operation, the system will perform a permission upgrade; if a user already has high-level operation permissions and requests a low-level operation, the system will send a downgrade confirmation to the user. Depending on the user's choice, the system determines whether to downgrade the permission or terminate the authorization process. Based on operation priority and operation coverage rules, this not only simplifies the authorization and authentication processes but also brings significant performance and maintenance advantages.

[0103] The built-in operation priorities, in descending order, include all Owners, ReadWrite, Readonly, and Guest. High-priority operations by default include all permissions of low-priority operations, thereby avoiding duplicate authorization of the same data resource, greatly simplifying the authorization process, and reducing the problem of permission spread.

[0104] Furthermore, the data resource operation rules also include custom operations, which support the creation of personalized operations without priority for data resource types to meet the refined management needs of specific business systems (such as scenarios where "editing basic information" and "editing extended information" require separate permission management).

[0105] Furthermore, the step of managing the permission application based on the data resource operation rules also includes:

[0106] When it is determined that there exists a first authorization record that is identical to the operation permission and the validity period information of the permission request, the interface idempotency processing is directly executed.

[0107] After determining that there exists a second authorization record that has the same operation permission as the permission request but different validity period information, the validity period of the second authorization record is changed to the validity period corresponding to the permission request, and the permission approval is completed.

[0108] In this embodiment, when there is a first authorization record with the same operation permission and validity period information in the permission request, the interface idempotency processing is directly executed to complete the permission request, and subsequent authorization decisions can be made directly. When there is a second authorization record with the same operation permission but a different validity period in the permission request, the validity period of the second authorization record is directly changed to the validity period of the permission request, thereby completing the permission approval process, and subsequent authorization decisions can be made directly. This facilitates rapid approval of permission requests based on authorization records and improves the efficiency of permission approval.

[0109] S500. After the permission approval is completed, the corresponding permission is granted to the permission application according to the authorization decision rules.

[0110] In some embodiments, granting the corresponding permissions to the permission subject according to the authorization decision rule includes:

[0111] Read the authorization decision rules corresponding to the data resources corresponding to the permission request;

[0112] The permission request is sent to each resource owner of the data resource for individual approval and the corresponding individual approval result is obtained;

[0113] Based on the data resource operation authorization decision rules, all individual approval results are processed to obtain the final decision result;

[0114] Based on the decision result, the permission subject is granted permissions, and the result of the permission granting process is logged.

[0115] In this embodiment, when the permission approval is completed, the corresponding permission needs to be granted to the permission application according to the authorization decision rules. Specifically, after the permission application is approved, the resource owner of each data resource is determined in the permission system, and the permission application is sent to each resource owner for individual approval, thereby obtaining the individual approval result of each resource owner. Then, the permission system performs decision processing based on all individual approval results according to the authorization decision rules corresponding to the data resource, thereby obtaining the final decision result. Then, based on the decision result, it decides whether to grant the permission to the permission application, and records the final permission granting result in the log.

[0116] The authorization decision rules include approval by any one owner, approval by more than half of the owners, and approval by all owners. Approval by any one owner means that the decision is effective upon the approval of any resource owner. This rule is applicable to operations with high efficiency requirements and low risk.

[0117] The rule that requires approval from more than half of the owners to take effect strikes a balance between efficiency and security and is applicable to most routine sensitive operations.

[0118] The rule that all owners must unanimously approve a rule to take effect is applicable to highly sensitive operations and can limit the transfer of permissions to the greatest extent.

[0119] Specifically, this decision-making mechanism is implemented using the strategy pattern. Each decision rule is encapsulated as an independent strategy algorithm class, interacting with the authorization process of the permission system through a unified interface, thus decoupling the authorization process from the specific decision logic. Furthermore, based on specific security needs, the core authorization process can be easily extended by implementing new strategy classes (such as "designated owner veto") without modifying the core authorization process. By seamlessly integrating this decision rule into the authorization process of the permission system, when a user requests permission or a resource owner grants permission, the system sends approval notifications to all currently valid owners based on the authorization rules configured for the target data resource operation. After each owner independently approves the request, the permission system evaluates the individual approval results. If the preset authorization rules are met, the permission is automatically granted. Otherwise, the authorization process will be suspended until timeout or the rules are met. By solidifying the authorization decision rules into the permission system, the authorization decision rules maintain good dynamic adaptability; different operations can be configured with different decision rules, providing a dynamic and adaptive security barrier for operations of varying sensitivities. By introducing a multi-owner consensus mechanism, improper granting of permissions due to individual owner decision-making errors is avoided, effectively curbing the transfer of permissions.

[0120] The scope of protection of the data resource permission management method based on data resource operation described in this application is not limited to the execution order of the steps listed in this embodiment. Any solution implemented by adding, deleting, or replacing steps in the prior art based on the principles of this application is included within the scope of protection of this application.

[0121] This invention also discloses a data access authorization method, applied to the aforementioned data resource access control method, characterized in that, with reference to Figure 3 The authentication method includes:

[0122] When the authorized subject performs data resource operations, obtain the data resource ID and data resource type ID of the data resource operation, and check the current login account status of the authorized subject;

[0123] After confirming that the current login account is in a normal state, the scope of the permission subject is obtained, which includes the login account, the organization to which the account belongs, the parent organization and institution of the organization to which the account belongs;

[0124] Based on the subject scope, the data resource ID, and the data resource type ID, match the corresponding historical authorization records in the permission system;

[0125] After successfully matching the required historical authorization record, the data resource operation with the permission subject is returned based on the historical authorization record; otherwise, the operation permission for the data resource operation is not returned.

[0126] In this embodiment, when data resource permission authentication is required, when the authorized subject needs to operate on the data resource, the data resource ID and data resource type ID of the data resource operation are first obtained, and the current login account status of the authorized subject is checked to determine whether the current login account status of the authorized subject is abnormal. After determining that the current login account status is normal, the subject scope of the authorized subject is obtained. Subsequently, based on the subject scope, the data resource ID, and the data resource type ID, the corresponding historical authorization record is matched in the permission system. When a historical authorization record is successfully matched, the data resource operation with operation permission for the authorized subject is returned according to the historical authorization record; otherwise, the operation permission for the data resource operation is not returned.

[0127] The aforementioned authentication method, based on the aforementioned data resource access control method, effectively solves the core problems of uncontrolled access control and access extension in the traditional DAC model. Its technical solution boasts significant advantages such as high security, superior performance, ease of integration, and a high degree of automation.

[0128] Furthermore, when there are multiple historical authorization records, each historical authorization record is sorted by priority, and the historical authorization record with the highest priority is retained.

[0129] This invention further discloses a data permission modification method, applied to the above-mentioned data resource permission management method, wherein the modification method includes:

[0130] Monitor permission change events in real time within the permission system;

[0131] When it is determined that the permission change event exists, the event type of the permission change event and the corresponding permission subject are obtained;

[0132] Based on the event type, change the data permissions of the permission subject.

[0133] After authorizing the subject of the data resource permission management method described above, the permission is changed through the data permission change method in this embodiment. During the permission change process, the rules in the aforementioned data resource permission management method are used to achieve effective management of data resource permission changes, thereby effectively solving the problems of uncontrolled permission transfer and permission spread in the traditional DAC model.

[0134] In some embodiments, changing the data permissions of the permission subject according to the event type includes:

[0135] When the event type of the permission change event is employee departure, determine whether the employee to be departing has a target data resource as the sole valid owner;

[0136] If the target data resource exists, a high-level alarm will be automatically triggered, and the supervisor of the employee to be leaving will be set as the owner of the target data resource.

[0137] The alarm will stop after the superior authority designates a new owner for the target data resource.

[0138] In this embodiment, when a departing employee is the sole owner of a target data resource in the permission system, to prevent the sole owner of the target data resource from becoming invalid, a high-level alarm is automatically triggered once it is detected that the departing employee is the sole valid owner of the target data resource. The departing employee's supervisor is then set as the owner of the target data resource, thus preventing the issue of the target data resource owner becoming invalid after the departing employee leaves. Furthermore, the alarm stops after the supervisor assigns a new owner to the target data resource, effectively avoiding the "permission silo" or "dead file" problem caused by the departure of the sole owner. This ensures that all data resources remain under control and do not affect the normal permission applications and approvals of other users.

[0139] In some other embodiments, the step of changing the data permissions of the permission subject according to the event type further includes:

[0140] When the event type is job transfer, the account data permissions of the authorized subject are retained, the data permissions granted to the authorized subject by the original organization and original position are deleted, and the data permissions obtained by the authorized subject in the new organization and new position are granted.

[0141] When the event type is onboarding, automatically grant the data permissions to the subject with the required permissions based on their organization and position.

[0142] When the event type is departmental adjustment, the permission subject automatically inherits all data permissions granted to its organization, which includes at least one of institutions, administrative groups, and virtual groups.

[0143] In this embodiment, the data resource permissions of the permission subject have an automatic inheritance mechanism when changing positions, joining a company, or adjusting departments. That is, when a user joins a company, changes positions, or changes departments, the user automatically inherits all the data permissions granted to their organization (institution, administrative group, virtual group, etc.) without having to reapply for numerous data permissions after the change. This process does not require the involvement of any business system, realizing silent updates of user permissions and ensuring that the user has all the necessary data access permissions to carry out their work as soon as they join the company, which greatly improves efficiency and reduces IT support costs.

[0144] This invention discloses a data resource access control system, with reference to... Figure 4The system includes:

[0145] The information search module 401 is used to, after receiving a permission request for a data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system, wherein the data resource type ID is obtained by registering the data resource in the permission system;

[0146] The confirmation module 402 is used to determine whether the permission subject corresponding to the permission application exists and whether the data resource type has been registered in the permission system.

[0147] The information acquisition module 403 is used to determine the corresponding data resource operation rules and authorization decision rules based on the data resource ID, the data resource type ID and the data resource operation ID after determining that the permission subject exists and the data resource type has completed registration;

[0148] The approval module 404 is used to determine whether there is an authorization record belonging to the same category as the permission application after determining that the permission application meets the preset requirements based on the data resource operation attributes, and to approve the permission application based on the judgment result and the data resource operation rules.

[0149] The decision module 405 is used to grant the corresponding permissions to the permission subject according to the authorization decision rules after the permission approval is completed.

[0150] Each of the above modules corresponds one-to-one with the steps of the aforementioned method. The specific working principle can also be found in the description of the data resource permission management method in the previous embodiments, so it will not be repeated here.

[0151] It should be noted that the data resource access control system can implement the data resource access control method described in this application. However, the implementation device of the data resource access control method described in this application includes, but is not limited to, the structure of the data resource access control system listed in this embodiment. All structural modifications and substitutions of the prior art made based on the principles of this application are included within the protection scope of this application.

[0152] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the above-described data resource permission management method, data permission authentication method, or data permission modification method based on data resource operations.

[0153] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing a processor. The program can be stored in a computer-readable storage medium, which is a non-transitory medium, such as random access memory, read-only memory, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof. The storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. This available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., solid-state drive (SSD)).

[0154] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, or methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules / units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or units may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of apparatuses or modules or units may be electrical, mechanical, or other forms.

[0155] The modules / units described as separate components may or may not be physically separate. The components shown as modules / units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules / units can be selected to achieve the objectives of the embodiments of this application, depending on actual needs. For example, the functional modules / units in the various embodiments of this application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0156] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0157] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0158] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A data resource access control method, characterized in that, The method includes: After receiving a permission request for a data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system. The data resource type ID is obtained by registering the data resource in the permission system. Determine whether the permission subject corresponding to the permission request exists, and whether the data resource type has been registered in the permission system; After confirming that the permission subject exists and that the data resource type has completed registration, the corresponding data resource operation rules and authorization decision rules are determined based on the data resource ID, the data resource type ID, and the data resource operation ID. After determining that the permission application meets the preset requirements based on the data resource operation attributes, it is determined whether there is an authorization record belonging to the same category as the permission application, and the permission application is approved based on the determination result and the data resource operation rules. After the permission approval is completed, the corresponding permissions are granted to the permission subject according to the authorization decision rules; The determination of whether there is an authorization record belonging to the same category as the permission request, and the permission approval of the permission request based on the determination result and the data resource operation rules, includes: Obtain the operation permission and validity period information of the permission request, and determine whether there is a first authorization record in the permission system that is identical to the operation permission and the validity period information; After determining that the first authorization record does not exist, it is determined whether a second authorization record exists in the permission system that has the same operation permission but different validity period information; After determining that the second authorization record does not exist, the permission application is subject to permission approval and management according to the data resource operation rules; The step of managing the permission application according to the data resource operation rules includes: Obtain the operation request priority in the permission request and the built-in operation priority corresponding to the data resource, and determine whether the operation request priority is greater than the built-in operation priority; When it is determined that the priority of the operation request is greater than or equal to the built-in operation priority, a permission upgrade request is made in the permission system. When the priority of the operation request is determined to be lower than the priority of the built-in operation, the permission system issues a permission downgrade prompt and issues a permission downgrade request after the user confirms.

2. The data resource access control method according to claim 1, characterized in that, The built-in operation priorities, in descending order, include all Owners, ReadWrite, Readonly, and Guest.

3. The data resource access control method according to claim 1, characterized in that, The step of managing the permission application according to the data resource operation rules further includes: When it is determined that there exists a first authorization record that is identical to the operation permission and the validity period information of the permission request, the interface idempotency processing is directly executed. After determining that there exists a second authorization record that has the same operation permission as the permission request but different validity period information, the validity period of the second authorization record is changed to the validity period corresponding to the permission request, and the permission approval is completed.

4. The data resource access control method according to claim 1, characterized in that, Granting corresponding permissions to the authorized subject according to the authorization decision rules includes: Read the authorization decision rules corresponding to the data resources corresponding to the permission request; The permission request is sent to each resource owner of the data resource for individual approval and the corresponding individual approval result is obtained; Based on the data resource operation authorization decision rules, all individual approval results are processed to obtain the final decision result; Based on the decision result, the permission subject is granted permissions, and the result of the permission granting process is logged.

5. The data resource access control method according to claim 4, characterized in that, The authorization decision rules include approval by any one owner, approval by more than half of the owners, and approval by all owners.

6. A data access authorization method, applied to the data resource access control method according to any one of claims 1 to 5, characterized in that, The authentication method includes: When the authorized subject performs data resource operations, obtain the data resource ID and data resource type ID of the data resource operation, and check the current login account status of the authorized subject; After confirming that the current login account is in a normal state, the scope of the permission subject is obtained, which includes the login account, the organization to which the account belongs, the parent organization and institution of the organization to which the account belongs; Based on the subject scope, the data resource ID, and the data resource type ID, match the corresponding historical authorization records in the permission system; After successfully matching the required historical authorization record, the data resource operation with the permission subject is returned based on the historical authorization record; otherwise, the operation permission for the data resource operation is not returned.

7. The data access authorization method according to claim 6, characterized in that, When there are multiple historical authorization records, each historical authorization record is sorted by priority, and the historical authorization record with the highest priority is retained.

8. A method for changing data permissions, characterized in that, The data resource access control method applied to any one of claims 1 to 5, wherein the modification method includes: Monitor permission change events in real time within the permission system; When it is determined that the permission change event exists, the event type of the permission change event and the corresponding permission subject are obtained; Based on the event type, change the data permissions of the permission subject.

9. The data permission change method according to claim 8, characterized in that, The step of changing the data permissions of the permission subject according to the event type includes: When the event type of the permission change event is employee departure, determine whether the employee to be departing has a target data resource as the sole valid owner; If the target data resource exists, a high-level alarm will be automatically triggered, and the supervisor of the employee to be leaving will be set as the owner of the target data resource. The alarm will stop after the superior authority designates a new owner for the target data resource.

10. The data permission change method according to claim 8, characterized in that, The step of changing the data permissions of the permission subject according to the event type also includes: When the event type is job transfer, the account data permissions of the authorized subject are retained, the data permissions granted to the authorized subject by the original organization and original position are deleted, and the data permissions obtained by the authorized subject in the new organization and new position are granted. When the event type is onboarding, automatically grant the data permissions of the authorized subject to their organization and position. When the event type is departmental adjustment, the permission subject automatically inherits all data permissions granted to its organization, which includes at least one of institutions, administrative groups, and virtual groups.

11. A data resource access control system, characterized in that, The system includes: The information search module is used to, after receiving a permission request for a data resource, obtain the data resource operation ID corresponding to the data resource in the permission request, obtain the data resource operation attribute corresponding to the data resource based on the data resource operation ID, and search for the data resource ID and data resource type ID corresponding to the data resource in the permission system. The data resource type ID is obtained by registering the data resource in the permission system. The confirmation module is used to determine whether the permission subject corresponding to the permission request exists, and whether the data resource type has been registered in the permission system. The information acquisition module is used to determine the corresponding data resource operation rules and authorization decision rules based on the data resource ID, the data resource type ID and the data resource operation ID after confirming that the permission subject exists and the data resource type has completed registration; The approval module is used to determine whether there is an authorization record belonging to the same category as the permission application after determining that the permission application meets the preset requirements based on the data resource operation attributes, and to approve the permission application based on the judgment result and the data resource operation rules. The decision-making module is used to grant corresponding permissions to the permission subject according to the authorization decision rules after the permission approval is completed. The determination of whether there is an authorization record belonging to the same category as the permission request, and the permission approval of the permission request based on the determination result and the data resource operation rules, includes: Obtain the operation permission and validity period information of the permission request, and determine whether there is a first authorization record in the permission system that is identical to the operation permission and the validity period information; After determining that the first authorization record does not exist, it is determined whether a second authorization record exists in the permission system that has the same operation permission but different validity period information; After determining that the second authorization record does not exist, the permission application is subject to permission approval and management according to the data resource operation rules; The step of managing the permission application according to the data resource operation rules includes: Obtain the operation request priority in the permission request and the built-in operation priority corresponding to the data resource, and determine whether the operation request priority is greater than the built-in operation priority; When it is determined that the priority of the operation request is greater than or equal to the built-in operation priority, a permission upgrade request is made in the permission system. When the priority of the operation request is determined to be lower than the priority of the built-in operation, the permission system issues a permission downgrade prompt and issues a permission downgrade request after the user confirms.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the data resource access control method according to any one of claims 1 to 5, the data access authentication method according to any one of claims 6 to 7, or the data access control modification method according to any one of claims 8 to 10.

Images