Authority management method and device, readable medium, electronic equipment and program product

Abstract

The invention discloses an authority management method and device, a readable medium, electronic equipment and a program product. The method comprises the following steps: receiving a first authority query request; wherein the first permission query request comprises at least one request object in a first subject, a first object and a first permission; for a request object included in the first permission query request, constructing a first permission triple set based on the relational graph; wherein the relation graph comprises at least one of a subject hierarchical relation, an object hierarchical relation and an authority hierarchical relation; querying in the permission graph based on the first permission triple set to obtain a request result corresponding to the first permission query request; wherein the permission graph comprises an atomic permission triple constructed based on permission configuration information. By querying the hierarchical relationship of the request objects at one time, all the to-be-queried request objects can be efficiently enumerated, and then all the to-be-queried permission triples can be enumerated, so that the permission query efficiency is improved.

Description

Technical Field

[0001] This disclosure relates to the field of access control, and more specifically, to an access control method, apparatus, readable medium, electronic device, and program product. Background Technology

[0002] In internet services, user access control over resources is crucial. As a core component for achieving this function, the access control system is responsible for determining whether a subject (such as a user) has the right to perform specific operations on a particular object (such as a file or service).

[0003] In related technologies, taking permission checks as an example, when querying the permissions of a subject for a certain object, the system will recursively decompose the query until an atomic and direct permission relationship is found. Recursive queries will lead to a large number of subqueries being executed concurrently, resulting in low efficiency and high latency. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] Firstly, this disclosure provides a permission management method, the permission management method comprising: Receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; For the request objects included in the first permission query request, a first permission triple set is constructed based on the relationship graph; wherein, the relationship graph includes at least one of subject-level relationship, object-level relationship and permission-level relationship; Based on the first set of permission triples, a query is performed in the permission graph to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

[0006] Secondly, this disclosure provides a permission management device, the permission management device comprising: A receiving module is configured to receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; The construction module is used to construct a first set of permission triples based on a relationship graph for the request objects included in the first permission query request; wherein the relationship graph includes at least one of subject-level relationship, object-level relationship and permission-level relationship; The query module is used to perform a query in the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

[0007] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method described in the first aspect.

[0008] Fourthly, this disclosure provides an electronic device, comprising: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method described in the first aspect.

[0009] Fifthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0010] The above technical solution decouples the subject hierarchy, object hierarchy, and permission hierarchy from the permissions of the subject, object, and the subject to the object, storing them as a relationship graph and a permission graph respectively. When a permission query request is received, a set of permission triples corresponding to the requested object in the permission query request is constructed based on the relationship graph. Then, a query is performed on the permission graph based on this set of permission triples to obtain the request result corresponding to the first permission query request. By querying the hierarchical relationship of the request object in a single step, all request objects to be queried can be efficiently enumerated, and thus all permission triples to be queried can be enumerated, improving the efficiency of subsequent permission queries. Compared to recursive queries in related technologies, this avoids initiating repeated subqueries, significantly reducing network round trips and system load. This not only improves the performance and stability of permission checks but also increases the efficiency of permission reading.

[0011] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0012] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 This is a flowchart illustrating a permission management method according to an exemplary embodiment.

[0013] Figure 2This is a schematic diagram illustrating objects and hierarchical relationships according to an exemplary embodiment.

[0014] Figure 3 This is a schematic diagram illustrating a permission check process according to another exemplary embodiment.

[0015] Figure 4 This is an interactive schematic diagram of a permission management system according to another exemplary embodiment.

[0016] Figure 5 This is a schematic diagram of the structure of a permission management device according to an exemplary embodiment.

[0017] Figure 6 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0018] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0019] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0020] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0021] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0022] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0023] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0024] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0025] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0026] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0027] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0028] Meanwhile, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0029] Access control systems typically need to handle two distinct but equally important functions: one is low-latency permission checks, such as determining in real time whether a user can access a resource, which usually requires extremely high efficiency and response speed; the other is comprehensive permission reads, used for management and auditing purposes, such as listing or enumerating all permissions held by a subject, or which subjects have permissions to an object.

[0030] In related technologies, access control systems model permissions as a relational graph. In this model, permissions are represented as a series of tuples, such as (subject, permission, object). When permission checks are required, the system resolves the query by recursively parsing this relational graph. Specifically, when querying a subject's permission for a certain object, the system recursively decomposes the query until it finds an atomic, direct permission relationship.

[0031] For example, for a query "Can user A view document B?", the system will first check if "user A" directly has viewing permissions for document B. If not, it will check if "user A" belongs to a user group. For example, if "user A" belongs to "user group 1", it will continue to query "Can user group 1 view document B?". The entire query process will recursively form a "divide and conquer" query process. This method has the following shortcomings: 1. Query Fan-out: Recursive queries can lead to the concurrent execution of a large number of subqueries. In complex permission hierarchies, such as the team and department relationships in a complex organization, a simple permission check may trigger hundreds or even thousands of subqueries, greatly increasing the load on the backend service.

[0032] 2. Tail Latency Amplification: Due to query fan-out, the response time of the entire query depends on the slowest of all subqueries, resulting in a significant amplification of the overall tail latency of the system.

[0033] 3. Low efficiency in access control: When performing large-scale access control operations, such as listing all permissions of a user, a large number of computationally complex traversal and combination operations are required, which makes access control and auditing tasks very inefficient.

[0034] In view of this, the present disclosure provides a method, apparatus, readable medium, electronic device, and program product for managing access rights, in order to solve the above-mentioned technical problems.

[0035] Figure 1 This is a flowchart illustrating a permission management method according to an exemplary embodiment. For example... Figure 1 As shown, the method may include the following steps: S101: Receive a first permission query request; wherein the first permission query request includes at least one of a first subject, a first object, and a first permission.

[0036] For example, a permission query request can be either a permission check request or a permission read request. A permission check request is used to verify whether a subject possesses a certain permission for a certain object, and is typically used for access control. A permission read request can be used to query the permissions possessed by a subject, which subjects are authorized to a certain object, etc., and is typically used for permission auditing and management. A permission query request can include one or more of the following request objects: subject, object, and permission. The subject can be a user, service, process, node, device, etc., the object can be a file, database, interface, service, device, etc., and the permission can be read, write, delete, add, use, etc., depending on the actual business scenario. This disclosure does not impose any restrictions on this.

[0037] For example, a permission check request "check if user A can view document B" includes the subject (user A), the object (document B), and the permission (viewing). A permission read request "query user A's permissions for document B" includes the subject (user A) and the object (document B). A permission read request "query what data user A can view" includes the subject (user A) and the permission (viewing). And so on. The specific details are determined according to the actual business scenario, and this disclosure does not impose any restrictions on them.

[0038] S102: For the request objects included in the first permission query request, construct a set of first permission triples based on the relationship graph; wherein, the relationship graph includes at least one of the subject hierarchy relationship, object hierarchy relationship and permission hierarchy relationship.

[0039] For example, a relationship graph can be a directed acyclic graph used to store hierarchical relationships between subjects, between objects, and between permissions.

[0040] It's important to understand that the permissions possessed by each entity can be passed on or inherited through subject hierarchy, object hierarchy, and permission hierarchy. For example, if user group 1 can view document B, and user A belongs to user group 1, then user A automatically inherits the permission to view document B. Similarly, if user A has editing permissions for document B, and editing permissions imply viewing permissions, then user A automatically has the permission to view document B. Likewise, if user A has viewing permissions for folder X, and folder X includes document B, then user A automatically has the permission to view document B.

[0041] In this embodiment, the relationship graph can store the hierarchical relationship between objects in a set manner, such as "user set of user group 1 = {user A, ...}", and these sets can be stored using an optimized data structure, such as a Roaring Bitmap, so that operations such as union and intersection of sets can be performed efficiently and memory can be saved significantly. The specific choice can be made according to the needs, and this disclosure does not limit it.

[0042] In one possible approach, for the request objects included in the first permission query request, a first permission triplet set is constructed based on the relationship graph, including: determining the set of objects that have a hierarchical relationship with the request objects based on the relationship graph; and enumerating the composable permission triplets based on the set of objects to obtain the first permission triplet set.

[0043] In a permission read request, the requested object can include one or more of the subject, object, and permission, while a permission check request must include the subject, object, and permission. The first permission triplet set is the set of all composable permission triples. If any of the subject, object, or permission is missing from the request, it can be used... The term "substitute" indicates that the item is not restricted, or "all" indicates that the item is all. Of course, other identifiers can also be used instead, and this disclosure does not restrict them.

[0044] For example, such as Figure 2 As shown, taking the query "Can User A view Document B?" as an example, assuming that the parent of "User A" is "User Group 1", and the parent of "User Group 1" is "Department C", then the subject set is {User A, User Group 1, Department C}. Assuming that the parent of "Document B" is "Folder X", and the parent of "Folder X" is "Dataset Y", then the object set is {Document B, Folder X, Dataset Y}. Assuming that the parent of the "View" permission is the "Edit" permission, and the parent of the "Edit" permission is the "All" permission, then the permission set is {View, Edit, All}, which can be determined based on the request objects included in the request. Correspondingly, the first permission triplet set can be (User A, View, Document B), (User A, All, Document B), (User Group 1, View, Document B), and so on, that is, enumerating all possible permission triplets.

[0045] For example, taking a read request to query "objects that user A can view" as an example, the requested object includes the subject "user A" and the permission "view". Then the first permission triple set includes (user A ∪ parent set of user A, view ∪ parent set of view, object) ),object Indicates no restriction on the object, with Figure 2 For example, including (User A, View, Object) (User group 1, View, Object) (Department C, View, Object) ), and so on, to obtain multiple atomic permission triples to be queried.

[0046] For example, taking a permission read request to query "all object permissions of user A" as an example, the requested object includes the subject "user A". Then the first permission triplet set includes (user A ∪ user A's parent set, permission ,object ), permissions This indicates that permissions are not restricted. For example, taking a permission read request or permission check request to query whether "user A has permission to view document B" as an example, the request objects include the subject "user A", the object "document B" and the permission "view". Then the first permission triple set includes (user A ∪ parent set of user A, view ∪ parent set of view, document B ∪ parent set of document B).

[0047] Of course, in actual business scenarios, in addition to querying the parent object of an object, it is also possible to query the child objects of an object. For example, taking the permission read request "list all permissions of user group 1 on document B" as an example, the request object includes the subject "user group 1" and the object "document B". Then the first permission triplet set includes (user group 1 ∪ subset of user group 1, permission (Document B ∪ Parent set of Document B), the specific details can be determined according to the actual request, and this disclosure does not impose any restrictions on it.

[0048] By breaking down complex permission queries into hierarchical relationship queries and constructing atomic permission triples to be queried based on the query results of the hierarchical relationships, the efficiency and performance of permission reading or permission checking are effectively improved.

[0049] S103: Based on the set of first permission triples, perform a query in the permission graph to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

[0050] For example, the permission graph is used to store the mapping relationship between subjects, objects, and permissions constructed based on permission configuration information. It can include multiple permission entries, and each permission entry can be represented by a permission triplet of (subject, permission, object). For example, "User A has viewing permission for document B" can be recorded as (user A, viewing permission, document B), "User A has viewing permission for folder X" can be recorded as (user A, viewing permission, folder X), and so on. Direct and atomic permission triplets can be stored, depending on the actual business scenario. This disclosure does not impose any restrictions on this.

[0051] Generally, if user A has view permissions for folder X, then user A will not have view permissions for document B separately. Therefore, if you need to query whether user A has view permissions for document B, you need to query through the hierarchical relationship.

[0052] In this embodiment, the permission graph can adopt a storage structure based on a hash table or a B+ tree to achieve fast lookup with a complexity of O(1) or O(log n). In addition, in order to improve the query hit rate, the triple data in the permission graph can be organized into a compact memory layout, which is determined according to the actual business scenario, and this disclosure does not impose any restrictions on it.

[0053] Using the above method, the subject hierarchy, object hierarchy, and permission hierarchy are decoupled from the subject, object, and the permissions of the subject to the object, and stored as a relationship graph and a permission graph, respectively. By querying the hierarchical relationship of the request objects in a single query, all request objects to be queried can be efficiently enumerated, and thus all permission triples to be queried can be enumerated, improving the efficiency of subsequent permission queries. Compared with recursive queries in related technologies, this method avoids initiating repeated subqueries, thereby significantly reducing network round trips and system load. This not only improves the performance and stability of permission checks but also increases the efficiency of permission reading.

[0054] In this implementation, for any query, a depth-first or breadth-first traversal is first performed on the relationship graph to resolve all related hierarchical relationships into a set of atomic permission triples. For example, the query "Can users in user group 1 access document B?" is resolved to query "All users in user group 1", and the query "Can user A access document B?" is resolved to query "The parent of user A". The goal of the relationship query phase is to obtain an accurate and enumerable atomic permission triple.

[0055] Since the permission graph can store the hierarchical relationships between objects in a set format, such as "user set of user group 1 = {user A, ...}", the collections of child objects of each object can be read directly. If the collections of parent objects of each object are needed, a traversal query is required.

[0056] In possible approaches, determining the set of objects with hierarchical relationships to the requested object based on the relationship diagram includes: if the relationship diagram stores a first parent set corresponding to the requested object, determining the set of objects based on the requested object and the first parent set; if the relationship diagram does not store a first parent set corresponding to the requested object, traversing and querying the direct parent objects and indirect parent objects of the requested object from the relationship diagram, and determining the set of objects based on the requested object, the direct parent objects, and the indirect parent objects; the permission management method also includes: storing the direct parent objects and indirect parent objects as the first parent set corresponding to the requested object.

[0057] In this embodiment, the first set of parent objects corresponding to an object (including direct parent objects and indirect parent objects) can be cached. If the parent object of the requested object is queried for the first time, it is necessary to traverse the permission graph to query the direct and indirect parent objects of the requested object. Figure 2 As shown, "User Group 1" is the direct parent of "User A", and "Department C" is the indirect parent of "User A". The retrieved direct and indirect parent objects are then stored as the first parent set corresponding to each object. Both breadth-first and depth-first traversal algorithms can be used; this disclosure does not impose any restrictions on either approach.

[0058] In this way, when querying the collection of parent objects corresponding to the object in the next query, the stored collection of parent objects can be read directly, thereby effectively improving the query efficiency of hierarchical relationships and thus improving the response speed of permission requests.

[0059] In this implementation, the adjacent parent node representation can be used to store parent objects. This involves flattening the parent node list of each node into a dense integer array. Specifically, the first array continuously stores all parent node identifiers, and the second array stores the starting offset of the node's parent node list within the first array. Here, a node represents an object. This storage method enables efficient parent node scanning and low-resource-consumption update operations.

[0060] In this embodiment, for relationship graphs with few levels and wide layers, a lightweight optimization method can be used during breadth-first traversal. This involves expanding only nodes whose parent node identifier is not empty (non-sink nodes). When a node with an empty parent node (sink node) is encountered, that node is recorded and further expansion stops. By distinguishing between sink nodes and non-sink nodes, traversal efficiency can be improved.

[0061] In this embodiment, further traversal optimization can be performed. For example, for each node, a third array stores all its direct parent nodes (including sink and non-sink nodes) for parent node merging without traversal. A fourth array stores the node's non-sink parent nodes for traversal. Furthermore, both the "visited node check" and "sink node check" are performed by looking up a hash table at each step. This pre-filters out "sink nodes," placing only non-sink nodes with parent nodes into a compact array. During traversal, this array is scanned, and the parent node set is represented by bits. Figure 1 One-time bitwise OR operation replaces numerous branch query operations.

[0062] The aforementioned arrays can be stored using a roaring bitmap, providing fast bitwise operations, sorting iterations, and a compression mechanism that maintains a moderate memory footprint even when the parent node set is large. It should be understood that the parent node set mentioned in this implementation includes both direct parent nodes and indirect parent nodes (ancestor nodes). Furthermore, when updating the relationship graph, including adding or deleting operations, the third array of the corresponding child nodes can be updated, or a parent node can be inserted or deleted from the fourth array, depending on the operation.

[0063] This enables efficient discovery of parent objects in deeply nested hierarchical relationships, significantly improving the efficiency of permission checks. It also allows for incremental modifications to the relationship graph, such as adding or deleting relationships, while maintaining correctness and availability for concurrent queries. Furthermore, the compact in-memory data structure allows for scaling to large relationship graphs, achieving a balance between space usage and traversal and update performance.

[0064] In this implementation, a persistent relationship graph can record all permission change requests from clients or management tools, including creation, update, and deletion, ensuring strong consistency of the mapping relationships. Sharded storage can also be used to distribute the load and eliminate single points of failure. Furthermore, an ordered log of each operation on the persistent relationship graph can be recorded, providing a reliable, sequential, authoritative data source for updates, rollbacks, and auditing.

[0065] In one possible approach, querying the permission graph based on the first set of permission triples includes: querying the cached permission set based on the first set of permission triples, whereby the cached permission set stores historically queried atomic permission triples; if no atomic permission triples matching each permission triple in the first set of permission triples are found in the cached permission set, then querying the permission graph based on the first set of permission triples; the permission management method further includes: if an atomic permission triple matching each permission triple in the first set of permission triples is found in the permission graph, then the atomic permission triple is stored in the cached permission set.

[0066] In this embodiment, in addition to querying mapping relationships in the persistent relationship graph, a cached permission set can also be provided to store the queried permission triples. In this way, when querying the same corresponding permission triples again, the corresponding permission triples can be quickly obtained from the cached permission set, which significantly reduces query latency and backend load.

[0067] It should be understood that instead of caching all retrieved permission triples, it's possible to cache permission triples from frequently requested requests. This ensures fast response times for high-frequency requests while avoiding the storage of large amounts of redundant data. For example, mapping relationships for frequently requested permission checks can improve the response speed of permission check requests.

[0068] In addition, if a permission change occurs, besides updating the persistent relationship graph, all affected permission triples in the cache permission set can be actively invalidated at the same time, instead of modifying the affected permission triples in the cache permission set. This eliminates the risk of data staleness caused by disordered read and write order, and ensures that subsequent requests can rebuild the cache from the persistent relationship graph, maintaining the correctness, consistency and security of cached data.

[0069] The cache permission set can also be implemented using a highly scalable, low-latency Redis cache layer, and this disclosure does not impose any restrictions on this.

[0070] In some possible approaches, the permission management method also includes: allocating a first resource based on the number of permission triples in the first permission triple set, wherein the number of first resources is positively correlated with the number of permission triples; and querying the permission graph based on the first permission triple set, including: calling the first resource and querying the permission graph based on the first permission triple set.

[0071] For example, the required computing resources can be determined based on the size of the object set or the first permission triple set. Then, resources can be dynamically allocated according to the required computing resources. For example, more CPU (Central Processing Unit) resources can be allocated to large-scale object sets or first permission triple sets, and less CPU resources can be allocated to small-scale object sets or first permission triple sets, etc. This disclosure does not limit this, in order to ensure high availability and performance under high load, such as ensuring the computing speed of enumerating the first permission triple set of large-scale object sets and the query speed of the corresponding permission query process.

[0072] In one possible approach, a query is performed on the permission graph based on the first permission triplet set to obtain the request result corresponding to the first permission query request. This includes: if the first permission query request is a first type request, obtaining the request result corresponding to the first permission query request based on all atomic permission triplets in the permission graph that match each permission triplet in the first permission triplet set; the first type request represents a permission query request including at least one of a first subject, a first object, and a first permission; if the first permission query request is a second type request, if an atomic permission triplet matching any permission triplet in the first permission triplet set is found in the permission graph, a request result representing a successful query of the first permission query request is obtained; otherwise, a request result representing a failed query of the first permission query request is obtained; the second type request represents a permission query request including a first subject, a first object, and a first permission.

[0073] For example, the first type of request is a permission read request, which needs to return all atomic permission triples that match the allocation of each permission triple in the first permission triple set in the permission graph. By efficiently traversing the object set and retrieving relevant permissions, efficient permission management or auditing can be achieved. The second type of request is a permission check request, which needs to return the result of check failure (query unsuccessful) or check success (query successful). Usually, it is only necessary to find an atomic permission triple that matches any permission triple in the first permission triple set to return a result of check success, thereby improving the response speed of permission check requests.

[0074] In one possible approach, for the request objects included in the first permission query request, a set of first permission triples is constructed based on a relational graph, including: when the first permission query request includes a first subject, a first object, and a first permission, the first subject set corresponding to the first subject, the first object set corresponding to the first object, and the first permission set corresponding to the first permission are determined based on the relational graph, and the combinable permission triples are enumerated based on the first object set and the first permission set to obtain the set of first permission triples. The query is performed on the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request. This includes: querying the permission graph for atomic permission triples that match each permission triple in the first set of permission triples; if no matching atomic permission triple is found in the permission graph, obtaining a request result indicating that the first permission query request failed; and / or, if a matching atomic permission triple is found in the permission graph, determining the second subject set based on the subjects in all matching atomic permission triples, and obtaining a request result indicating that the first permission query request succeeded if the first subject set and the second subject set intersect; otherwise, obtaining a request result indicating that the first permission query request failed.

[0075] For example, taking a permission check request as an example, the query usually queries the set of parent objects. Therefore, the first subject set includes the first subject and the parent subject of the first subject, the first object set includes the first object and the parent object of the first object, and the first permission set includes the first permission and the parent permission of the first permission.

[0076] For example, such as Figure 3 As shown, taking the query "Does subject 0 have viewing permissions for document K?" as an example, assuming that neither the viewing permissions nor document K has a parent, we can query the permission graph to see if there is a match (subject 0). View the permission triplet for document K, subject This indicates that there are no restrictions on the subject; if no data is found, the check will fail. For example, if the query finds (Subject 3, View, Document K), then the subject set {3} is extracted. On the other hand, a parent query for Subject 0 can be performed in parallel within the relationship graph to determine the subject set {0, 1, 2, 3, 4, 5} corresponding to Subject 0. If both subject sets include Subject 3, then Subject 0 has view permission for Document K. If there is no intersection, then Subject 0 does not have view permission for Document K. If it is a permission read request, then the atomic permission triplet corresponding to the intersection is returned.

[0077] Accordingly, if the viewing permissions and document K have a parent, then a query can be performed in the relationship graph to see if there is a match (the main body). The atomic permission triples of (viewing ∪viewing parent set, document K ∪document K parent set) are not restricted in this disclosure.

[0078] By separately querying the subject set and the subject set corresponding to the atomic permission triples related to the object, and then determining the result corresponding to the permission check request based on whether there is an intersection between the two subject sets, the query of the relationship graph and the permission graph can be performed in parallel without traversing and querying all atomic permission triples, which effectively improves the efficiency of permission checks and the speed of request response.

[0079] like Figure 4 As shown, regardless of whether the request is for permission checking or permission reading, the permission management system follows a unified and efficient processing flow. First, the client can send the request to a proxy service or directly call the core service based on the request's latency sensitivity, or it can use load balancing for task scheduling. The core service calls the graph service to parse all relevant levels, generating a complete set including parent objects, and possibly child objects, for the query. For permission reading requests, the core service's internal policy engine first checks the cache to obtain direct permissions. If the cache is not found, it falls back to persistent storage for querying. For permission checking requests, the graph service pushes ultra-low latency permission queries to the permission graph for parallel processing with the relationship graph. If it's an access control permission checking request, the core service's internal policy engine evaluates the corresponding access control rules based on the queried permission mapping relationship, further eliminating redundant policy paths. Finally, for permission checking requests, the core service directly returns a simple boolean result (pass or fail) to the client. For permission reading requests, the core service sends the raw permission data to the proxy service, which evaluates, paginates, and assembles the final response before returning it to the client.

[0080] The proxy service serves as the primary entry point for all permission queries, forwarding incoming requests to the core service for processing, re-evaluating aggregation strategies, and integrating the final results before returning them to the client. This service also manages permission pagination functionality. The core service acts as the central coordinator of the policy engine, responsible for executing the two-stage query logic driving the permission evaluation process. The policy engine is also responsible for executing the two-stage query logic driving the permission evaluation process. The graph service is a high-performance, in-memory service optimized for hierarchical queries, supporting in-memory caching of the permission graph to accelerate queries, persistent storage, and all configured permission mapping relationships.

[0081] This embodiment provides a unified architecture to efficiently handle two distinct query types, simplifying system design and maintenance. It aims to achieve ultra-low latency permission checks while supporting large-scale scalable permission reading. By decoupling the permission management system into a permission graph and a relationship graph, and optimizing each independently, permission queries are divided into a two-stage model of "relationship resolution - permission query," separating complex hierarchical traversal from the final permission verification / reading. By completing the complex hierarchical traversal in the first stage, the fan-out problem caused by repeatedly initiating subqueries in recursive queries is avoided. This achieves a non-recursive query scheme for the permission management system, significantly reducing network round trips and system load, improving the performance and stability of permission checks, and greatly reducing query fan-out and tail latency.

[0082] Furthermore, since the relationship graph can efficiently enumerate all possible permission triples, the permission reading task in the second stage becomes efficient and feasible, thus enabling a quick query of all permissions of a user or all visitors of a resource, greatly improving management and auditing efficiency.

[0083] Furthermore, the permission graph can employ CPU-caching-friendly data structures, while the relationship graph can utilize efficient set data structures such as roaring bitmaps to achieve memory optimization and high-performance set operations. Moreover, as independent components, the permission graph and relationship graph can be independently expanded according to their respective load requirements, improving the overall scalability and fault tolerance of the system.

[0084] In addition, the system resource allocation can be dynamically adjusted based on the computing resources required for the query, ensuring high availability and performance under high load.

[0085] Figure 5 This is a schematic diagram illustrating the structure of a permission management device according to an exemplary embodiment. Figure 5 As shown, the access control device 500 includes: The receiving module 501 is used to receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; The construction module 502 is used to construct a first set of permission triples based on a relationship graph for the request objects included in the first permission query request; wherein the relationship graph includes at least one of subject-level relationship, object-level relationship and permission-level relationship; The query module 503 is used to perform a query in the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

[0086] Optionally, the query module 503 is used for: When the first permission query request is a first type request, the request result corresponding to the first permission query request is obtained based on all atomic permission triples that match each permission triple in the first permission triple set in the permission graph; the first type request represents a permission query request that includes at least one request object among the first subject, the first object, and the first permission. When the first permission query request is a second type of request, if an atomic permission triplet matching any permission triplet in the first permission triplet set is found in the permission graph, a request result indicating that the first permission query request was successful is obtained; otherwise, a request result indicating that the first permission query request failed is obtained. The second type of request indicates a permission query request including the first subject, the first object, and the first permission.

[0087] Optionally, the construction module 502 is used for: When the first permission query request includes the first subject, the first object, and the first permission, the first subject set corresponding to the first subject, the first object set corresponding to the first object, and the first permission set corresponding to the first permission are determined based on the relationship graph. Based on the first object set and the first permission set, the combinable permission triples are enumerated to obtain the first permission triple set. In the permission graph, query the atomic permission triplet that matches each permission triplet in the first permission triplet set; If no matching atomic permission triple is found in the permission graph, a request result indicating that the first permission query request failed is obtained; and / or, if a matching atomic permission triple is found in the permission graph, a second subject set is determined based on the subjects in all matching atomic permission triples, and if there is an intersection between the first subject set and the second subject set, a request result indicating that the first permission query request succeeded is obtained; otherwise, a request result indicating that the first permission query request failed is obtained.

[0088] Optionally, the construction module 502 is used for: Based on the relationship diagram, determine the set of objects that have a hierarchical relationship with the requested object; Based on the set of objects, enumerate the composable permission triples to obtain the first permission triple set.

[0089] Optionally, the construction module 502 is used for: If the relationship graph stores a first parent set corresponding to the request object, the object set is determined based on the request object and the first parent set; If the relationship graph does not store the first parent set corresponding to the request object, the direct parent object and indirect parent object of the request object are traversed and queried from the relationship graph, and the object set is determined based on the request object, the direct parent object and the indirect parent object; The access control device 500 further includes a storage module, which is used for: The direct parent object and the indirect parent object are stored as the first parent set corresponding to the request object.

[0090] Optionally, the query module 503 is used for: Based on the first set of permission triples, a query is performed in the cached permission set, which is used to store historically queried atomic permission triples; If no atomic permission triplet matching each permission triplet in the first permission triplet set is found in the cached permission set, then a query is performed in the permission graph based on the first permission triplet set. The permission management device 500 further includes a cache module, which is used for: If an atomic permission triplet is found in the permission graph that matches each permission triplet in the first permission triplet set, then the atomic permission triplet is stored in the cached permission set.

[0091] Optionally, the permission management device 500 further includes an allocation module, which is used for: The first resource is allocated based on the number of permission triples in the first permission triple set, and the first resource is positively correlated with the number of permission triples. The query module 503 is used for: The first resource is invoked, and a query is performed on the permission graph based on the first set of permission triples.

[0092] Regarding the permission management device 500 in the above embodiments, the method logic executed by each functional module has been described in detail in the section on methods, and will not be repeated here.

[0093] Based on the same concept, embodiments of this disclosure also provide a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of any of the above-described permission management methods.

[0094] Based on the same concept, this disclosure also provides an electronic device that may include: A storage device on which computer programs are stored; A processing device for executing a computer program stored in a storage device to implement the steps of any of the above-described permission management methods.

[0095] Based on the same concept, this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described permission management methods.

[0096] The following is for reference. Figure 6 The diagram illustrates a structural schematic of an electronic device 600 suitable for implementing embodiments of the present disclosure. Terminal devices in embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0097] like Figure 6 As shown, electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0098] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0099] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0100] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0101] In some implementations, communication can be conducted using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol), and can be interconnected with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0102] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0103] The aforementioned computer-readable medium carries one or more programs. When the electronic device executes the aforementioned one or more programs, the electronic device causes the electronic device to: receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; for the request object included in the first permission query request, construct a first permission triplet set based on a relationship graph; wherein the relationship graph includes at least one of a subject hierarchy relationship, an object hierarchy relationship, and a permission hierarchy relationship; perform a query on the permission graph based on the first permission triplet set to obtain the request result corresponding to the first permission query request; wherein the permission graph includes atomic permission triplets constructed based on permission configuration information.

[0104] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules are not, in some cases, intended to limit the functionality of the module itself.

[0107] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0108] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0109] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0110] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0111] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A method for managing access permissions, characterized in that, The permission management method includes: Receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; For the request objects included in the first permission query request, a first permission triple set is constructed based on the relationship graph; wherein, the relationship graph includes at least one of subject-level relationship, object-level relationship and permission-level relationship; Based on the first set of permission triples, a query is performed in the permission graph to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

2. The access control method according to claim 1, characterized in that, The step of querying the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request includes: When the first permission query request is a first type request, the request result corresponding to the first permission query request is obtained based on all atomic permission triples that match each permission triple in the first permission triple set in the permission graph; the first type request represents a permission query request that includes at least one request object among the first subject, the first object, and the first permission. When the first permission query request is a second type of request, if an atomic permission triplet matching any permission triplet in the first permission triplet set is found in the permission graph, a request result indicating that the first permission query request was successful is obtained; otherwise, a request result indicating that the first permission query request failed is obtained. The second type of request indicates a permission query request including the first subject, the first object, and the first permission.

3. The access control method according to claim 1, characterized in that, For the request objects included in the first permission query request, a first permission triplet set is constructed based on the relationship graph, including: When the first permission query request includes the first subject, the first object, and the first permission, the first subject set corresponding to the first subject, the first object set corresponding to the first object, and the first permission set corresponding to the first permission are determined based on the relationship graph. Based on the first object set and the first permission set, the combinable permission triples are enumerated to obtain the first permission triple set. The step of querying the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request includes: In the permission graph, query the atomic permission triplet that matches each permission triplet in the first permission triplet set; If no matching atomic permission triple is found in the permission graph, a request result indicating that the first permission query request failed is obtained; and / or, if a matching atomic permission triple is found in the permission graph, a second subject set is determined based on the subjects in all matching atomic permission triples, and if there is an intersection between the first subject set and the second subject set, a request result indicating that the first permission query request succeeded is obtained; otherwise, a request result indicating that the first permission query request failed is obtained.

4. The access control method according to claim 1, characterized in that, For the request objects included in the first permission query request, a first permission triplet set is constructed based on the relationship graph, including: Based on the relationship diagram, determine the set of objects that have a hierarchical relationship with the requested object; Based on the set of objects, enumerate the composable permission triples to obtain the first permission triple set.

5. The access control method according to claim 4, characterized in that, The set of objects that have a hierarchical relationship with the requested object, determined based on the relationship diagram, includes: If the relationship graph stores a first parent set corresponding to the request object, the object set is determined based on the request object and the first parent set; If the relationship graph does not store the first parent set corresponding to the request object, the direct parent object and indirect parent object of the request object are traversed and queried from the relationship graph, and the object set is determined based on the request object, the direct parent object and the indirect parent object; The access control method also includes: The direct parent object and the indirect parent object are stored as the first parent set corresponding to the request object.

6. The access control method according to any one of claims 1-5, characterized in that, The querying of the permission graph based on the first set of permission triples includes: Based on the first set of permission triples, a query is performed in the cached permission set, which is used to store historically queried atomic permission triples; If no atomic permission triplet matching each permission triplet in the first permission triplet set is found in the cached permission set, then a query is performed in the permission graph based on the first permission triplet set. The access control method also includes: If an atomic permission triplet is found in the permission graph that matches each permission triplet in the first permission triplet set, then the atomic permission triplet is stored in the cached permission set.

7. The access control method according to any one of claims 1-5, characterized in that, The access control method also includes: The first resource is allocated based on the number of permission triples in the first permission triple set, and the first resource is positively correlated with the number of permission triples. Based on the first set of permission triples, a query is performed in the permission graph, including: The first resource is invoked, and a query is performed on the permission graph based on the first set of permission triples.

8. An access control device, characterized in that, The access control device includes: A receiving module is configured to receive a first permission query request; wherein the first permission query request includes at least one request object selected from a first subject, a first object, and a first permission; The construction module is used to construct a first set of permission triples based on a relationship graph for the request objects included in the first permission query request; wherein the relationship graph includes at least one of subject-level relationship, object-level relationship and permission-level relationship; The query module is used to perform a query in the permission graph based on the first set of permission triples to obtain the request result corresponding to the first permission query request; wherein, the permission graph includes atomic permission triples constructed based on permission configuration information.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method according to any one of claims 1-7.

10. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

Images