An account management method, device, equipment, medium and product

Abstract

The application discloses an account management method, device, equipment, medium and product. The method comprises the following steps: if an account authorization request is detected, determining a to-be-authorized account recorded in a request authorization work order, and determining an enterprise identification relationship requested by the to-be-authorized account for authorization; determining an authorization operation mode recorded in the enterprise identification relationship, and matching a corresponding security policy according to the authorization operation mode, so as to verify the account authorization request according to the security policy; if the verification is passed, performing an authorization operation on the to-be-authorized account based on a calling application program interface authorization mode and / or a pre-configured security group authorization mode, obtaining an interface return code and / or a group addition result, and responding to the account authorization request based on the interface return code and / or the group addition result. The application can perform approval and verification according to the enterprise identification relationship, and perform an authorization operation by using a corresponding authorization operation mode, so that more efficient, safe and accurate account management is realized.

Description

Technical Field

[0001] This invention relates to the fields of cloud platform technology and big data technology, and in particular to an account management method, apparatus, device, medium and product. Background Technology

[0002] With the continuous development of cloud platform technology, in order to ensure data security and isolation, a logical zone division strategy is usually adopted, including network domains such as local area network zones (e.g., government extranet zones) and internet zones, with strict isolation implemented between each logical zone. However, account management between cloud platforms located in different logical zones often relies on relevant personnel to manually log in to each regional platform after submitting a work order, which has problems such as inconsistent cross-regional permissions, high labor costs, and significant security risks.

[0003] Therefore, how to review and verify the corporate identification information of authorized accounts and authorize them upon successful verification, in order to complete account management operations more efficiently, securely, and accurately, is an urgent problem to be solved. Summary of the Invention

[0004] This invention provides an account management method, apparatus, device, medium, and product to approve and verify authorized personnel based on enterprise identification relationships and to perform authorization operations using corresponding authorization operation methods, thereby achieving more efficient, secure, and accurate account management.

[0005] According to one aspect of the present invention, an account management method is provided, comprising:

[0006] If an account authorization request is detected, the account to be authorized recorded in the authorization request work order is identified, and the enterprise identification relationship of the account to be authorized is determined.

[0007] The authorization operation method recorded in the enterprise identification relationship is determined, and the corresponding security policy is matched according to the authorization operation method to verify the account authorization request according to the security policy; the authorization operation method includes authorization by calling the application programming interface and / or authorization based on the pre-configured security group;

[0008] If the verification passes, the authorization operation is performed on the account to be authorized by calling the application interface authorization method to obtain the interface return code, and the account authorization request is responded to based on the interface return code; or

[0009] Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, the group is added, and the account authorization request is responded to based on the group addition result; or

[0010] Authorization is performed on the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method. The API return code and group addition result are obtained, and the account authorization request is responded to based on the API return code and group addition result.

[0011] According to another aspect of the present invention, an account management device is provided, comprising:

[0012] The determination module is used to determine the account to be authorized recorded in the authorization request work order and determine the enterprise identification relationship of the account to be authorized if an account authorization request is detected.

[0013] The verification module is used to determine the authorization operation method recorded in the enterprise identification relationship, and match the corresponding security policy according to the authorization operation method, so as to verify the account authorization request according to the security policy; the authorization operation method includes authorization by calling the application interface and / or authorization based on the pre-configured security group;

[0014] The authorization module, if verification passes, performs an authorization operation on the account to be authorized by calling the application's API, obtains the API return code, and responds to the account authorization request based on the API return code; or

[0015] Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, the group is added, and the account authorization request is responded to based on the group addition result; or

[0016] Authorization is performed on the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method. The API return code and group addition result are obtained, and the account authorization request is responded to based on the API return code and group addition result.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] At least one processor; and

[0019] A memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform an account management method according to any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the account management method described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer program product is also provided, the computer program product including a computer program, which, when executed by a processor, implements an account management method according to any embodiment of the present invention.

[0023] The technical solution of this invention, upon detecting an account authorization request, identifies the account to be authorized recorded in the authorization request work order and determines the enterprise identification relationship of the account requesting authorization. It then determines the authorization operation method recorded in the enterprise identification relationship and matches the corresponding security policy according to the authorization operation method to verify the account authorization request based on the security policy. If the verification passes, it performs an authorization operation on the account to be authorized based on the method of calling the application programming interface (API) and / or the method of authorization based on a pre-configured security group, obtaining the corresponding API return code and / or group addition result, and responds to the account authorization request based on the API return code and / or group addition result. By approving and verifying the account to be authorized based on the enterprise identification relationship and performing the authorization operation using the corresponding authorization operation method, more efficient, secure, and accurate account management can be achieved.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of an account management method provided in an embodiment of the present invention;

[0027] Figure 2 This is a structural block diagram of an account management device provided in an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," "target," "candidate," and "alternative," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the invention described herein can be practiced in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The acquisition, storage, use, and processing of data in the technical solutions of this application comply with relevant laws and regulations.

[0031] It should be noted that the relevant technologies have shortcomings in the permission management of heterogeneous cloud platforms with different logical regions. Taking a backup platform cluster as an example, on the one hand, there is a problem of cross-regional permission consistency. Each logical region is configured independently, resulting in maintenance personnel having permissions in the local area network (LAN) region (such as the government extranet) but not in the internet region, leading to inconsistent backup operator permissions and regional discrepancies. On the other hand, there is a problem of high maintenance costs. A single permission configuration takes at least 15 minutes per region, and granting new employees backup permissions in both the LAN and internet regions takes more than 30 minutes, resulting in low efficiency. Furthermore, there is a significant compliance risk. Due to the lack of regional security policy verification, unauthorized data access is easily possible, such as configuring LAN region permissions for the internet region, complex structures without automatic mechanisms, and violations of security compliance requirements. Finally, the existing solution has a simplistic structure, cannot handle differences in topology rules between heterogeneous backup platforms, and is slow and prone to errors. To address the aforementioned issues, this invention proposes an automatic authorization scheme for personnel accounts on a multi-regional heterogeneous cloud platform based on work orders. This scheme can verify and authorize accounts to be authorized, enabling more efficient, secure, and accurate account management operations. The specific implementation method will be described in detail in subsequent embodiments.

[0032] Example 1

[0033] Figure 1This is a flowchart of an account management method provided by an embodiment of the present invention. This embodiment is applicable to the management of accounts of personnel on multi-regional heterogeneous cloud platforms based on work order-driven methods, and is particularly suitable for account management in government cloud environments. The method can be executed by an account management device, which can be implemented in hardware and / or software. The account management device can be configured in an electronic device, such as an electronic device equipped with an account management system. The account management system may include a work order module, a region management module, an event listening module, and a permission management module.

[0034] For example, the work order module can be used to define templates, including role type (e.g., backup operator), operation type (create / recycle), platform type identifier (backup platform), target logical area list (government extranet area, internet area), and target platform list. The work order module uses work orders as input and interacts with the event listener module to trigger the authorization process.

[0035] For example, the region management module is used to maintain region topology, handle authentication differences, and verify security policies; it also maintains a role-region-platform mapping table (i.e., enterprise identification relationships) (e.g., Backup Platform 1 is associated with the Government Extranet region and Backup Platform 2 is associated with the Internet region; Backup Platform is associated with the role Backup Operator). Detailed description of the mapping table: The mapping table is primarily stored in the configuration management database, treating it as a configuration item. Each role-region-platform association represents an enterprise identification relationship. The table structure includes fields: Role ID (uniquely identifies the role, such as "Backup Operator"), Region ID (logical region identifier, such as "Government Extranet region"), Platform ID (platform identifier, such as "Platform 1"), and associated permissions (permission description, such as "Backup Recovery Access").

[0036] For example, the maintenance mechanism of the region management module includes: real-time updates (when the work order status changes, the configuration management database is scanned and automatically inserted or updated to ensure mapping consistency when an event triggers the process); query optimization (using the search engine of the configuration management database to accelerate cross-region queries); version control (the configuration management database has built-in change management, recording the timestamp of each update and change log, and supporting rollback); security verification (entry data is verified through the access control of the configuration management database before maintenance to avoid unauthorized mapping); and automatic discovery (the configuration management database periodically or in real-time synchronizes configuration changes with the cloud platform).

[0037] For example, the event listening module is used to capture changes in work order status, extract platform type and region lists, and push them to the permission management module. This module distinguishes between three cases: First, if a new account is created and authorized, the account creation information is first pushed to the permission management module for account creation. Then, based on the role-region-platform mapping table, the authorization operation method adopted by the platform adapter module is determined, and the corresponding trigger operation is performed. Second, if an existing account is authorized or revoked, the account information is determined, and the corresponding authorization or deauthorization operation is determined based on the implementation method of the platform adapter module. Third, if an existing account is deleted, all connected underlying platforms are traversed to delete the corresponding account's role and the account in the permission management module. The permission management module is used to verify requests and execute account operations.

[0038] like Figure 1 As shown, the account management method includes:

[0039] S101. If an account authorization request is detected, determine the account to be authorized recorded in the authorization request work order, and determine the enterprise identification relationship of the account to be authorized.

[0040] The account authorization request can be initiated by submitting an authorization request ticket. The authorization request ticket can be an ITSM (Information Technology Service Management Ticket) ticket. The account to be authorized refers to the personnel account specified in the authorization request ticket that needs to be granted the corresponding authorization role on the corresponding target platform.

[0041] Corporate Identity (CI) relationships refer to the associations that characterize the role, region, and platform to which an authorized account belongs. CI relationships include at least one of the following: data center, network region, target platform, platform type, authorized role, and authorized operation method. Platform type can be a backup platform, government cloud platform, desktop cloud platform, monitoring platform, or auditing platform. Authorized roles can be backup operators, platform administrators, etc., and network regions can be government extranet zones, internet zones, etc.

[0042] Optionally, the account management system can interact with the bill of lading terminal through the ITSM work order module, instructing the bill of lading personnel to select data center → network area → platform type in sequence on the bill of lading terminal. Specifically, if a data center is selected, the account management system can only list the network areas where that data center exists; if a network area is selected, it can only list the platforms actually deployed in that area. The final selection scenario is, for example: China Unicom Data Center → Government Extranet Area → Backup Platform, thus obtaining the enterprise identification relationship of the account to be authorized. The account management system can also parse the authorization request work order to directly obtain the enterprise identification relationship of the account to be authorized recorded in the authorization request work order. This invention does not limit this.

[0043] It should be noted that the account to be authorized and the account corresponding to the bill of lading terminal can be the same or different. The account corresponding to the bill of lading terminal can be any account with bill of lading authority. The account to be authorized refers to the person specified in the form of the authorization request work order. The form will provide the account information of the specific account to be authorized. For example, if the account corresponding to the bill of lading terminal belongs to person A, and the account to be authorized belongs to person B, then the authorization request work order records the account information of person B, which is unrelated to A's own account.

[0044] S102. Determine the authorization operation method recorded in the enterprise identification relationship, and match the corresponding security policy according to the authorization operation method, so as to verify the account authorization request according to the security policy.

[0045] The authorization operation methods include authorization via application programming interface (API) and / or authorization based on pre-configured security groups.

[0046] For example, if there is a request for authorization work order that requires Zhang San to apply for administrator privileges for Backup Platform 1 deployed in the Government Affairs Extranet Zone of Data Center 1, then the enterprise identification relationship is Data Center 1 - Government Affairs Extranet Zone - Backup Platform 1 - Administrator.

[0047] For example, in the regional management module of the account management system, a CI relationship configuration field for each specific underlying platform can be used to record which authorization operation method is adopted. A value of 1 indicates calling the application programming interface, a value of 0 indicates authorization based on a pre-configured security group, and a value of "combined mode" indicates authorization using both methods simultaneously. During the process of determining the implementation method, the billing personnel will select Data Center → Network Region → Platform Type in the ITSM form. After selecting a Data Center, the system will only list the network regions that exist within that Data Center. After selecting a network region, only the platforms actually deployed in that region will be listed. After selecting a platform, the appropriate authorization operation method will be determined based on the parameter values.

[0048] Optionally, a corresponding security policy can be matched based on the authorized operation method, including:

[0049] (1) If the authorization operation method in the enterprise identification relationship is to call the application interface for authorization, then the security policy is either the independent security policy of zone authorization or the logical security policy of role permissions;

[0050] For example, if the security policy is a regional authorization independence security policy, the independence of regional authorization can be checked to avoid overlapping situations. For instance, if a user applies for permissions in the government extranet zone, but the configuration calls authorization actions for both the government extranet and the Internet zones at the same time, then the regional authorization independence security policy is not satisfied, and the verification fails.

[0051] For example, permission mutual exclusion can be designed based on the logic of role-based access control. For instance, the roles of administrator and auditor cannot be authorized to the same user at the same time. Enterprise identification relationships can also be designed for user accounts in the Configuration Management Database (CMDB) of the regional management module to record the permission configuration of existing user accounts. When performing security policy checks, the permission information of existing accounts will be read to verify that they meet the logical security policy of role-based access control.

[0052] (2) If the authorization operation method in the enterprise identification relationship is based on the pre-configured security group authorization, then the security policy is the regional isolation policy after the group is added or the platform requirement policy of the pre-configured security group.

[0053] For example, if the security policy is a regional isolation policy after a group is added, it can be based on preset regional isolation requirements, such as the government extranet group not containing Internet sensitive permissions, to check whether the group addition meets the regional isolation requirements.

[0054] For example, if the security policy is a platform requirement policy for pre-configured security groups, it can be checked whether the pre-configured security groups exist and meet the platform requirements. For example, for the user groups of the Aishu platform, the requirements including audit_member need to be met.

[0055] It should be noted that the platform can correctly associate the roles of the personnel to be authorized on the premise that the user group is pre-configured on the platform and is consistent with the security group pre-stored in the permission management module of the account management system to facilitate the matching work. For example, the audit_member group. If the platform or the permission management module (Active Directory) of the account management system does not have this security group, the verification will be determined to fail. Both parties must have the audit_member group for the verification to succeed.

[0056] Optionally, after determining the enterprise identification relationship of the account requesting authorization, the process further includes: approving the authorization request through a work order approval terminal, and, if approved, determining the authorization operation method recorded in the enterprise identification relationship. Here, the work order approval terminal refers to a terminal that performs preliminary approval of the account authorization request itself before verification based on security policies. There can be at least one work order approval terminal, which can be determined based on information such as the data center, network area, target platform, platform type, and authorized role specified in the enterprise identification relationship to approve the authorization request.

[0057] S103. If the verification is successful, the authorization operation is performed on the account to be authorized based on the authorization method of calling the application interface and the authorization method of pre-configured security group, the interface return code and group addition result are obtained, and the account authorization request is responded to based on the interface return code and group addition result.

[0058] The interface return code refers to the feedback code returned after an authorization operation based on the application interface authorization method. The group addition result refers to the feedback result returned after an authorization operation based on the pre-configured security group authorization method. The interface return code and the group addition result can characterize the execution status of the authorization operation.

[0059] For example, an interface return code of 0 indicates successful authorization, while an interface return code of 3001 indicates authorization failure. Group addition results can be characterized by different error codes. Specifically, error code 30001 indicates an unknown error; error code 30002 indicates the user does not exist during a revocation operation; error code 30003 indicates the transmitted user group does not exist during a revocation operation; error code 30004 indicates the user does not exist during a addition operation; error code 30005 indicates the transmitted user group does not exist during a addition operation; error code 30006 indicates an invalid operation type (only 0 or 1 is supported); error code 30007: the user already exists in the group (during addition), or the user is not in the group (during revocation).

[0060] Optionally, the authorization operation method in the enterprise identification relationship can be authorization by calling an application programming interface (API), authorization based on a pre-configured security group, or a combination of both. Accordingly, if the authorization operation method in the enterprise identification relationship is authorization by calling an API, the account authorization request can be responded to based on the API return code after the account authorization operation. If the authorization operation method in the enterprise identification relationship is authorization based on a pre-configured security group, the account authorization request can be responded to based on the group addition result after the account authorization operation. If the authorization operation method is authorization by calling an API and authorization based on a pre-configured security group, the account authorization request can be responded to based on the return code and the group addition result after the account authorization operation.

[0061] Optionally, if the verification is successful, the authorization operation is performed on the account to be authorized based on the method of calling the application interface authorization to obtain the interface return code, and the account authorization request is responded to based on the interface return code; or the authorization operation is performed on the account to be authorized based on the method of pre-configured security group authorization to obtain the group addition result, and the account authorization request is responded to based on the group addition result; or the authorization operation is performed on the account to be authorized based on both the method of calling the application interface authorization and the method of pre-configured security group authorization to obtain the interface return code and the group addition result, and the account authorization request is responded to based on the interface return code and the group addition result. That is, the authorization operation on the account to be authorized can be performed through any of steps (1)-(3).

[0062] (1) Authorize the account to be authorized by calling the application interface authorization method, including: determining the platform area adapter and target interface of the target platform based on the account to be authorized and the target platform in the enterprise identification relationship; calling the target interface based on the platform area adapter of the target platform to perform account creation operation, and associating the account to be authorized as an authorized role on the target platform to synchronize platform permissions and complete the account authorization operation.

[0063] Among them, the target interface refers to the API interface corresponding to the target platform in the enterprise identification relationship.

[0064] Optionally, when the authorization operation method is to call the application programming interface (API) for authorization, if the event listening module of the account management system detects that the work order module has approved the work order, it can parse the fields in the enterprise identification relationship, and after security verification, push an instruction packet to the permission management module, such as {"Work Order Identifier":"WO-2025-001","Operation Type":"Create","Region List":["Government Extranet Zone","Internet Zone"],"Target Platform":"Backup Platform"}, to instruct the permission management module to confirm the identity of the account to be authorized, and then control the corresponding platform zone adapter to perform account creation and platform synchronization operations to complete the account authorization.

[0065] For example, the account creation operation can be as follows: (a) Parameter supplementation and verification: Based on the personnel name, organizational structure, profession, position, and other information associated with the account to be authorized in the work order, determine its account name and detailed information. The detailed information may include the full spelling of the name, the name, the converted security string, the OU (Organization Unit) path, etc. (b) Call the preset call command, such as "PowerShell cmdlet New-ADUser" to create the account. After successful creation, use the preset retrieval command, such as "Get-ADUser -Identity $ADAccount" to confirm whether the account exists.

[0066] Optionally, after creating an account, you can control the platform's regional adapter to call target interfaces based on the region, verify security policies, and independently execute operations for each region. For example, grant user xxx access to the government extranet platform 1, and log any processing failures. This method directly configures precise permissions via API, such as calling the backup platform API to set user role permissions, enabling fine-grained control.

[0067] (2) Based on the pre-configured security group authorization method, the authorization operation is performed on the account to be authorized, including: generating an instruction package according to the instruction information in the enterprise identification relationship; and sending the instruction package to the permission management module to instruct the permission management module to add the account to be authorized to the pre-configured security group; and synchronizing platform permissions according to the user group corresponding to the authorized role associated with the target platform according to the account to be authorized, and completing the account authorization operation.

[0068] The access control module refers to the Active Directory access control module pre-configured in the account management system. Security groups can be pre-created in the access control module for each role, region, and platform combination. For example, a group can be created for the "Backup Operator" role on the government extranet backup platform, and this group can be mapped to the platform's access control roles on the target platform. For instance, if the administrator role on platform A is configured to the corresponding security group named "Platform A Administrator" in the access control module, then all users within that security group will obtain administrator role permissions for platform A.

[0069] It should be noted that pre-configured security group authorization involves pre-configuring Active Directory user groups for each role on each target platform. When a work order triggers an account authorization event, authorization is granted by adding the account information to the corresponding user group. This pre-configured security group authorization method automatically associates the account to be authorized with the authorization request when it is submitted, establishing it as the subject of permission ownership.

[0070] Optionally, after the work order is approved and the fields are parsed to obtain the enterprise identification relationship including the target logical area list, platform type identifier, and role type, verification can be performed based on the security policy. After the verification is passed, an instruction package for adding events to the group can be generated according to the area, platform selection, and role requirements of the work order.

[0071] It should be noted that the method of generating the instruction package is the same when the authorization operation is performed by calling the application interface and when the authorization operation is performed based on the pre-configured security group. The difference between the two is that the authorization operation by calling the application interface is performed on the target platform, while the authorization operation based on the pre-configured security group is performed on the permission management authentication source.

[0072] For example, the instruction information may include: the request authorization work order number, operation type, account to be authorized, data center, network zone, target platform, platform type, and authorized role. Based on the instruction information in the enterprise identification relationship, the generated instruction package can be: {"Work Order Identifier":"WO-2025-001","Operation Type":"Create","Zone List":["Government Extranet Zone","Internet Zone"],"Target Platform":"Backup Platform","Role Type":"Backup Operator"}.

[0073] Optionally, the access control module allows adding accounts to be authorized to corresponding security groups based on network zone, target platform, and authorized role. For example, for the role of the government extranet backup platform, user xxx is added to user group 1 of the backup platform; for the role of the internet zone backup platform, the same user is added to user group 2 of the backup platform.

[0074] For example, the security group will have a system group name in both the permission management module and the corresponding backup platform. When the adapter is triggered, it will send an instruction to the permission management module to add the account to be authorized to the corresponding security group. Then, the backup platform will query the permission management module for the corresponding security group members through the pre-configured information to match the security group with the corresponding role already associated on the backup system.

[0075] Optionally, the pre-configured security group authorization method can achieve compatibility through pre-configured security groups. When the target platform does not support direct API calls, the security group synchronization mechanism can be relied upon to automatically propagate permissions.

[0076] (3) Authorize the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method, including: determining the target platform recorded in the enterprise identification relationship and determining the compatibility type of the target platform; and determining the authorization operation method for each target platform according to the compatibility type of the target platform to complete the account authorization operation. The compatibility type is either supporting API authorization or not supporting API authorization.

[0077] Optionally, when the compatibility type is to support application interface authorization, application interface authorization and / or authorization based on pre-configured security groups can be invoked; when the compatibility type is to not support application interface authorization, authorization based on pre-configured security groups can be used.

[0078] For example, in a real-world government cloud environment, two authorization methods can be used in combination based on platform characteristics to provide a balance between precise control and compatibility. For instance, for platforms that support APIs, API configuration of user roles and permissions can be triggered directly to achieve fine-grained authorization (such as setting access permissions for specific backup tasks); for platforms with high compatibility requirements (such as platforms in the internet zone that may not support the full API), an add group event can be triggered to add the personnel to be authorized to a pre-configured security group, thereby achieving authorization (this group has been mapped to the platform's standard permissions).

[0079] Optionally, when the authorization operation method is to call the application programming interface for authorization and to authorize based on the pre-configured security group, the corresponding generated mixed instruction package can be {"work order identifier":"WO-2025-002","operation type":"create","region list":["government extranet zone","internet zone"],"target platform":"backup platform","implementation method":"joint use","role type":"backup operator"}.

[0080] For example, for target platform 1 in the government extranet zone, precise permissions can be configured directly via API (such as setting backup and restore permissions); for target platform 2 in the internet zone, an add group event can be triggered to add users to user groups. The entire process is executed independently in each zone to ensure failure isolation; simultaneously, mixed logs are recorded, including API return codes and group addition results. This combined approach achieves a balance between precision and compatibility, making it suitable for heterogeneous platform environments.

[0081] Optionally, after responding to an account authorization request, the method may further include: in response to an account change request, performing an account change operation by calling an application programming interface and / or based on a pre-configured security group; in response to an account deletion request initiated by a bill of lading personnel, performing an account deletion operation by calling an application programming interface and / or based on a pre-configured security group.

[0082] For example, in response to an account change request, a new account can be created and authorized for the account to be authorized, or an identity for another network zone, another platform or another role can be added to an existing account, i.e., account change can be performed.

[0083] For example, if an account change request involves creating a new account and authorizing a backup operator on target platform 1 in the government extranet area, the work order operation type can be "Create," specifying role as "Backup Operator," target area as "Government Extranet Area," platform as "Backup Platform," and backup platform as "Target Platform 1." The event listening module captures the change, determines it's a new account creation and authorization, and first pushes the account creation information to the permission management module to create a new account. Subsequently, based on the enterprise identification relationship in the region management module, the authorization operation method is determined (assuming it's authorization via API call), triggering the platform adapter module to call the target platform's API and directly configure backup operator permissions (e.g., setting backup task access). Logs are promptly recorded after processing to ensure compliance verification. The platform adapter can include a threshold API specification library to instruct it to call the corresponding API based on the region, ensuring permission synchronization.

[0084] For example, if the account change request is to add an existing account to the Internet zone's backup operator list, the work order operation type can be "Authorization," specifying the existing account (e.g., xxx), role = "Backup Operator," target area = "Internet Zone," platform = "Backup Platform," and backup platform = "Target Platform 2." The event listening module determines that it is an existing account's authorization status, queries the permission management module to verify whether the account exists, determines the implementation method based on the enterprise identification relationship (assuming it is based on pre-configured security group authorization), triggers the platform adapter module, adds the user to the target platform 2 user group, verifies the security policy, and promptly records the log.

[0085] For example, in response to an account deletion request, the work order operation type can be determined to be "delete," and the account to be deleted can be specified (e.g., xxx). The event listening module determines that an existing account is being deleted, iterates through all connected platforms, triggers the platform adapter module to delete the corresponding role permissions (e.g., calling an API to remove permissions, or removing group members), and then pushes the request to the permission management module to execute the account deletion. The entire process is executed independently to ensure no residual permissions remain and to record audit logs.

[0086] The technical solution of this invention, upon detecting an account authorization request, identifies the account to be authorized recorded in the authorization request work order and determines the enterprise identification relationship of the account requesting authorization. It then determines the authorization operation method recorded in the enterprise identification relationship and matches the corresponding security policy according to the authorization operation method to verify the account authorization request based on the security policy. If the verification passes, it performs an authorization operation on the account to be authorized based on the method of calling the application programming interface (API) and / or the method of authorization based on a pre-configured security group, obtaining the corresponding API return code and / or group addition result, and responds to the account authorization request based on the API return code and / or group addition result. By approving and verifying the account to be authorized based on the enterprise identification relationship and performing the authorization operation using the corresponding authorization operation method, more efficient, secure, and accurate account management can be achieved.

[0087] Example 2

[0088] Figure 2 This is a structural block diagram of an account management device provided in an embodiment of the present invention. This embodiment is applicable to the management of user accounts on multi-regional heterogeneous cloud platforms based on work order-driven methods. The account management device provided by the present invention can execute the account management method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. The account management device can be implemented in hardware and / or software and configured in an electronic device with account management function, such as... Figure 2 As shown, the account management device may specifically include:

[0089] The determination module 201 is used to determine the account to be authorized recorded in the authorization request work order and determine the enterprise identification relationship of the account to be authorized if an account authorization request is detected.

[0090] Verification module 202 is used to determine the authorization operation method recorded in the enterprise identification relationship, and match the corresponding security policy according to the authorization operation method, so as to verify the account authorization request according to the security policy; the authorization operation method includes authorization by calling the application programming interface and / or authorization based on a pre-configured security group;

[0091] The authorization module 203 is used to, if the verification passes, perform an authorization operation on the account to be authorized by calling the application interface, obtain the interface return code, and respond to the account authorization request based on the interface return code; or

[0092] Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, the group is added, and the account authorization request is responded to based on the group addition result; or

[0093] Authorization is performed on the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method. The API return code and group addition result are obtained, and the account authorization request is responded to based on the API return code and group addition result.

[0094] The technical solution of this invention, upon detecting an account authorization request, identifies the account to be authorized recorded in the authorization request work order and determines the enterprise identification relationship requested by the account to be authorized; it determines the authorization operation method recorded in the enterprise identification relationship and matches the corresponding security policy according to the authorization operation method to verify the account authorization request based on the security policy; if the verification is successful, it performs an authorization operation on the account to be authorized based on the method of calling the application interface for authorization and / or based on the method of pre-configured security group authorization, obtains the corresponding interface return code and / or group addition result, and responds to the account authorization request based on the interface return code and / or group addition result. This technical solution allows for approval and verification based on enterprise identification relationships and authorization operations using corresponding authorization operation methods, achieving more efficient, secure, and accurate account management.

[0095] Furthermore, the enterprise identification relationship includes at least one of the following: data center, network area, target platform, platform type, authorized role, and authorized operation method;

[0096] Verification module 202 is specifically used for:

[0097] If the authorization operation method in the enterprise identification relationship is to authorize by calling the application interface, then the security policy is either the independent security policy of zone authorization or the logical security policy of role permissions.

[0098] If the authorization operation method in the enterprise identification relationship is based on pre-configured security group authorization, then the security policy is either the regional isolation policy after the group is added or the platform requirement policy of the pre-configured security group.

[0099] Furthermore, the authorization module 203 is specifically used for:

[0100] Based on the unauthorized account and target platform in the enterprise identification relationship, determine the platform area adapter and target interface of the target platform;

[0101] The platform area adapter of the target platform calls the target interface to perform the account creation operation, and associates the account to be authorized with the authorized role on the target platform to synchronize platform permissions and complete the account authorization operation.

[0102] Furthermore, the authorization module 203 is specifically used for:

[0103] Based on the instruction information in the enterprise identification relationship, an instruction package is generated and sent to the permission management module to instruct the permission management module to add the account to be authorized to the pre-configured security group;

[0104] Based on the instructions of the account to be authorized, the target platform associates the user group corresponding to the authorized role, synchronizes platform permissions, and completes the account authorization operation.

[0105] Furthermore, the authorization module 203 is specifically used for:

[0106] Identify the target platform recorded in the enterprise identification relationship and determine the compatibility type of the target platform; the compatibility type is either supporting application programming interface (API) authorization or not supporting API authorization.

[0107] Based on the compatibility type of the target platform, determine the authorization operation method for each target platform to complete the account authorization operation.

[0108] Furthermore, the above-mentioned device is also used for:

[0109] In response to an account change request, perform the account change operation by calling the application programming interface and / or based on a pre-configured security group;

[0110] In response to an account deletion request, perform the account deletion operation by calling the application programming interface and / or based on a pre-configured security group.

[0111] Furthermore, the above-mentioned device is also used for:

[0112] The work order approval system approves the authorization request work orders and, if the approval is successful, determines the authorization operation method recorded in the enterprise identification relationship.

[0113] Example 3

[0114] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Figure 3A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0115] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory 12 or a random access memory 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 12 or loaded from storage unit 18 into the random access memory 13. The random access memory 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, read-only memory 12, and random access memory 13 are interconnected via a bus 14. An input / output interface 15 is also connected to the bus 14.

[0116] Multiple components in electronic device 10 are connected to input / output 15, including: input unit 16, such as a keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as a disk, optical disk, etc.; and communication unit 19, such as a network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0117] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as account management methods.

[0118] In some embodiments, the account management method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via read-only memory 12 and / or communication unit 19. When the computer program is loaded into random access memory 13 and executed by processor 11, one or more steps of the account management method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the account management method by any other suitable means (e.g., by means of firmware).

[0119] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), system-on-a-chip (SoCs), complex programmable logic devices (PLCs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0121] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (e.g., voice input, speech input, or tactile input).

[0123] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0124] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system to address the shortcomings of traditional physical hosts and virtual reality services, such as high management difficulty and weak business scalability.

[0125] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the account management method of any embodiment of the present invention.

[0126] In the implementation of a computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​as well as conventional procedural programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0127] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0128] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An account management method, characterized in that, include: If an account authorization request is detected, the account to be authorized recorded in the authorization request work order is identified, and the enterprise identification relationship of the account to be authorized is determined; wherein, the enterprise identification relationship is an association relationship that represents the role-region-platform correspondence of the account to be authorized; The authorization operation method recorded in the enterprise identification relationship is determined, and the corresponding security policy is matched according to the authorization operation method to verify the account authorization request according to the security policy; the authorization operation method includes authorization by calling the application interface and / or authorization based on the pre-configured security group; wherein, authorization by calling the application interface is operated on the target platform, and authorization based on the pre-configured security group is operated on the permission management authentication source; If the verification passes, the authorization operation is performed on the account to be authorized by calling the application interface authorization method to obtain the interface return code, and the account authorization request is responded to based on the interface return code; or Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, the group is added, and the account authorization request is responded to based on the group addition result; or Authorization is performed on the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method. The API return code and group addition result are obtained, and the account authorization request is responded to based on the API return code and group addition result. The authorization operations for the accounts to be authorized, based on the application programming interface (API) authorization method and the pre-configured security group authorization method, include: Identify the target platform recorded in the enterprise identification relationship and determine the compatibility type of the target platform; the compatibility type is either supporting application programming interface (API) authorization or not supporting API authorization. Based on the compatibility type of the target platform, determine the authorization operation method for each target platform to complete the account authorization operation.

2. The method according to claim 1, characterized in that, in, The enterprise identification relationship includes at least one of the following: data center, network zone, target platform, platform type, authorized role, and authorized operation method; Accordingly, the corresponding security policy is matched based on the authorized operation method, including: If the authorization operation method is to authorize by calling the application interface, then the security policy is either the independent security policy of zone authorization or the logical security policy of role permissions. If the authorization method is based on pre-configured security group authorization, the security policy is either the regional isolation policy after the group is added or the platform requirement policy of the pre-configured security group.

3. The method according to claim 1, characterized in that, Authorization operations are performed on the account to be authorized based on the method of calling the application programming interface (API), including: Based on the unauthorized account and target platform in the enterprise identification relationship, determine the platform area adapter and target interface of the target platform; The platform area adapter of the target platform calls the target interface to perform the account creation operation, and associates the account to be authorized with the authorized role on the target platform to synchronize platform permissions and complete the account authorization operation.

4. The method according to claim 1, characterized in that, Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, including: Based on the instruction information in the enterprise identification relationship, an instruction package is generated and sent to the permission management module to instruct the permission management module to add the account to be authorized to the pre-configured security group; Based on the instructions of the account to be authorized, the target platform associates the user group corresponding to the authorized role, synchronizes platform permissions, and completes the account authorization operation.

5. The method according to claim 1, characterized in that, After responding to the account authorization request, it also includes: In response to an account change request, perform the account change operation by calling the application programming interface and / or based on a pre-configured security group; In response to an account deletion request, perform the account deletion operation by calling the application programming interface and / or based on a pre-configured security group.

6. The method according to claim 1, characterized in that, After determining the enterprise identification relationship of the account requesting authorization, the process also includes: The work order approval system approves the authorization request work orders and, if the approval is successful, determines the authorization operation method recorded in the enterprise identification relationship.

7. An account management device, characterized in that, include: The determination module is used to determine the account to be authorized recorded in the authorization request work order if an account authorization request is detected, and to determine the enterprise identification relationship of the authorization request of the account to be authorized; wherein, the enterprise identification relationship is an association relationship that represents the role-region-platform correspondence of the account to be authorized; The verification module is used to determine the authorization operation method recorded in the enterprise identification relationship, and match the corresponding security policy according to the authorization operation method to verify the account authorization request according to the security policy; the authorization operation method includes authorization by calling the application interface and / or authorization based on the pre-configured security group; wherein, authorization by calling the application interface is operated on the target platform, and authorization based on the pre-configured security group is operated on the permission management authentication source; The authorization module, if verification passes, performs an authorization operation on the account to be authorized by calling the application's API, obtains the API return code, and responds to the account authorization request based on the API return code; or Based on pre-configured security group authorization, the authorization operation is performed on the account to be authorized, the group is added, and the account authorization request is responded to based on the group addition result; or Authorization is performed on the account to be authorized based on either the application programming interface (API) authorization method or the pre-configured security group authorization method. The API return code and group addition result are obtained, and the account authorization request is responded to based on the API return code and group addition result. The authorization module is specifically used for: Identify the target platform recorded in the enterprise identification relationship and determine the compatibility type of the target platform; the compatibility type is either supporting application programming interface (API) authorization or not supporting API authorization. Based on the compatibility type of the target platform, determine the authorization operation method for each target platform to complete the account authorization operation.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor, such that the at least one processor is able to perform the account management method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the account management method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the account management method according to any one of claims 1-6.

Images