Multi-tenant RBAC permission inheritance management method and system
By automating role classification and permission inheritance management, the problem of inconsistent permission configurations in multi-tenant systems is solved, achieving efficient and secure permission management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-03-27
AI Technical Summary
In traditional multi-tenant systems, permissions cannot be inherited, leading to increased permission management burden, inconsistent configurations, and impacts on security and efficiency.
By analyzing the tenant role table, roles with the same job title are automatically categorized, role groups and levels are determined based on role information, permission sets are inherited, permission changes are monitored and updated in real time, and user permission subsets are merged.
It reduces the configuration burden on administrators, improves the efficiency and consistency of permission management, supports high-concurrency access, ensures security and flexibility, and reduces operation and maintenance costs.
Smart Images
Figure CN121744355A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of access control technology, and in particular to a multi-tenant RBAC access control inheritance management method and system. Background Technology
[0002] With the evolution of cloud computing technology, multi-tenant platforms have become a core infrastructure for enterprise IT infrastructure, and their user management and access control mechanisms are crucial for ensuring the platform's secure and stable operation. In traditional multi-tenant systems, permissions are typically configured independently for each tenant, meaning each user is assigned access privileges separately. Since permissions cannot be inherited, as the user base expands and organizational structures become more complex, this approach not only significantly increases the burden of access control and reduces its efficiency, but also easily leads to inconsistencies or omissions in permission configurations, severely impacting consistency and security. Summary of the Invention
[0003] To address the aforementioned technical problems, this invention provides a multi-tenant RBAC permission inheritance management method and system, comprising: Retrieve the role information of each role in the role table of each tenant, and classify each role based on the role information to obtain multiple role groups; Determine the permissions of each ancestor role in each role group, and inherit and aggregate the permissions of each role's ancestor role to obtain the inherited permission set of the role group; Based on the role information, the role level is determined, and based on the role level, the scope of permission usage for each role in the inherited permission set of the corresponding role group is determined, thus obtaining a permission subset; Detect permission changes of the ancestor roles of each role in each role group, and update the permission subset of each role based on the permission changes to obtain the updated permission subset; Determine the user's tenant and role information, and based on the user's tenant and role information, determine the role group and role level corresponding to the user's role information; The user's update permission subset is determined based on the role group and role level, and then merged with the preset permissions to obtain the user's real-time permissions.
[0004] Furthermore, the step involves obtaining the role information of each role in the role table of each tenant, and classifying each role based on the role information to obtain multiple role groups, including: Obtain the role table for each tenant and determine the role information for each role in the role table; Based on the role information, the role position of each role is determined, and the roles are categorized based on the role position to obtain multiple role groups.
[0005] Furthermore, the step of determining the permissions of each ancestor role corresponding to each role in each role group, and inheriting and aggregating the permissions of each role corresponding to its ancestor role to obtain the inherited permission set of the role group includes: The ancestor roles of each role in each role group are determined by searching, and the permissions of the ancestor roles are also determined. Each role inherits the permissions of its ancestor role, and the inherited permissions are then aggregated to obtain the inherited permission set for the role group.
[0006] Furthermore, determining the role level based on role information includes: Determine the class of each character from the character information, and determine the depth of each character to their corresponding ancestor character; Determine a pre-set baseline depth, calculate the difference between the depth of each character to its corresponding ancestor character and the baseline depth, evaluate the difference, and obtain the depth evaluation value for each character. The role level of each role is calculated based on the role rank and depth assessment value.
[0007] Furthermore, the formula for calculating the character's level is as follows: L=k*p*z, Where L is the character's level, k is the preset level conversion coefficient, p is the character's depth evaluation value, and z is the character's depth evaluation value.
[0008] Furthermore, the process of determining the scope of permissions for each role within the inherited permission set of the corresponding role group based on role level yields a permission subset, including: A preset permission usage scope - character level range mapping table is set up. For each character level range, the preset permission usage scope is associated with a corresponding preset permission usage scope. Obtain the character level of each character, and based on the mapping relationship between the character level range to which the character level belongs and the preset permission usage range-character level range mapping table, select the preset permission usage range corresponding to the character level range to determine the permission usage range of each character in the inherited permission set of the corresponding character group; The inherited permission set is divided based on the scope of permission usage to obtain the permission subset for each role.
[0009] Furthermore, the step of detecting permission changes of the ancestor roles corresponding to each role in each role group, and updating the permission subset of each role based on the permission changes to obtain the updated permission subset, includes: Detect permission changes of the ancestor roles corresponding to each role in each role group, and after determining the permission changes of the ancestor roles, update the permission subset of the corresponding roles in the role group to obtain the updated permission subset.
[0010] Furthermore, determining the user's tenant and role information, and determining the role group and role level corresponding to the user's role information based on the user's tenant and role information, includes: The user's tenant is determined based on the tenant table, and the user's role information is also determined. Based on the tenant, determine the multiple role groups corresponding to the tenant, and based on the role information, determine the role group corresponding to the user from the multiple role groups; Determine the multiple role levels corresponding to the role group, and determine the user's corresponding role level from the multiple role levels based on the role information.
[0011] Furthermore, the step of determining a subset of user update permissions based on role groups and role levels, and merging this subset with preset permissions to obtain the user's real-time permissions, includes: Determine the subset of update permissions corresponding to the user's role level, and determine the user's preset permissions; The user's update permission subset is merged with the preset permissions to obtain the user's real-time permissions.
[0012] This invention also provides a multi-tenant RBAC permission inheritance management system, comprising: The acquisition module is used to retrieve the role information of each role in the role table of each tenant, and classify each role based on the role information to obtain multiple role groups; The inheritance module is used to determine the permissions of the ancestor roles of each role in each role group, and to inherit and aggregate the permissions of the ancestor roles of each role to obtain the inherited permission set of the role group. The partitioning module is used to determine the role level based on role information, and to determine the scope of permission usage for each role in the inherited permission set of the corresponding role group based on the role level, thus obtaining a permission subset; The update module is used to detect permission changes of the ancestor roles of each role in each role group, and update the permission subset of each role based on the permission changes to obtain the updated permission subset. The determination module is used to determine the user's tenant and role information, and to determine the role group and role level corresponding to the user's role information based on the user's tenant and role information; The management module is used to determine a subset of user update permissions based on role groups and role levels, and then merge the user's update permission subset with preset permissions to obtain the user's real-time permissions.
[0013] Compared with the prior art, the multi-tenant RBAC permission inheritance management method and system of this invention have the following advantages: This invention analyzes the role attribute information in each tenant's role table and automatically groups roles with the same position into the same role group, greatly reducing the manual configuration burden on administrators and laying the foundation for subsequent batch permission operations. This invention ensures high performance of permission parsing by pre-compiling permission sets based on inheritance relationships. It pre-computes the permission sets of all roles and their ancestor roles contained in each role group, forming the "inherited permission set" of the group. This transforms complex runtime recursive queries into simple static data retrieval, fundamentally solving the performance bottleneck that may occur during permission verification and perfectly supporting high-concurrency access scenarios. This invention introduces role-level-based permission scope control, realizing refined management that separates the "capability" and "right" of permissions. It not only determines whether a user "possesses" a certain permission, but also determines whether the user "is allowed to use" that permission based on their role level. For example, even if a lower-level role inherits a higher-level permission, it will be automatically filtered by the system because the level is insufficient, effectively following the principle of least privilege and greatly improving the security of the system. This invention can automatically and accurately locate all affected downstream role groups and users by monitoring changes in role permissions and inheritance relationships, and asynchronously trigger updates to their "inherited permission sets" and "permission subsets". This ensures that any adjustment to permission policies takes effect globally within seconds, while avoiding performance impact on real-time system services during the update process. After determining the "update permission subset" obtained by a user through role group and level filtering, this invention merges it with the user's "preset permissions". It can simultaneously support rule-based permission allocation based on the organization and exception-based permission adjustment for specific users, meeting the needs of standardized management while retaining the flexibility to deal with special situations. In summary, this invention successfully constructs a multi-tenant permission management core that integrates automation, precision, high performance, high security, and high flexibility. It simplifies the permission inheritance and allocation process, supports batch operation of user permissions, and significantly improves management efficiency and consistency. It not only greatly reduces operation and maintenance costs but also provides powerful and reliable access control guarantees for complex and ever-changing enterprise business scenarios. Attached Figure Description
[0014] Figure 1 This is a schematic diagram of the process structure of the multi-tenant RBAC permission inheritance management method in an embodiment of the present invention; Figure 2 This is a schematic diagram of the composition of the multi-tenant RBAC permission inheritance management system in an embodiment of the present invention. Detailed Implementation
[0015] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the invention.
[0016] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the platform or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.
[0017] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.
[0018] like Figure 1 As shown in the embodiments of this application, a multi-tenant RBAC permission inheritance management method is provided, including: S100: obtaining the role information of each role in the role table of each tenant, and classifying each role based on the role information to obtain multiple role groups; S200: determining the permissions of the ancestor roles corresponding to each role in each role group, and inheriting and aggregating the permissions of the ancestor roles corresponding to each role to obtain the inherited permission set of the role group; S300: determining the role level based on the role information, and determining the scope of permission usage of each role in the inherited permission set of the corresponding role group based on the role level to obtain a permission subset; S400: detecting permission changes of the ancestor roles corresponding to each role in each role group, and updating the permission subset of each role based on the permission changes to obtain an updated permission subset; S500: determining the tenant and role information of the user, and determining the role group and role level corresponding to the user's role information based on the tenant and role information of the user; S600: determining the updated permission subset of the user based on the role group and role level, and merging the updated permission subset of the user with preset permissions to obtain the user's real-time permissions.
[0019] Furthermore, this invention analyzes the role attribute information in each tenant's role table, automatically grouping roles with the same position into the same role group, greatly reducing the manual configuration burden on administrators and laying the foundation for subsequent batch permission operations. This invention ensures high-performance permission parsing through pre-calculation of permission sets based on inheritance relationships. It pre-calculates the permission sets of all roles and their ancestor roles within each role group, forming the group's "inherited permission set," transforming complex runtime recursive queries into simple static data retrieval. This fundamentally solves the performance bottleneck that may occur during permission verification and perfectly supports high-concurrency access scenarios. This invention introduces permission scope control based on role levels, achieving refined management that separates the "capability" and "right" of permissions. It not only determines whether a user "possesses" a certain permission but also determines whether they are "permitted" to use that permission based on their role level. For example, even if a lower-level role inherits a higher-level permission, it will be automatically filtered out by the system due to insufficient level, effectively adhering to the principle of least privilege and greatly improving system security. This invention offers several advantages. First, by monitoring changes in role permissions and inheritance relationships, it can automatically and accurately pinpoint all affected downstream role groups and users, asynchronously triggering updates to their "inherited permission sets" and "permission subsets." This ensures that any adjustment to permission policies takes effect globally within seconds, while avoiding performance impacts on real-time system services during the update process. Second, after determining the "updated permission subset" obtained by filtering by role group and level, this invention merges it with the user's "preset permissions," simultaneously supporting rule-based permission allocation based on the organization and exceptional permission adjustments for specific users. This meets standardized management needs while retaining flexibility to handle special situations. In summary, this invention successfully constructs a multi-tenant permission management core that integrates automation, fine-grained management, high performance, high security, and high flexibility. It simplifies the permission inheritance and allocation process, supports batch operation of user permissions, significantly improves management efficiency and consistency, greatly reduces operation and maintenance costs, and provides powerful and reliable access control guarantees for complex and ever-changing enterprise business scenarios.
[0020] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided. The method involves obtaining the role information of each role in the role table of each tenant and classifying each role based on the role information to obtain multiple role groups. The method includes: obtaining the role table of each tenant and determining the role information of each role in the role table; determining the role position of each role based on the role information; and classifying each role based on the role position to obtain multiple role groups.
[0021] Specifically, the system obtains an independent role table for each tenant and parses the detailed information of each role. Based on this role information, a machine learning model automatically determines the functional positioning of each role, i.e., "role position." For example, by parsing the role name and permission set, different job types such as "financial approver," "project administrator," and "data viewer" can be identified. Roles are then automatically categorized according to their identified positions to form logical role groups. For instance, all positions related to "finance" are categorized into the "finance role group," including roles such as "expense auditor" and "financial manager." Roles related to "project management" are categorized into the "project role group." This step standardizes and automates role management, significantly reducing errors and inconsistencies caused by manual configuration in a multi-tenant environment. The role groups, formed by job categorization, lay the foundation for subsequent batch operations and inheritance control of permissions, greatly improving the efficiency of permission allocation and maintenance. The abstraction of role groups enhances the system's scalability; when a new role is added, it can be automatically assigned to the corresponding group, ensuring the continuous consistency of the permission system. This strengthens the permission governance capabilities under a multi-tenant architecture, balancing flexibility and security, and providing an efficient and reliable solution for permission management in large-scale, complex organizations.
[0022] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided. The method involves determining the permissions of the ancestor roles corresponding to each role in each role group, and inheriting and aggregating the permissions of the ancestor roles corresponding to each role to obtain the inherited permission set of the role group. This includes: determining the ancestor roles corresponding to each role in each role group by searching and determining the permissions of the ancestor roles; inheriting the permissions of the ancestor roles corresponding to each role, and aggregating the inherited permissions to obtain the inherited permission set of the role group.
[0023] Specifically, the process involves searching to determine all ancestor roles for each role within a role group. For each role in a role group, the process recursively traverses the role inheritance tree upwards or uses a pre-established inheritance closure table to query all its parent roles, grandparent roles, and even the root role, thus determining the complete set of ancestor roles. The permissions directly assigned to these ancestor roles are then obtained, and through a permission inheritance mechanism, these permissions are passed down layer by layer. In addition to its own permissions, each role also inherits the permissions of all its ancestor roles. Furthermore, the permissions possessed by all roles within the group (including the permissions they inherit) are merged and deduplicated to finally generate the "inherited permission set" corresponding to the role group. This permission set represents the maximum range of permissions that the role group can possess. This step enables automated aggregation and redundancy control of permissions, significantly reducing the complexity and error probability of manual configuration and improving the efficiency and consistency of permission management. Inherited permission integration provides a unified view for cross-role permission allocation and revocation, supporting more efficient security policy auditing and compliance checks. Inherited permission sets can serve as the basis for permission optimization, helping to identify redundant or conflicting permission settings. This mechanism lays a reliable foundation for batch operations of permissions at the role group level and the implementation of dynamic permission policies, enhancing the scalability and maintainability of permission management in multi-tenant systems.
[0024] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided. The step of determining the role level based on role information includes: determining the role level of each role from the role information and determining the depth of each role to its corresponding ancestor role; determining a pre-set baseline depth, calculating the difference between the depth of each role to its corresponding ancestor role and the baseline depth, and evaluating the difference to obtain the depth evaluation value of each role; and calculating the role level of each role based on the role level and the depth evaluation value of each role.
[0025] Specifically, a clear "role rank" attribute (such as "Level 1", "Level 2", "Level 3", etc.) is extracted from the role information. At the same time, by traversing the role inheritance tree, the hierarchical distance from each role to each of its ancestor roles, i.e., "depth", is calculated. A "baseline depth" is pre-set (usually based on the root role depth or the organization's average depth). The difference between the actual depth of each role and the base depth is then calculated, and this difference is standardized to obtain an objective "depth assessment value". The role's rank information (representing its functional weight) and the depth assessment value (representing its positional influence in the inheritance structure) are calculated to finally generate a comprehensive and reasonable "role level". This level reflects both the role's functional importance within the organization and incorporates its topological relationship in the authority inheritance chain, thus forming a multi-dimensional level assessment result. This step automates and automates role level determination, reducing reliance on human experience and improving the objectivity and consistency of assessment results. By integrating both job level and depth factors, role levels more accurately reflect the actual scope of authority and business importance, providing a reliable basis for subsequent refined permission allocation. The depth assessment based on differences effectively eliminates biases caused by differences in the depth of different inheritance subtrees, enhancing the comparability of role levels across branches. This mechanism supports the dynamic adaptation and optimization of permission policies, providing a more scientific, flexible, and scalable permission governance foundation for multi-tenant systems.
[0026] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided, wherein the calculation formula for the role level is: L=k*p*z, Where L is the character's level, k is the preset level conversion coefficient, p is the character's depth evaluation value, and z is the character's depth evaluation value.
[0027] In embodiments of this application, a multi-tenant RBAC permission inheritance management method is provided. The method involves determining the permission usage scope of each role within the inherited permission set of the corresponding role group based on role level, thereby obtaining a permission subset. This includes: pre-setting a preset permission usage scope-role level interval mapping table, where each role level interval is associated with a corresponding preset permission usage scope; obtaining the role level of each role, and based on the mapping relationship between the role level interval to which the role level belongs and the preset permission usage scope-role level interval mapping table, selecting the preset permission usage scope corresponding to the role level interval as the permission usage scope of each role within the inherited permission set of the corresponding role group; and dividing the inherited permission set based on the permission usage scope to obtain a permission subset for each role.
[0028] Specifically, an automated and hierarchical control of permissions is achieved by introducing a "preset permission usage scope - role level range mapping table." This mapping table predefines different role level ranges (e.g., levels 1-3 are primary, levels 4-6 are intermediate, and levels 7-9 are advanced) and their corresponding permission usage scopes (e.g., "data for myself only," "data within my department," and "data for the entire company"). The specific level value of each role is obtained, and the corresponding preset permission usage scope is matched in the mapping table according to its level range. Based on this scope, the complete permission set that the role has inherited (inherited permission set) is dynamically divided and filtered, and finally a "permission subset" containing only the actual operable permissions of the role is generated. This step enables fine-grained management of permission allocation, ensuring that even if roles at different levels inherit the same permission set, their actual operational scope is still constrained by their level, effectively implementing the principle of least privilege. Through a configurable mapping table, the correspondence between permission scope and level can be flexibly defined, adapting to adjustments in organizational structure or permission policies without code modification. It significantly improves the efficiency and consistency of permission management, reducing the risk of errors or permission abuse caused by manual configuration. It provides a highly scalable, maintainable, and more secure permission governance solution for multi-tenant systems, supporting dynamic permission control needs in complex business scenarios.
[0029] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided. The step of detecting permission changes of the ancestor roles corresponding to each role in each role group and updating the permission subset of each role based on the permission changes to obtain an updated permission subset includes: detecting permission changes of the ancestor roles corresponding to each role in each role group, and after determining the permission changes of the ancestor roles, updating the permission subset of the corresponding roles in the role group to obtain an updated permission subset.
[0030] Specifically, through continuous monitoring or periodic scanning mechanisms, the system detects in real time whether there have been any permission changes (such as the addition, deletion, or modification of permissions) to the ancestral roles corresponding to each role within each role group. Once a permission change is detected for an ancestral role, the permission update process is immediately triggered: First, all descendant roles affected by this change are accurately located, and then the effective permission range of these roles is dynamically recalculated according to their respective role groups and preset permission inheritance rules. Based on the latest ancestral permission set and the level attributes of each role, the original permission subset is automatically reconstructed and updated, ultimately generating an "updated permission subset" that is completely synchronized with the current permission inheritance state. This step ensures the real-time nature and consistency of permission changes, automatically and accurately propagating ancestor-level permission adjustments to all affected descendant roles, completely avoiding security vulnerabilities or permission mismatches caused by delayed or missed manual updates. Through precise impact scope analysis and targeted updates, unnecessary global calculations are greatly reduced, significantly improving the efficiency of permission synchronization and system performance. This mechanism strengthens autonomy, reduces the need for operational intervention, and enables permission management to maintain high reliability and maintainability in complex multi-tenant environments. It provides robust technical support for permission governance in dynamic business environments, effectively ensuring the continuous and accurate implementation of system security policies.
[0031] In embodiments of this application, a multi-tenant RBAC permission inheritance management method is provided. The step of determining the user's tenant and role information, and determining the role group and role level corresponding to the user's role information based on the user's tenant and role information, includes: determining the user's tenant based on a tenant table, and determining the user's role information; determining multiple role groups corresponding to the tenant based on the tenant, and determining the user's role group from the multiple role groups based on the role information; determining multiple role levels corresponding to the role group, and determining the user's role level from the multiple role levels based on the role information.
[0032] Specifically, by querying the relationship between users and tenants, the system accurately locates the tenant to which a user belongs and obtains the user's role information. Based on the identified tenant identifier, it retrieves all pre-defined role groups under that tenant and, according to the user's role information, locates the specific role group directly corresponding to the user by matching the role group and the role's affiliation. It identifies the multi-level role hierarchy defined within that role group and, based on the level attributes (such as role rank, depth evaluation value, etc.) contained in the user's role information, accurately determines the user's corresponding role level from multiple levels. This step achieves a multi-layered and precise mapping of users, tenants, role groups, and role levels, ensuring the accuracy and consistency of the permission calculation foundation. Through automated matching and determination mechanisms, it can efficiently handle the attribution of massive amounts of user permissions, significantly reducing the workload and error risk of manual configuration. The hierarchical management of role groups and the fine-grained distinction of role levels provide a structured control foundation for subsequent dynamic permission allocation and real-time permission updates. This mechanism enhances the adaptability of multi-tenant systems, supports complex and dynamically changing business scenarios, and significantly improves the scalability and operational efficiency of permission management while ensuring security.
[0033] In an embodiment of this application, a multi-tenant RBAC permission inheritance management method is provided. The step of determining a subset of user update permissions based on role groups and role levels, and merging the subset of user update permissions with preset permissions to obtain the user's real-time permissions, includes: determining the subset of update permissions corresponding to the user's role level, and determining the user's preset permissions; merging the subset of user update permissions with preset permissions to obtain the user's real-time permissions.
[0034] Specifically, based on the user's determined role level, a corresponding "updated permission subset" is extracted from their role group. This subset dynamically integrates the latest permission inheritance results from ancestor roles and is filtered according to role level rules. "Preset permissions" configured specifically for the user are then obtained; these permissions are typically used to handle exceptional scenarios or meet personalized access needs. The "updated permission subset" and "preset permissions" are integrated using a permission merging algorithm (such as a union operation) to ultimately generate the user's currently effective "real-time permissions." This step achieves an organic unity between standardized and personalized permissions, ensuring consistency in role-inherited permissions while retaining the flexibility to adjust for specific users. By dynamically integrating the latest inheritance results with static preset permissions, the real-time and accurate allocation of permissions is ensured, effectively avoiding access conflicts or security vulnerabilities caused by delayed permissions. The merging process employs efficient set operations, guaranteeing permission calculation performance and enabling rapid response to permission query requests even in environments with massive user volumes. This mechanism provides the system with fine-grained, adaptive, and highly reliable permission control capabilities, significantly enhancing the accuracy of permission management and user experience in multi-tenant environments.
[0035] like Figure 2 As shown in the embodiments of this application, a multi-tenant RBAC permission inheritance management system is provided, including: an acquisition module, used to acquire role information of each role in the role table of each tenant, and classify each role based on the role information to obtain multiple role groups; an inheritance module, used to determine the permissions of the ancestor roles corresponding to each role in each role group, and inherit and aggregate the permissions of the ancestor roles corresponding to each role to obtain the inherited permission set of the role group; a partitioning module, used to determine the role level based on the role information, and determine the scope of permission use of each role in the inherited permission set of the corresponding role group based on the role level to obtain a permission subset; an update module, used to detect permission changes of the ancestor roles corresponding to each role in each role group, and update the permission subset of each role based on the permission changes to obtain an updated permission subset; a determination module, used to determine the tenant and role information of the user, and determine the role group and role level corresponding to the user's role information based on the tenant and role information of the user; and a management module, used to determine the updated permission subset of the user based on the role group and role level, and merge the updated permission subset of the user with preset permissions to obtain the user's real-time permissions.
[0036] In summary, this invention provides a multi-tenant RBAC permission inheritance management method and system, comprising: obtaining role information of each role in the role table of each tenant, and classifying them into multiple role groups; determining the permissions of the ancestor roles corresponding to each role in each role group, and inheriting and aggregating them to obtain the inherited permission set of the role group; determining the role level based on the role information, and determining the permission usage scope of each role based on it to obtain a permission subset; detecting permission changes of ancestor roles, and updating the permission subsets of each role based on them to obtain an updated permission subset; determining the tenant and role information of the user, and determining the role group and role level corresponding to the user's role information based on it; determining the updated permission subset of the user based on the role group and role level, and merging it with preset permissions to obtain the user's real-time permissions. This invention simplifies the permission inheritance and allocation process, supports batch operation of user permissions, and significantly improves management efficiency and consistency.
[0037] Finally, it should be noted that those skilled in the art can obviously make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.
[0038] The above description is merely one embodiment of the present invention, and should not be construed as limiting the scope of the invention. Any structural changes made based on the present invention, as long as they do not depart from the essence of the invention, should be considered as falling within the protection scope of the present invention and subject to its restrictions. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the platform described above can be referred to the corresponding processes in the foregoing platform embodiments, and will not be repeated here.
[0039] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, platform, article, or device / platform that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to those processes, platforms, articles, or devices / platforms.
[0040] The technical solutions of the present invention have been described in conjunction with the accompanying drawings and further embodiments. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to closely related technical features, and the technical solutions resulting from such changes or substitutions will all fall within the scope of protection of the present invention.
[0041] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.
Claims
1. A multi-tenant RBAC permission inheritance management method, characterized in that, include: Retrieve the role information of each role in the role table of each tenant, and classify each role based on the role information to obtain multiple role groups; Determine the permissions of each ancestor role in each role group, and inherit and aggregate the permissions of each role's ancestor role to obtain the inherited permission set of the role group; Based on the role information, the role level is determined, and based on the role level, the scope of permission usage for each role in the inherited permission set of the corresponding role group is determined, thus obtaining a permission subset; Detect permission changes of the ancestor roles of each role in each role group, and update the permission subset of each role based on the permission changes to obtain the updated permission subset; Determine the user's tenant and role information, and based on the user's tenant and role information, determine the role group and role level corresponding to the user's role information; The user's update permission subset is determined based on the role group and role level, and then merged with the preset permissions to obtain the user's real-time permissions.
2. A multi-tenant RBAC permission inheritance management method according to claim 1, characterized in that, The process involves obtaining the role information of each role in each tenant's role table, and classifying each role based on the role information to obtain multiple role groups, including: Obtain the role table for each tenant and determine the role information for each role in the role table; Based on the role information, the role position of each role is determined, and the roles are categorized based on the role position to obtain multiple role groups.
3. A multi-tenant RBAC permission inheritance management method according to claim condition 2, characterized in that, The process involves determining the permissions of each ancestor role within each role group, inheriting and aggregating the permissions of each role's ancestor role to obtain the inherited permission set for the role group, including: The ancestor roles of each role in each role group are determined by searching, and the permissions of the ancestor roles are also determined. Each role inherits the permissions of its ancestor role, and the inherited permissions are then aggregated to obtain the inherited permission set for the role group.
4. A multi-tenant RBAC permission inheritance management method according to claim 3, characterized in that, The determination of role level based on role information includes: Determine the class of each character from the character information, and determine the depth of each character to their corresponding ancestor character; Determine a pre-set baseline depth, calculate the difference between the depth of each character to its corresponding ancestor character and the baseline depth, evaluate the difference, and obtain the depth evaluation value for each character. The role level of each role is calculated based on the role rank and depth assessment value.
5. A multi-tenant RBAC permission inheritance management method according to claim 4, characterized in that, The formula for calculating the character's level is as follows: L=k*p*z, Where L is the character's level, k is the preset level conversion coefficient, p is the character's depth evaluation value, and z is the character's depth evaluation value.
6. A multi-tenant RBAC permission inheritance management method according to claim 4, characterized in that, The process of determining the scope of permissions for each role within the inherited permission set of the corresponding role group based on role level yields a permission subset, including: A preset permission usage scope - character level range mapping table is set up. For each character level range, the preset permission usage scope is associated with a corresponding preset permission usage scope. Obtain the character level of each character, and based on the mapping relationship between the character level range to which the character level belongs and the preset permission usage range-character level range mapping table, select the preset permission usage range corresponding to the character level range to determine the permission usage range of each character in the inherited permission set of the corresponding character group; The inherited permission set is divided based on the scope of permission usage to obtain the permission subset for each role.
7. A multi-tenant RBAC permission inheritance management method according to claim 6, characterized in that, The process involves detecting permission changes of the ancestor roles corresponding to each role in each role group, and updating the permission subset of each role based on these changes to obtain an updated permission subset, including: Detect permission changes of the ancestor roles corresponding to each role in each role group, and after determining the permission changes of the ancestor roles, update the permission subset of the corresponding roles in the role group to obtain the updated permission subset.
8. A multi-tenant RBAC permission inheritance management method according to claim 7, characterized in that, The process of determining the user's tenant and role information, and determining the role group and role level corresponding to the user's role information based on the user's tenant and role information, includes: The user's tenant is determined based on the tenant table, and the user's role information is also determined. Based on the tenant, determine the multiple role groups corresponding to the tenant, and based on the role information, determine the role group corresponding to the user from the multiple role groups; Determine the multiple role levels corresponding to the role group, and determine the user's corresponding role level from the multiple role levels based on the role information.
9. A multi-tenant RBAC permission inheritance management method according to claim 8, characterized in that, The process of determining a subset of user update permissions based on role groups and role levels, and merging this subset with preset permissions to obtain the user's real-time permissions, includes: Determine the subset of update permissions corresponding to the user's role level, and determine the user's preset permissions; The user's update permission subset is merged with the preset permissions to obtain the user's real-time permissions.
10. A multi-tenant RBAC permission inheritance management system, characterized in that, include: The acquisition module is used to retrieve the role information of each role in the role table of each tenant, and classify each role based on the role information to obtain multiple role groups; The inheritance module is used to determine the permissions of the ancestor roles of each role in each role group, and to inherit and aggregate the permissions of the ancestor roles of each role to obtain the inherited permission set of the role group. The partitioning module is used to determine the role level based on role information, and to determine the scope of permission usage for each role in the inherited permission set of the corresponding role group based on the role level, thus obtaining a permission subset; The update module is used to detect permission changes of the ancestor roles of each role in each role group, and update the permission subset of each role based on the permission changes to obtain the updated permission subset. The determination module is used to determine the user's tenant and role information, and to determine the role group and role level corresponding to the user's role information based on the user's tenant and role information; The management module is used to determine a subset of user update permissions based on role groups and role levels, and then merge the user's update permission subset with preset permissions to obtain the user's real-time permissions.