Temporary permission processing method, electronic equipment and storage medium
By generating temporary permission tokens and monitoring operations in real time, and combining server status and user behavior to assess risk levels, the lack of flexibility in BMC user permission management is solved, enabling dynamic management of temporary permissions and enhanced security.
Patent Information
- Application Number
- CN202511675827.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-14
- Publication Date
- 2026-04-03
AI Technical Summary
The existing BMC user permission management uses static role allocation, which lacks flexibility and cannot adapt to the dynamic allocation needs of temporary high permissions, thus posing a risk of permission abuse.
This paper provides a method for handling temporary permissions. By obtaining the application request from the target user, generating a temporary permission token, monitoring the operation and updating the validity period, automatically revoking the permission, and assessing the risk level by combining server status and user behavior, dynamic management is achieved.
It enables flexible and dynamic management of temporary permissions while ensuring security, avoiding over-authorization, reducing security risks caused by human negligence, and providing detailed usage reports.
Smart Images
Figure CN121786808A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the technical field of servers, and more specifically, to a temporary permission processing method, an electronic device, and a storage medium. Background Technology
[0002] Currently, the server's BMC (Baseboard Management Controller) can manage and monitor various user permissions on the server. The BMC's user permission management method usually adopts static role assignment, such as defining different groups such as administrators, operators, and ordinary users, and assigning fixed permissions to each group, thereby preventing accidental or malicious operations and improving security. However, this fixed permission assignment method lacks flexibility and cannot dynamically assign and manage temporary permissions. Summary of the Invention
[0003] This application provides a method for handling temporary permissions, an electronic device, and a storage medium, which are intended to dynamically manage temporary permissions.
[0004] In a first aspect, embodiments of this application provide a temporary permission processing method applied to a BMC, the method comprising: Obtain the target user's request for target temporary permissions, wherein the request for target temporary permissions includes the scope of operation and the effective period of the target temporary permissions; In response to the administrator's permission operation for the application request of the target temporary permission, a temporary permission token for the target temporary permission is generated. The temporary permission token includes the user ID, the scope of permission operation and the validity period. The temporary permission token is used to indicate that the target user has successfully obtained the target temporary permission. Monitor the operations corresponding to the target temporary permissions of the target user, and update the validity period in the temporary permission token; When the validity period expires, the target temporary permissions of the target user are revoked.
[0005] Optionally, after obtaining the target user's request for temporary permissions, the method further includes: Determine whether the target user meets the application requirements for the target temporary permissions; When the target user meets the application conditions for the target temporary permission, the application request for the target temporary permission is reported to the administrator; If the target user does not meet the application requirements for the target temporary permission, an application failure message will be returned to the target user.
[0006] Optionally, determining whether the target user meets the application conditions for the target temporary permissions includes: Extract the target user's user ID from the request for the target temporary permissions; Based on the user ID of the target user, obtain the temporary permission list corresponding to the target user, the temporary permission list includes all temporary permissions that the target user is allowed to apply for; When the target user's temporary permission list includes the target temporary permission, it is determined that the target user has the application conditions for the target temporary permission.
[0007] Optionally, after obtaining the target user's request for temporary permissions, the method further includes: Obtain the target user's historical operation logs within the target time period; Based on the historical operation logs, determine whether the target user exhibits any abnormal behavior; When the target user exhibits abnormal behavior, a high-risk level label is added to the target's temporary permission request.
[0008] Optionally, based on the historical operation logs, determining whether the target user exhibits abnormal behavior includes: Based on the target user's historical operation logs, determine the target user's login frequency and the frequency of requesting any temporary permission; When the login frequency of the target user exceeds the frequency threshold, or the application frequency of any temporary permission exceeds the frequency threshold, it is determined that the target user has abnormal behavior.
[0009] Optionally, after obtaining the target user's request for temporary permissions, the method further includes: Obtain the current operating status of the server, which includes the server's temperature and health status; When the server is currently in an abnormal operating state, a high-risk level tag is added to the request for temporary permissions for the target.
[0010] Optionally, monitoring the operations corresponding to the target temporary permission of the target user and updating the validity period in the temporary permission token includes: When the effective period in the application request for the target temporary permission is the effective time, the validity period in the temporary permission token is the valid time, and the initial value of the timer is configured according to the effective time, and the timer is started; Monitor the operations corresponding to the target temporary permissions of the target user, and update the validity period in the temporary permission token in real time according to the timer.
[0011] Optionally, monitoring the operations corresponding to the target temporary permission of the target user and updating the validity period in the temporary permission token includes: When the effective period in the application request for the target temporary permission is the number of effective periods, the validity period in the temporary permission token is the number of effective periods, and the initial value of the count counter is configured according to the number of effective periods, and the count counter is started; When an operation corresponding to the target temporary permission of the target user is detected, the count counter is decremented by 1, and the valid count in the temporary permission token is updated in real time according to the count counter.
[0012] In a second aspect, embodiments of this application provide an electronic device, including: at least one processor and a memory, the memory storing a computer program executable on the processor, wherein the processor executes the computer program and performs the temporary permission processing method described in the first aspect of the embodiments.
[0013] Thirdly, embodiments of this application provide a non-volatile readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the temporary permission processing method described in the first aspect of the embodiment.
[0014] Beneficial effects: This method obtains the target user's request for a target temporary permission, which includes the scope of operations and the effective period of the temporary permission. When the administrator approves the request, a temporary permission token is generated, indicating that the target user has successfully obtained the target temporary permission. Then, the operation corresponding to the target user's target temporary permission is monitored, and the validity period in the temporary permission token is updated. When the validity period expires, the target user's target temporary permission is automatically revoked, and the temporary permission is withdrawn in a timely manner. This method provides flexible and dynamic management of temporary permissions while ensuring security. Attached Figure Description
[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 This is a flowchart of the steps of a temporary permission processing method proposed in an embodiment of this application; Figure 2 This is a schematic diagram of a temporary permission processing system proposed in an embodiment of this application; Figure 3 This is a flowchart of a temporary permission processing system provided in an embodiment of this application; Figure 4 This is a functional block diagram of a temporary permission processing device provided in an embodiment of this application; Figure 5 This is a schematic diagram of an electronic device according to an embodiment of this application; Figure 6 This is a schematic diagram of a non-volatile readable storage medium proposed in an embodiment of this application; Figure 7 This is a schematic diagram of a computer program product provided in an embodiment of this application. Detailed Implementation
[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0019] BMC: Baseboard Management Controller, a dedicated controller for server hardware management and monitoring; IPMI: Intelligent Platform Management Interface; GUI: Graphical User Interface, a graphical interface for interacting with users. CPLD: Complex Programmable Logic Device.
[0020] Existing BMC user access management typically uses static role assignment, such as dividing users into administrators, operators, and regular users, and fixing the permissions of each user group. This can prevent accidental or malicious operations and improve security. However, this access allocation method is relatively simple, lacks flexibility, and has the following problems: 1) Risk of abuse of privileges: If high privileges are granted to a user group and not revoked in time, users may perform high-risk operations without authorization; 2) Lack of flexibility: The fixed role assignment method cannot adapt to the dynamic assignment requirements of temporary high-privilege roles.
[0021] Therefore, this application provides a temporary permission processing method that can flexibly and dynamically manage temporary permissions while ensuring security.
[0022] Reference Figure 1 The diagram illustrates a flowchart of a temporary permission processing method according to an embodiment of this application. The method can be applied to BMC, and the method specifically includes the following steps: S101: Obtain the target user's request for target temporary permissions, wherein the request for target temporary permissions includes the scope of operation and the effective period of the target temporary permissions.
[0023] Temporary permissions include any permission on the server where the BMC is located, such as firmware upgrade permissions and power management permissions. In actual implementation, permissions that can be dynamically assigned can be pre-set as temporary permissions.
[0024] In actual implementation, an application template for any temporary permission can be predefined. The application template for temporary permission is used to define the content in the application request for temporary permission. For example, the application template for temporary permission shall include at least the scope of operation and the effective period of any temporary permission. The effective period includes the effective time and the number of times it can be effective. The application request for any temporary permission includes the effective time or the number of times it can be effective.
[0025] In one feasible implementation, after obtaining the target user's request for temporary permissions, the method further includes the following steps: A1: Determine whether the target user meets the application requirements for the target temporary permissions.
[0026] Specifically, after obtaining the target user's request for temporary permissions, the system first determines whether the target user meets the requirements for requesting the temporary permissions. This can prevent over-authorization of any temporary permissions, improve permission security, and avoid over-authorization.
[0027] In actual implementation, the application conditions for any user to apply for any temporary permission can be preset, such as pre-defining the range of temporary permissions that each user can apply for. In actual implementation, other application conditions can also be set, which are not limited in this application embodiment.
[0028] A2: When the target user meets the application conditions for the target temporary permission, the application request for the target temporary permission is reported to the administrator.
[0029] If the target user meets the requirements for applying for the target temporary permissions, then the target user is allowed to apply for the target temporary permissions. The target user's application for the target temporary permissions can be reported to the administrator, who will then approve the application.
[0030] A3: If the target user does not meet the application conditions for the target temporary permission, return an application failure message to the target user.
[0031] If the target user does not meet the requirements for applying for the target temporary permissions, the application request can be ignored, and a failure message can be returned directly to the target user, reducing the approval burden on the administrator. The failure message is used to inform the target user that the application request for the target temporary permissions has failed. The failure message can also include the reason for the failure, such as not meeting the requirements for applying for the target temporary permissions.
[0032] In one feasible implementation, step A1, determining whether the target user meets the application conditions for the target temporary permission, may include the following steps: B1: Extract the target user's user ID from the request for the target temporary permissions.
[0033] Each user has a unique user ID. The target user's request for temporary permissions carries the target user's user ID. After obtaining the target user's request for temporary permissions, the target user's user ID can be extracted from the request. Based on the target user's user ID, it can be determined whether the target user meets the conditions for applying for temporary permissions.
[0034] B2: Based on the target user's user ID, obtain the temporary permission list corresponding to the target user, which includes all temporary permissions that the target user is allowed to apply for.
[0035] In actual implementation, all temporary permissions that each user is allowed to apply for can be predefined, and a temporary permission list for each user can be established. The temporary permission list has a one-to-one mapping relationship with the user ID.
[0036] When a target user requests target temporary permissions, the target user's temporary permission list is retrieved based on the target user's user ID to determine whether the target temporary permissions are included in the temporary permission list.
[0037] B3: When the target user's temporary permission list includes the target temporary permission, it is determined that the target user has the application conditions for the target temporary permission.
[0038] If the target user's temporary permission list includes the target temporary permission, it means that the target user is allowed to apply for the target temporary permission. At this time, the target user has the conditions to apply for the target temporary permission, and the target user's application request for the target temporary permission can be reported to the administrator for approval.
[0039] If the target user's temporary permission list does not include the target temporary permission, it means that the target user is not allowed to apply for the target temporary permission. In this case, the target user does not meet the application requirements for the target temporary permission, and an application failure message can be returned directly to the target user to reduce the approval burden on the administrator.
[0040] After obtaining the target user's request for temporary permissions, if the target user meets the conditions for requesting temporary permissions, a risk label can be added to the request. The risk label is used to alert the administrator of the risks associated with allocating temporary permissions and can assist the administrator in the approval process.
[0041] In one feasible implementation, the process of adding a risk label to a request for target temporary permissions may include the following steps: C1: Obtain the target user's historical operation logs within the target time period.
[0042] In practice, the historical behavior of each user can be monitored and historical operation logs can be generated. Then, based on the historical operation logs of the target user within the target time period, the analysis can be performed to determine whether the target user has any abnormalities.
[0043] The target time period can be set to 1 month or 1 week. The target time period can be set according to the actual application requirements, and this application embodiment does not impose any restrictions.
[0044] C2: Based on the historical operation logs, determine whether the target user exhibits any abnormal behavior.
[0045] Specifically, the login frequency and the frequency of requesting any temporary permission for the target user can be determined based on the target user's historical operation logs.
[0046] When the login frequency of the target user exceeds the frequency threshold, or the application frequency of any temporary permission exceeds the frequency threshold, it is determined that the target user has abnormal behavior.
[0047] In practice, historical operation logs can also record information such as the frequency of user commands issued, the distribution of operation time, and the type of operation target. AI is used to build a baseline of normal user behavior and to identify abnormal behaviors in the historical operation logs of target users. Abnormal behaviors can also include logging in outside of working hours.
[0048] C3: When the target user exhibits abnormal behavior, add a high-risk level tag to the target's temporary permission request.
[0049] When a target user exhibits abnormal behavior, granting temporary permissions to that user could potentially threaten server security. Therefore, when a target user exhibits abnormal behavior, a high-risk label can be added to the temporary permission request to alert the administrator of the risk of granting temporary permissions to the target user.
[0050] In one feasible implementation, in addition to assessing the risk level of the target temporary permission request based on the user's abnormal behavior, the risk level of granting the target temporary permission can also be assessed based on the current operating status of the server. Specifically, the current operating status of the server can be obtained, including but not limited to the server's temperature and health status.
[0051] When the server is currently in an abnormal operating state, a high-risk level tag is added to the request for temporary permissions for the target.
[0052] In actual implementation, abnormal operating states of the server can be predefined. After obtaining the current operating state, it is compared with the predefined abnormal operating states. For example, when the server temperature exceeds the temperature threshold, it is an abnormal operating state. When the server is in a fault state or an overload state, it is an abnormal operating state.
[0053] Granting temporary permissions to a target user when the server is in an abnormal operating state may further aggravate the server's abnormality. Therefore, when the server is in an abnormal operating state, a high-risk label can be added to the target temporary permission request to alert the administrator of the risk of granting the target temporary permissions.
[0054] In practice, after obtaining the target user's request for temporary permissions, if the target user meets the conditions for requesting temporary permissions, a risk label can be added to the request based on the target user's abnormal behavior and the abnormal operating state of the server. If the target user exhibits abnormal behavior or the server exhibits abnormal operating state, a high-risk label can be added to the request. Only when the target user does not exhibit abnormal behavior and the server does not exhibit abnormal operating state can a normal label be added to the request or no risk label be added.
[0055] In practice, high-risk temporary permissions can be predefined based on their importance. These high-risk temporary permissions are those that can significantly impact the normal operation of the server, such as firmware upgrade permissions or power control permissions.
[0056] When a request for a target temporary permission is received, the scope of permission operations in the request is used to determine whether the target temporary permission is a high-risk temporary permission. If it is a high-risk temporary permission, a high-risk level label is added to the request for the target temporary permission.
[0057] In practice, to further improve server security, requests for temporary permissions with high-risk level tags can be filtered out, eliminating the need for administrator approval. The processing strategy for such requests can be selected based on the actual application requirements.
[0058] S102: In response to the administrator's permission operation for the request for the target temporary permission, a temporary permission token for the target temporary permission is generated.
[0059] The administrator is responsible for approving the target user's request for the target temporary permission. When the administrator grants permission to the target temporary permission request, it indicates that the administrator has approved the request for the target temporary permission and generates a temporary permission token for the target temporary permission. The temporary permission token is used to indicate that the target user has successfully obtained the target temporary permission.
[0060] The temporary permission token includes fields such as user ID, scope of permission operations, and validity period. By associating the temporary permission token with the target user's operations, precise control over the target's temporary permissions can be achieved.
[0061] In practice, after generating a temporary permission token for the target temporary permissions, BMC can return the temporary permission token to the target user to inform the target user that the application for the target temporary permissions was successful.
[0062] S103: Monitor the operation corresponding to the target temporary permission of the target user, and update the validity period in the temporary permission token.
[0063] The initial value of the validity period in a temporary permission token is determined based on the effective period in the application request for the target temporary permission. For example, if the effective period is the effective time and the effective time is 1 hour, then the initial value of the validity period is 1 hour; if the effective period is the number of times it can be effective and the number of times it can be effective is 10, then the initial value of the validity period is 10 times.
[0064] To avoid over-authorization and improve server security, after granting target temporary permissions to a target user, the system monitors the operations corresponding to the target user's target temporary permissions in real time and updates the validity period in the temporary permission token.
[0065] In one feasible implementation, when the effective period in the application request for the target temporary permission is the effective time, the validity period in the temporary permission token is the valid time, and the initial value of the timer is configured according to the effective time, and the timer is started; the operation corresponding to the target temporary permission of the target user is monitored, and the valid time in the temporary permission token is updated in real time according to the timer.
[0066] In another feasible implementation, when the effective period in the application request for the target temporary permission is the number of effective periods, the effective period in the temporary permission token is the number of effective periods, and the initial value of the count counter is configured according to the number of effective periods, and the count counter is started; when the operation corresponding to the target temporary permission of the target user is detected, the count counter is decremented by 1, and the number of effective periods in the temporary permission token is updated in real time according to the count counter.
[0067] S104: When the validity period expires, the target temporary permission of the target user is revoked.
[0068] When the validity period of the temporary permission token expires, such as when the validity time is 0 or the number of validity times is 0, it indicates that the validity period of the applied target temporary permission has ended. The target user's target temporary permission is then revoked, and the temporary permission token corresponding to the target temporary permission is cleared, thereby automatically revoking the target temporary permission that has exceeded its validity period.
[0069] In actual implementation, after the target user's temporary permissions are revoked, a notification of the revocation of temporary permissions can be returned to the target user, indicating that the target user no longer has the temporary permissions.
[0070] In one feasible implementation, during the process of monitoring the operation corresponding to the target temporary permission of the target user, the actual usage record of the target temporary permission is recorded, and the actual usage record includes time information and the specific operation content of the target temporary permission.
[0071] Furthermore, in response to the request operation for a usage report of the target temporary permission, a usage report of the target temporary permission can also be generated, which includes a lifecycle record of the target temporary permission's application stage, usage stage, and termination stage.
[0072] The temporary permission handling method provided in this application embodiment has at least the following beneficial effects: 1. Refined temporary authorization: Predefine the application template for any temporary permission, and implement unified and precise control over the application for temporary permissions to avoid over-authorization; 2. Authorizing temporary permissions by combining various methods such as effective time or number of effective times is more flexible than a purely time-limited approach; 3. Update the validity period of temporary permissions to enable automatic revocation of permissions and reduce security risks caused by human negligence; 4. Add a high-risk label to temporary permission requests based on the server's operating status, the target user's historical behavior, and the importance of the temporary permissions, providing administrators with an approval reference.
[0073] 5. Enhanced auditability: Detailed usage reports for any temporary permission can be generated, including a complete lifecycle record of the temporary permission from application to revocation.
[0074] Reference Figure 2 The diagram illustrates a temporary permission processing system provided in an embodiment of this application. The system includes a BMC, a user interface module, and an administrator user interface module.
[0075] The BMC is used to execute the temporary permission processing method provided in the embodiments of this application. Interface design can be performed on the BMC, providing a user interface module and an administrator user interface module.
[0076] The user interface module provides a graphical user interface for any user, similar to that of a regular user. Users can submit requests for temporary permissions and obtain approval results through this graphical user interface.
[0077] Specifically, the main interface of the graphical user interface for ordinary users displays all temporary permission application templates. The temporary permission application templates include all operation permissions, optional time limits, and optional operation count limits.
[0078] Users can select the scope of operation for the desired temporary permission from all operation permissions. For example, all operation permissions include a major permission category and a minor permission category. If the major permission category is firmware upgrade permission, the corresponding minor permission categories include: BMC firmware upgrade permission, BIOS firmware upgrade permission, and CPLD firmware upgrade permission, etc. Users can select the minor permission category to determine the scope of operation for the target temporary permission, then select a time limit range to determine the effective time of the target temporary permission, or select an operation count limit range to determine the number of times the target temporary permission can be effective, and then click the submit button to submit the application request for the target temporary permission.
[0079] For example, for any selected permission subclass, the preset time limit range for that permission subclass can also be displayed. For instance, for temporary permission A, the range of allowed effective time for the application is: 30min ≥ effective time ≤ 7 days.
[0080] The graphical user interface for regular users also includes a notification page, which displays various prompts, including notifications of successful application, application failure, and the revocation of temporary permissions.
[0081] The administrator user interface module provides administrators with a graphical user interface corresponding to the administrator. Based on this graphical user interface, the administrator can approve the application request for target temporary permissions and has a download control to download the usage report of any temporary permission.
[0082] The main interface in the graphical user interface corresponding to the administrator can display all temporary permission application requests. Temporary permission application requests can be divided into two categories: unprocessed requests and processed requests. Each application request can carry a risk level label. On the main interface, application requests can be filtered and classified according to risk level, username, user group, and other conditions.
[0083] Clicking on any temporary permission request will display detailed information about the request, such as the user ID, the scope of operation of the target temporary permission, and the effective period.
[0084] For processed requests, users can click the download control to download the usage report of the temporary permission.
[0085] For unprocessed requests, you can audit them by clicking the "Agree" and "Reject" buttons. For each approval, you can also choose to fill in the processing comments and then send the approval result to BMC.
[0086] Reference Figure 3The diagram illustrates a flowchart of a temporary permission processing system provided in an embodiment of this application. Based on this system, a target user can select a target temporary permission and choose the effective time or number of times it can be applied. The BMC reports the user's request for the target temporary permission to the administrator. The administrator approves the request for the target temporary permission. When the approval is successful, the BMC generates a temporary permission token for the target temporary permission. The temporary permission token includes the user ID, the scope of permission operations, and the validity period. The BMC sends the approval result carrying the temporary permission token to the target user. Then, the BMC monitors the user's operations, updates the validity period in the temporary permission token, and when the validity period expires, revoks the target temporary permission and generates a usage report of the target temporary permission.
[0087] Reference Figure 4 This diagram illustrates a functional block diagram of a temporary permission processing device provided in an embodiment of this application, applied to a BMC. The system includes: The acquisition module 100 is used to acquire the target user's application request for the target temporary permission, wherein the application request for the target temporary permission includes the operation scope and effective period of the target temporary permission; The temporary permission token generation module 200 is used to generate a temporary permission token for the target temporary permission in response to the administrator's permission operation for the application request of the target temporary permission. The temporary permission token includes a user ID, permission operation scope and validity period. The temporary permission token is used to indicate that the target user has successfully obtained the target temporary permission. The monitoring module 300 is used to monitor the operations corresponding to the target temporary permissions of the target user and update the validity period in the temporary permission token; The permission removal module 400 is used to remove the target temporary permission of the target user when the validity period expires.
[0088] Optionally, the device further includes: The application condition judgment module is used to determine whether the target user has the application conditions for the target temporary permission; The reporting module is used to report the application request for the target temporary permission to the administrator when the target user meets the application conditions for the target temporary permission; The return module is used to return an application failure message to the target user when the target user does not meet the application conditions for the target temporary permission.
[0089] Optionally, the application condition judgment module is used for: Extract the target user's user ID from the request for the target temporary permissions; Based on the user ID of the target user, obtain the temporary permission list corresponding to the target user, the temporary permission list includes all temporary permissions that the target user is allowed to apply for; When the target user's temporary permission list includes the target temporary permission, it is determined that the target user has the application conditions for the target temporary permission.
[0090] Optionally, the device further includes a first risk level label adding module, used for: Obtain the target user's historical operation logs within the target time period; Based on the historical operation logs, determine whether the target user exhibits any abnormal behavior; When the target user exhibits abnormal behavior, a high-risk level label is added to the target's temporary permission request.
[0091] Optionally, the first risk level label adding module is also used for: Based on the target user's historical operation logs, determine the target user's login frequency and the frequency of requesting any temporary permission; When the login frequency of the target user exceeds the frequency threshold, or the application frequency of any temporary permission exceeds the frequency threshold, it is determined that the target user has abnormal behavior.
[0092] Optionally, the device further includes a second risk level label adding module, used for: After obtaining the target user's request for temporary permissions, the method further includes: Obtain the current operating status of the server, which includes the server's temperature and health status; When the server is currently in an abnormal operating state, a high-risk level tag is added to the request for temporary permissions for the target.
[0093] Optionally, the monitoring module includes a first monitoring unit, used for: When the effective period in the application request for the target temporary permission is the effective time, the validity period in the temporary permission token is the valid time, and the initial value of the timer is configured according to the effective time, and the timer is started; Monitor the operations corresponding to the target temporary permissions of the target user, and update the validity period in the temporary permission token in real time according to the timer.
[0094] Optionally, the monitoring module includes a second monitoring unit, used for: When the effective period in the application request for the target temporary permission is the number of effective periods, the validity period in the temporary permission token is the number of effective periods, and the initial value of the count counter is configured according to the number of effective periods, and the count counter is started; When an operation corresponding to the target temporary permission of the target user is detected, the count counter is decremented by 1, and the valid count in the temporary permission token is updated in real time according to the count counter.
[0095] Reference Figure 5 The diagram illustrates an electronic device according to an embodiment of this application, including: at least one processor and a memory, the memory storing a computer program executable on the processor, wherein the processor executes the computer program to perform the temporary permission processing method described in the embodiment.
[0096] Reference Figure 6 The diagram illustrates a non-volatile readable storage medium provided in an embodiment of this application. The non-volatile readable storage medium stores a computer program, wherein the computer program, when executed by a processor, performs the temporary permission processing method described in the embodiment.
[0097] Reference Figure 7 The diagram illustrates a computer program product provided in an embodiment of this application, including a computer program / instruction that, when executed by a processor, implements the temporary permission processing method described in the embodiment.
[0098] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0099] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0100] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0103] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.
[0104] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0105] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for handling temporary permissions, characterized in that, Applied to BMC, the method includes: Obtain the target user's request for target temporary permissions, wherein the request for target temporary permissions includes the scope of operation and the effective period of the target temporary permissions; In response to the administrator's permission operation for the application request of the target temporary permission, a temporary permission token for the target temporary permission is generated. The temporary permission token includes the user ID, the scope of permission operation and the validity period. The temporary permission token is used to indicate that the target user has successfully obtained the target temporary permission. Monitor the operations corresponding to the target temporary permissions of the target user, and update the validity period in the temporary permission token; When the validity period expires, the target temporary permissions of the target user are revoked.
2. The method according to claim 1, characterized in that, After obtaining the target user's request for temporary permissions, the method further includes: Determine whether the target user meets the application requirements for the target temporary permissions; When the target user meets the application conditions for the target temporary permission, the application request for the target temporary permission is reported to the administrator; If the target user does not meet the application requirements for the target temporary permission, an application failure message will be returned to the target user.
3. The method according to claim 2, characterized in that, Determining whether the target user meets the application conditions for the target temporary permissions includes: Extract the target user's user ID from the request for the target temporary permissions; Based on the target user's user ID, obtain the temporary permission list corresponding to the target user, the temporary permission list including all temporary permissions that the target user is allowed to apply for; When the target user's temporary permission list includes the target temporary permission, it is determined that the target user has the application conditions for the target temporary permission.
4. The method according to claim 1, characterized in that, After obtaining the target user's request for temporary permissions, the method further includes: Obtain the target user's historical operation logs within the target time period; Based on the historical operation logs, determine whether the target user exhibits any abnormal behavior; When the target user exhibits abnormal behavior, a high-risk label is added to the target's temporary permission request.
5. The method according to claim 4, characterized in that, Based on the historical operation logs, determine whether the target user exhibits any abnormal behavior, including: Based on the target user's historical operation logs, determine the target user's login frequency and the frequency of requesting any temporary permission; When the login frequency of the target user exceeds the frequency threshold, or the application frequency of any temporary permission exceeds the frequency threshold, it is determined that the target user has abnormal behavior.
6. The method according to claim 1, characterized in that, After obtaining the target user's request for temporary permissions, the method further includes: Obtain the current operating status of the server, including the server's temperature and health status; When the server is currently in an abnormal operating state, a high-risk level tag is added to the request for temporary permissions for the target.
7. The method according to claim 1, characterized in that, Monitoring the operations corresponding to the target user's temporary permissions and updating the validity period of the temporary permission token, including: When the effective period in the application request for the target temporary permission is the effective time, the validity period in the temporary permission token is the valid time, and the initial value of the timer is configured according to the effective time, and the timer is started; Monitor the operations corresponding to the target temporary permissions of the target user, and update the validity period in the temporary permission token in real time according to the timer.
8. The method according to claim 1, characterized in that, Monitoring the operations corresponding to the target user's temporary permissions and updating the validity period of the temporary permission token, including: When the effective period in the application request for the target temporary permission is the number of effective periods, the validity period in the temporary permission token is the number of effective periods, and the initial value of the count counter is configured according to the number of effective periods, and the count counter is started; When an operation corresponding to the target temporary permission of the target user is detected, the count counter is decremented by 1, and the valid count in the temporary permission token is updated in real time according to the count counter.
9. An electronic device, characterized in that, include: At least one processor, and a memory storing a computer program executable on the processor, wherein the processor executes the computer program to perform the temporary permission processing method according to any one of claims 1-8.
10. A non-volatile readable storage medium, characterized in that, The non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it performs the temporary permission processing method according to any one of claims 1-8.