Authority management method and device, computer equipment and storage medium

Abstract

The invention relates to an authority management method and device, computer equipment and a storage medium. The method comprises the following steps: respectively attributing authority resource partitions of a target system to corresponding management domains, and establishing authority association data of a plurality of management main bodies and a plurality of partition resources; in response to the received permission change instruction, determining an instruction sending main body and an instruction target main body, and determining a corresponding instruction target management domain; traversing the instruction target resource, and constructing a management authority tree of the instruction sending main body in an instruction target management domain; and selecting permission leaf nodes from the management permission tree and generating permission change information so as to change the management permission of the instruction target main body to the instruction target resource. By adopting the method, the clear management domain boundary can be established based on the resource partition, the authority action range is limited according to the management domain, and the management authority tree is constructed to accurately generate the change information, so that the technical problems that the authority action range is difficult to limit and the authority change cannot be accurately controlled in the prior art are solved.

Description

Technical Field

[0001] This application relates to the field of access control technology, and in particular to an access control method, apparatus, computer device and storage medium. Background Technology

[0002] In the current permission management system, permissions are usually centrally configured by a small number of abstract roles. However, when a subject needs to be responsible for multiple business segments or product lines, it is often necessary to split it into multiple fine-grained roles to carry different permission combinations under different businesses. This leads to a rapid expansion of the number of roles, a chaotic permission structure, and a complex authorization chain. Especially in large systems, a role often spans multiple business scenarios, and its permissions are difficult to restrict to the corresponding business scope. This further leads to problems such as permission overreach, authorization conflicts, and difficulty in performing permission auditing and maintenance at the business granularity. At the same time, permission resources lack clear business domain affiliation, and permission changes often have a global effect, making it difficult to control only specific business scopes, resulting in high maintenance costs and high risks. Summary of the Invention

[0003] Based on this, it is necessary to provide a permission management method, device, computer equipment, and storage medium that can establish clear management domain boundaries based on resource partitioning, automatically limit the scope of permission based on the management domain during permission change, construct a traceable management permission tree, and accurately generate change information accordingly, so as to at least solve the technical problems in the prior art, such as the difficulty in limiting the scope of permission, the easy cross-domain diffusion of role permissions, the inability to accurately control permission changes according to business scope, and the high maintenance cost.

[0004] On the one hand, a permission management method is provided, the method comprising: Multiple partition resources obtained from the permission resource partitioning of the target system are assigned to their respective management domains, and the management domains are used as permission scopes to establish permission association data between multiple management entities and multiple partition resources. In response to receiving a permission change instruction, the instruction sending subject and the instruction target subject are determined, and the instruction target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the instruction sending subject and the set of changeable management domains of the instruction target subject. The partition resources corresponding to the instruction target management domain are determined as instruction target resources, and based on the permission association data, the instruction target resources are traversed to construct the management permission tree of the instruction sending entity under the instruction target management domain; Based on the permission change instruction, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; Based on multiple permission change information, the management permissions of the instruction target entity over the instruction target resource are changed.

[0005] In one embodiment, the step of assigning multiple partition resources obtained from the permission resource partitioning of the target system to corresponding management domains, and establishing permission association data between multiple management entities and multiple partition resources using the management domains as permission scopes, includes: Based on the business entities in the target system, determine the permission resources controlled by management permissions; Based on at least one or more of the subordinate relationship between the permission resources and business entities, isolation requirements, and access boundaries, the permission resources are partitioned to obtain multiple partitioned resources; The partitioned resources are assigned to a preset management domain, and one or more management entities are set up to be associated with the management domain; Based on the association between the management entity and the management domain, the management authority of the management entity over the partition resources within the management domain is determined; Based on the management permissions of the multiple management entities for the multiple partition resources, permission association data corresponding to the management permissions is established.

[0006] In one embodiment, determining the instruction sending entity and the instruction target entity, and determining the instruction target management domain corresponding to the permission change instruction based on the set of management domains associated with the instruction sending entity and the set of modifiable management domains of the instruction target entity, includes: Parse the permission change instruction to determine the type of the management entity corresponding to the target entity of the instruction. The management entity includes at least: user entities that can send and receive instructions and role entities that cannot send and receive instructions. In response to the user subject corresponding to the target subject of the instruction, the user management domain associated with the user subject is obtained, and the set of changeable management domains is generated based on the business scope that the user can be authorized to. Obtain the set of management domains associated with the instruction sending entity, and perform an intersection operation with the set of changeable management domains to obtain the intersection result; If the intersection result is not empty, then the intersection result is taken as the instruction target management domain; If the intersection result is empty, the permission change instruction is deemed invalid. If the target entity of the instruction is the role entity, then check whether there is a binding relationship between the instruction sending entity and the instruction target entity; If so, the set of management domains associated with the instruction sending subject shall be taken as the set of changeable management domains of the instruction target subject, and the set of changeable management domains shall be taken as the instruction target management domain; If not, the permission change instruction is deemed invalid.

[0007] In one embodiment, the step of traversing the instruction target resource based on the permission association data to construct a management permission tree for the instruction sending entity under the instruction target management domain includes: The target resource of the instruction is parsed to obtain multiple resource nodes, and the resource hierarchy structure of the multiple resource nodes is determined. Using the instruction target management domain as the root node, and based on the resource hierarchy, traversing multiple resource nodes from top to bottom, determining the resource nodes without lower-level resources as resource leaf nodes, and generating the resource topology of the instruction target resource; Parse the permission association data to obtain the permission items of the instruction sending body for multiple resource leaf nodes; Based on the resource topology, the permission items of multiple resource leaf nodes are aggregated upwards from bottom to top to generate the permission items of the upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, so as to generate the management permission tree.

[0008] In one embodiment, the step of sequentially aggregating the permission items of multiple resource leaf nodes from bottom to top based on the resource topology to generate the permission items of upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, in order to generate the management permission tree, includes: Obtain multiple permission items and corresponding permission metadata of the resource leaf node, wherein the permission metadata includes at least: resource identifier, operation type, decision flag, source flag and applicable constraints; Based on the permission metadata, the multiple permission items of the resource leaf node are normalized and internal conflict is checked. If there is no internal conflict among the multiple permission items of the same resource leaf node, the multiple permission items are determined as leaf layer permission items and used as the convergence input of the upper layer resource node of the resource leaf node. Based on the resource identifier, multiple leaf layer permission items of multiple resource leaf nodes are aggregated to generate a candidate permission set for the upper-layer resource node. Based on the decision marker and the applicable constraints, determine whether there is one or more of the following conflicts: decision consistency conflict or constraint compatibility conflict among the multiple leaf layer permission items in the candidate permission set; In response, the decision consistency conflict and / or constraint compatibility conflict are handled according to a preset conflict resolution strategy, and multiple leaf layer permission items in the candidate permission set are merged according to a preset merging rule to update the candidate permission set. Obtain the existing authorization of the parent resource node, merge the updated candidate permission set with the existing authorization, and generate the upper-level permission set of the upper-level resource node; The set of upper-level permissions is used as the aggregate input for the next higher-level resource nodes, and so on, until the top-level permission item is obtained.

[0009] In one embodiment, the step of selecting one or more permission leaf nodes from the management permission tree based on the permission change instruction, and generating permission change information for the target subject of the instruction based on the permission leaf nodes, includes: Parse the permission change instruction to determine the change type, which includes at least: permission addition, permission revocation, and permission adjustment; Based on the change type and the target operation of the permission change instruction, match the set of permission leaf nodes corresponding to the target operation from the management permission tree; Parse the permission items and associated permission metadata corresponding to multiple permission leaf nodes in the permission leaf node set; Based on the permission item and the permission metadata, a permission change unit representing the direction and scope of permission change is generated. The permission change unit includes at least the target resource identifier, operation type, change action and applicable constraints. Multiple permission change units are aggregated to generate permission change information corresponding to the target subject of the instruction.

[0010] In one embodiment, changing the management permissions of the instruction target subject to the instruction target resource based on multiple permission change information includes: Parse the permission change information to determine permission addition information, permission revocation information, and permission adjustment information; Based on the target resource identifier, locate the existing authorization records of the instruction target subject under the target resource node; The permission addition information is parsed to determine the new permission item and write it into the existing authorization record to form a new authorization; The permission revocation information is parsed, and the permission items to be deleted are identified and deleted from the existing authorization records to form a revocation of authorization; The permission adjustment information is parsed to determine the target permission and the target permission information, and the existing authorization records are replaced or overwritten based on the target permission information. In response to the addition, revocation, or adjustment of multiple of the aforementioned permission items, an updated instruction target subject authorization result set is generated.

[0011] On the other hand, a permission management device is provided, the device comprising: The permission association module is used to assign multiple partition resources obtained from the permission resource partitioning of the target system to the corresponding management domains, and to establish permission association data between multiple management entities and multiple partition resources using the management domains as the permission scope. The target determination module is used to, in response to receiving a permission change instruction, determine the instruction sending body and the instruction target body, and determine the instruction target management domain corresponding to the permission change instruction based on the set of management domains associated with the instruction sending body and the set of changeable management domains of the instruction target body; The permission tree construction module is used to determine the partition resources corresponding to the instruction target management domain as instruction target resources, and based on the permission association data, to traverse the instruction target resources and construct the management permission tree of the instruction sending entity under the instruction target management domain. The change information generation module is used to select one or more permission leaf nodes from the management permission tree based on the permission change instruction, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; The permission change module is used to change the management permissions of the instruction target subject to the instruction target resource based on multiple permission change information.

[0012] In another aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Multiple partition resources obtained from the permission resource partitioning of the target system are assigned to their respective management domains, and the management domains are used as permission scopes to establish permission association data between multiple management entities and multiple partition resources. In response to receiving a permission change instruction, the instruction sending subject and the instruction target subject are determined, and the instruction target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the instruction sending subject and the set of changeable management domains of the instruction target subject. The partition resources corresponding to the instruction target management domain are determined as instruction target resources, and based on the permission association data, the instruction target resources are traversed to construct the management permission tree of the instruction sending entity under the instruction target management domain; Based on the permission change instruction, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; Based on multiple permission change information, the management permissions of the instruction target entity over the instruction target resource are changed.

[0013] In another aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps: Multiple partition resources obtained from the permission resource partitioning of the target system are assigned to their respective management domains, and the management domains are used as permission scopes to establish permission association data between multiple management entities and multiple partition resources. In response to receiving a permission change instruction, the instruction sending subject and the instruction target subject are determined, and the instruction target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the instruction sending subject and the set of changeable management domains of the instruction target subject. The partition resources corresponding to the instruction target management domain are determined as instruction target resources, and based on the permission association data, the instruction target resources are traversed to construct the management permission tree of the instruction sending entity under the instruction target management domain; Based on the permission change instruction, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; Based on multiple permission change information, the management permissions of the instruction target entity over the instruction target resource are changed.

[0014] The aforementioned permission management methods, devices, computer equipment, and storage media partition permission resources and assign them to corresponding management domains. By using these management domains as the scope of permissions, the management boundaries of permissions correspond one-to-one with the actual business scope, preventing the problem of unbounded permission diffusion. Simultaneously, by establishing structured permission association data between management subjects and partitioned resources, the system can clearly determine the permission scope of a subject in different management domains, achieving intra-domain control and inter-domain isolation of permission resources. Furthermore, when processing permission changes, the system automatically determines the scope of permissions based on the set of management domains already associated with the subject and the set of modifiable management domains of the target subject, according to the instruction sent. The instruction target management domain avoids the overreach or omission caused by manual selection of the scope of action, thus achieving precise limitation of the scope of impact of permission changes. Furthermore, by traversing partition resources under the instruction target management domain to construct a management permission tree, permission relationships are made visible and hierarchical, facilitating the identification of permission coverage relationships and boundary differences. Based on this, the system only selects permission leaf nodes from the management permission tree to generate change information, enabling permission addition and deletion to be performed at the smallest resource unit, avoiding over-authorization and improving change accuracy. In addition, permission changes are executed item by item based on structured data, making the process traceable and verifiable, significantly reducing configuration conflicts and security risks caused by manual adjustments. In summary, this application effectively solves the problems of difficulty in limiting the scope of permission action, chaotic authorization structures, inability to accurately control change operations according to business scope, and high permission maintenance costs in existing technologies, achieving domain-based management of permission resources, precise location of permission changes, and improved security and controllability of permission configuration. Attached Figure Description

[0015] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is an application environment diagram of the permission management method in one embodiment; Figure 2 This is a flowchart illustrating a permission management method in one embodiment; Figure 3 This is a flowchart illustrating the permission management steps in one embodiment; Figure 4 This is a structural block diagram of a permission management device in one embodiment; Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] This application provides a permission management method that can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. Management entities on terminal 102 (such as administrators or business users with management capabilities) can send commands to the server through the terminal interface, such as permission queries, permission changes, or management domain configurations. Server 104 is used to carry the core logic involved in this application, including permission resource partitioning, management domain construction, permission association data maintenance, permission change processing, and authentication calculation.

[0019] In the technical solution of this application, server 104 can partition resources and assign them to different management domains based on the permission resource structure of the target system, and establish permission association data for multiple management subjects using the management domain as the permission scope; when receiving a permission change instruction from terminal 102, the server can determine the set of management domains to which the instruction sending subject and the instruction target subject belong and can be changed, and automatically determine the target management domain for the permission change; the server can further construct a management permission tree based on the resource topology under the target management domain, select permission leaf nodes from the permission tree to generate permission change information, and finally update the management permissions and permission association data of the instruction target subject, and so on. The pre-calculated permission results for the corresponding management domain need to be updated in real time for use by the terminal side in authentication requests. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, used to display the permission interface, trigger permission changes, or initiate authentication requests. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers, used to execute all or part of the steps of the permission management method involved in this application, including but not limited to permission data storage, permission tree construction, conflict resolution, incremental update, authentication calculation and cache synchronization, etc., to support permission security management in high-concurrency, large-scale, multi-business domain scenarios.

[0020] In one embodiment, such as Figure 2 As shown, a permission management method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included: Step 201: Assign the multiple partition resources obtained from the permission resource partitioning of the target system to the corresponding management domains, and use the management domains as the permission scope to establish permission association data between multiple management entities and multiple partition resources; Step 202: In response to receiving a permission change instruction, determine the instruction sending subject and the instruction target subject, and determine the instruction target management domain corresponding to the permission change instruction based on the set of management domains associated with the instruction sending subject and the set of changeable management domains of the instruction target subject. Step 203: Determine the partition resources corresponding to the instruction target management domain as instruction target resources, and traverse the instruction target resources based on the permission association data to construct the management permission tree of the instruction sending entity under the instruction target management domain; Step 204: Based on the permission change instruction, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the subject of the instruction according to the permission leaf nodes; Step 205: Based on multiple permission change information, change the management permissions of the instruction target subject to the instruction target resource.

[0021] This embodiment provides a permission management method that partitions permission resources and assigns them to corresponding management domains. By using these management domains as the scope of permissions, the management boundaries of permissions correspond one-to-one with the actual business scope, avoiding the problem of unbounded permission propagation. Simultaneously, by establishing structured permission association data between management subjects and partitioned resources, the system can clearly determine the permission scope of a subject in different management domains, achieving intra-domain control and inter-domain isolation of permission resources. Furthermore, when processing permission changes, the system automatically determines the target of the instruction by considering the set of management domains already associated with the subject and the set of modifiable management domains of the target subject. By defining a management domain, the system avoids unauthorized access or omissions caused by manual selection of the scope of action, thus achieving precise limitation of the impact of permission changes. Furthermore, by constructing a management permission tree by traversing partitioned resources under the instruction target management domain, permission relationships are made visible and hierarchical, facilitating the identification of permission coverage relationships and boundary differences. Based on this, the system only selects permission leaf nodes from the management permission tree to generate change information, enabling permission addition and deletion to be performed at the smallest resource unit, avoiding over-authorization and improving change accuracy. In addition, permission changes are executed item by item based on structured data, making the process traceable and verifiable, significantly reducing configuration conflicts and security risks caused by manual adjustments. In summary, the permission management method provided in this embodiment effectively solves the problems of difficulty in defining the scope of permission action, chaotic authorization structure, inability to accurately control change operations according to business scope, and high permission maintenance costs in existing technologies, achieving domain-based management of permission resources, precise location of permission changes, and improved security and controllability of permission configuration.

[0022] In one embodiment, multiple partition resources obtained from the permission resource partitioning of the target system are respectively assigned to corresponding management domains, and permission association data between multiple management entities and multiple partition resources is established using the management domain as the permission scope, including: Based on the business entities in the target system, determine the permission resources controlled by management permissions; The business entities may include product lines, business modules, business domains, organizational units, function sets, or cross-departmental specialized business resources, such as business units such as "order management," "inventory management," "platform operation," and "financial settlement." The permission resources are preferably functional resources, data resources, or operational capabilities that correspond one-to-one or many-to-one with the business entities, such as operation items such as "order viewing," "order editing," "inventory transfer," and "report export." Based on at least one or more of the following factors—the subordinate relationship between the permission resource and the business entity, isolation requirements, and access boundaries—the permission resource is partitioned to obtain multiple partitioned resources. Among them, the subordinate relationship is used to describe whether the authorized resource belongs to only a single business entity; the isolation requirement is used to identify whether the resource must be isolated from other businesses, for example, financial data and operational data usually need to be isolated by partition; the access boundary is used to determine whether the resource can be accessed across businesses; preferably, the resource partitioning can be automatically completed through preset resource labeling attributes (such as resource.biz, resource.scope, resource.sensitivity); Assign the partitioned resources to a preset management domain and set one or more management entities associated with the management domain; Among them, the management domain is preferably the management scope of the corresponding business entity, such as "order domain" and "inventory domain". The management subject can be a user or role with management responsibilities for that domain, such as "order administrator" and "inventory manager". Based on the relationship between the management entity and the management domain, determine the management authority of the management entity over the partitioned resources within the management domain; Based on the management permissions of multiple management entities for multiple partition resources, permission association data corresponding to the management permissions is established. The permission association data is preferably stored in the form of a tree structure, matrix structure, or domain permission mapping table to facilitate quick retrieval by management domain, management entity, or resource granularity.

[0023] Specifically, in this embodiment, permission resources are identified based on business entities, and the permission resources are partitioned according to resource affiliation, isolation requirements, and access boundaries, so that the resources naturally form multiple independently manageable partitions. The partitioned resources are then assigned to a preset management domain, and the management domain is bound to the management subject, so that the scope of the permission is clearly defined at the structural level. Furthermore, by determining the actual management permissions of the management subject within the domain based on the association between the management subject and the management domain, and constructing structured permission association data accordingly, the organizational boundaries of permission data are clear and the source of authorization is traceable. This effectively avoids the problems of continuously refined role granularity, cross-domain diffusion of permissions, and chaotic authorization structure, and lays a unified data foundation for subsequent precise permission changes and permission tree construction based on management domains.

[0024] In one embodiment, the instruction sending entity and the instruction target entity are determined, and based on the set of management domains associated with the instruction sending entity and the set of modifiable management domains of the instruction target entity, the instruction target management domain corresponding to the permission change instruction is determined, including: Parse the permission change command to determine the type of management entity corresponding to the target subject of the command. The management entity includes at least: user entities that can send and receive commands, and role entities that cannot send and receive commands. In response to the user subject corresponding to the instruction target subject, the user management domain associated with the user subject is obtained, and a set of modifiable management domains is generated based on the business scope that the user can be authorized to. The business scope that the user can be authorized to is preferably automatically derived from the user's position, organization, department, or historical authorization behavior, and can be automatically converged according to the actual business scenario. For example, a user may be associated with multiple user management domains such as "inventory domain", "supply domain", "order domain", and "customer domain", but the user belongs to the "supply chain operations group". Therefore, the user's modifiable management domains are narrowed down to "inventory domain" and "supply domain". Obtain the set of management domains associated with the instruction sending entity, perform an intersection operation with the set of changeable management domains, and obtain the intersection result; If the intersection result is not empty, then the intersection result will be used as the instruction target management domain; If the intersection result is empty, the permission change instruction is deemed invalid. In response to the instruction target being a role subject, the system checks whether there is a binding relationship between the instruction sending subject and the instruction target subject. Preferably, the binding relationship is that the role is created, managed, or directly managed by a user, or the role is designated as a subordinate role of that user. The system can automatically identify the binding relationship through role metadata (such as role.owner or role.manager). If so, the set of management domains associated with the instruction sending body will be used as the set of changeable management domains of the instruction target body, and the set of changeable management domains will be used as the instruction target management domain; If not, the permission change command is deemed invalid.

[0025] Specifically, in this embodiment, by parsing permission change instructions and distinguishing between user subjects and role subjects, the system can adopt different domain determination strategies based on subject type. For user subjects, a set of changeable management domains is generated based on their authorized business scope, and intersection is calculated with the set of management domains associated with the instruction sending subject, thereby limiting the scope of change to the domains that both parties have the authority to, effectively preventing unauthorized changes. For role subjects, their changeable management domains are determined by checking the binding relationship, realizing secure boundary control for role permission adjustments. Thus, this embodiment can automatically and accurately determine the target management domain of permission change instructions, ensuring that permission changes only occur within the legal scope, avoiding permission overreach and configuration risks caused by manual selection of the scope.

[0026] In one embodiment, such as Figure 3 As shown, based on permission-related data, the target resource of the instruction is traversed to construct a management permission tree for the instruction sending entity under the instruction target management domain, including: Step 301: Parse the target resource of the instruction to obtain multiple resource nodes and determine the resource hierarchy structure of the multiple resource nodes; The preferred resource hierarchy structure includes a multi-level structure of business domain → module → function → operation, such as "order domain → order management module → order details → edit operation"; Step 302: Take the instruction target management domain as the root node, and based on the resource hierarchy, traverse multiple resource nodes from top to bottom, determine the resource nodes without lower-level resources as resource leaf nodes, and generate the resource topology of the instruction target resources. Step 303: Parse the permission association data to obtain the permission items of the instruction sending body for multiple resource leaf nodes; Step 304: Based on the resource topology, the permission items of multiple resource leaf nodes are aggregated upwards from bottom to top to generate the permission items of the upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, so as to generate the management permission tree. The resource topology is preferably generated by predefined resource tree, resource registry or automatic scanning business function, so that the system can adapt to resource changes.

[0027] Specifically, in this embodiment, the resource hierarchy structure is obtained by parsing the target resource of the instruction, and the management domain is used as the root node of the tree. The resource nodes are traversed from top to bottom to generate the resource topology. Then, combined with the permission association data, the permission items of the instruction sending subject on each leaf node are obtained, and the permission aggregation is performed from bottom to top along the resource topology to construct a complete management permission tree. This allows the permission relationship of different resource levels to be uniformly expressed in structure, and the scope of change and permission coverage boundary are visible and controllable. This provides a clear decision basis for subsequent selection of permission leaf nodes and generation of change information, and improves the accuracy and traceability of the permission change process.

[0028] In one embodiment, based on the resource topology, the permission items of multiple resource leaf nodes are aggregated upwards from bottom to top to generate the permission items of the upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, so as to generate a management permission tree, including: Obtain multiple permission items and corresponding permission metadata of the resource leaf node. The permission metadata includes at least: resource identifier, operation type, decision flag, source flag, and applicable constraints. Among them, the resource identifier can be a unique resource ID, such as "order.edit"; the operation type can be read / write / configuration / management, etc.; the decision flag preferably indicates whether the permission is allowed, denied, or inherited; the source flag indicates that the permission comes from role inheritance, direct user authorization, organizational authorization, etc.; the applicable constraints can include time restrictions, IP range, data range (such as limited to this department). Based on permission metadata, multiple permission items of a resource leaf node are normalized and internal conflict is checked. If multiple permission items of the same resource leaf node do not have internal conflicts, then the multiple permission items are determined as leaf layer permission items and used as the aggregation input of the upper-level resource nodes of the resource leaf node. Based on resource identifiers, multiple leaf-level permission items of multiple resource leaf nodes are aggregated to generate a candidate permission set for upper-level resource nodes. Based on decision labels and applicable constraints, determine whether there is one or more of the following conflicts: decision consistency conflict or constraint compatibility conflict among multiple leaf layer permission items in the candidate permission set; In response, the system handles decision consistency conflicts and / or constraint compatibility conflicts according to the preset conflict resolution strategy, and merges multiple leaf-level permission items in the candidate permission set according to the preset merging rules to update the candidate permission set. The conflict resolution strategy preferably adopts a strategy of rejection priority, explicit authorization priority, or selection based on constraint precision. The system can automatically execute the strategy through a preset priority table. Obtain the existing authorization of the parent resource node, merge the updated candidate permission set with the existing authorization, and generate the upper-level permission set of the upper-level resource node; The set of permissions at the upper level is used as the aggregate input for the resource nodes at the next higher level, and so on, until the top-level permission items are obtained.

[0029] Specifically, in this embodiment, by obtaining the permission items and their permission metadata of the resource leaf nodes, performing normalization processing and internal conflict verification, the legality of the underlying permission items is guaranteed. Subsequently, the leaf layer permission items are aggregated based on the resource identifier, and conflicts are detected according to the decision flag and constraint conditions. Combined with the preset conflict resolution strategy and merging rules, the permission set of the upper-level resource nodes is generated, thereby ensuring the consistency of permissions during the upward aggregation process. Then, the aggregation result is merged with the existing authorization of the parent node to form a complete hierarchical permission expression. Thus, this embodiment can automatically handle permission conflicts and maintain the consistency of the permission structure when constructing the permission tree, avoiding unauthorized access or overwriting anomalies caused by the superposition of permissions from different sources.

[0030] In one embodiment, based on a permission change instruction, one or more permission leaf nodes are selected from the management permission tree, and permission change information for the target subject of the instruction is generated according to the permission leaf nodes, including: Parse permission change instructions to determine the change type, which includes at least: permission addition, permission revocation, and permission adjustment. Based on the change type and the target operation of the permission change instruction, match the set of permission leaf nodes corresponding to the target operation from the management permission tree; Parse the permission items and associated permission metadata corresponding to multiple permission leaf nodes in the permission leaf node set; Based on permission items and permission metadata, a permission change unit is generated that represents the direction and scope of permission changes. The permission change unit includes at least the target resource identifier, operation type, change action, and applicable constraints. Multiple permission change units are aggregated to generate permission change information corresponding to the target subject of the instruction.

[0031] Specifically, in this embodiment, the change type is clarified by parsing the permission change instruction, and the set of permission leaf nodes corresponding to the target operation is accurately matched from the management permission tree, so that the change decision is based entirely on the visible and legal permission scope; then the permission items and metadata of the leaf nodes are parsed and organized into permission change units that represent the change direction, resource scope and constraints, and aggregated into structured permission change information. Thus, permission changes can be performed at the smallest resource granularity, avoiding over-authorization caused by overall authorization or indiscriminate coverage, and realizing the accuracy, controllability and traceability of permission changes.

[0032] In one embodiment, the management permissions of the target entity for the target resource are changed based on multiple permission change information, including: Parse permission change information to determine permission additions, permission revocations, and permission adjustments. Based on the target resource identifier, locate the existing authorization records of the target entity under the target resource node; Parse the new permission information, determine the new permission items, and write them into the existing authorization records to form new authorizations; Parse the permission revocation information, identify and delete the permission items to be deleted from the existing authorization records to form a revocation authorization; Parse the permission adjustment information, determine the target permission and the target permission information, and replace or overwrite the existing authorization records based on the target permission information. In response to the addition, revocation, or adjustment of multiple permission items, an updated authorization result set for the instruction target subject is generated; Preferably, to ensure the atomicity of changes, the system preferably uses transaction mode or temporary authorization buffer for batch submissions to avoid permission abnormalities caused by partial success and partial failure of updates.

[0033] Specifically, in this embodiment, by parsing permission change information, the change actions are categorized into three types: addition, revocation, and adjustment. Based on the target resource identifier, the existing authorization records of the instruction target subject are located. Then, addition, deletion, and adjustment / overwrite operations are performed respectively to ensure the atomicity of permission change operations and the consistency of results. Finally, an updated authorization result set is generated, making the permission status of the target subject under the instruction target resource complete, accurate, clear, and traceable. Thus, this embodiment achieves rule-based processing of permission changes, effectively reducing conflicts, omissions, and ambiguous boundaries that are prone to occur during manual maintenance.

[0034] In one embodiment, updating the corresponding permission-related data includes: Based on the updated target subject authorization result set, incremental updates are performed on the permission association records of multiple partition resources. The incremental updates include the addition, deletion and replacement of permission items. Before performing an incremental update, the authorization records of the target subject before the update and the authorization result set after the update are compared to obtain the permission change difference set; Based on the permission change difference set, the affected resource nodes are located according to the resource hierarchy structure, and the corresponding permission-related data is partially updated. After completing the incremental update of permission-related data, version information of the permission-related data is generated. The version information includes at least the version identifier, the subject of the change, the type of change, and the time of change. Based on version information, traceable management is performed on permission-related data to support permission anomaly recovery, audit tracing, or historical permission verification. The version information of permission-related data is preferably represented by timestamps, incrementing version numbers, change IDs, or submission sequence numbers, and can be stored in version lists or audit logs.

[0035] Specifically, in this embodiment, a permission change difference set is generated by comparing the authorization records before and after the update. This allows the system to accurately locate the resource nodes affected by the change and perform only local incremental updates on the corresponding nodes, avoiding the high overhead and consistency risks caused by full rewriting. At the same time, version information of permission-related data is generated, and retrospective management of permission data is performed based on the version information. This supports anomaly recovery, audit tracing, and historical permission verification. As a result, permission-related data can remain consistent, reliable, and auditable in continuously changing scenarios, improving the overall maintainability and security of the system.

[0036] In one embodiment, the method further includes: Based on the permission association data and the updated authorization result set, generate the permission pre-calculation result set for the corresponding management domain, and store the pre-calculation result set in the preset result set storage structure; In response to receiving an authentication request, based on the management domain identifier carried in the request, the pre-computed permission result corresponding to the management domain is read from the distributed cache layer. If the cache is not hit, the pre-computed result is read from the result set storage structure and written to the distributed cache layer. Based on the comparison between the permission information carried in the request and the pre-calculated permission results, authentication feedback information is generated.

[0037] Specifically, in this embodiment, permission pre-calculation results corresponding to each management domain are generated based on permission association data and authorization result sets, and stored in the result set storage structure. When an authentication request arrives, the pre-calculation result of the corresponding management domain is read first from the distributed cache. If the cache is not hit, the result is retrieved from the storage structure and written back to the cache, so that the authentication process has an efficient reading path. Based on the rapid comparison between the requested permission and the pre-calculation result, authentication feedback information can be generated immediately. Thus, this embodiment achieves high-performance response for permission judgment, reduces real-time computing costs, and ensures stable and fast authentication capabilities even in scenarios with frequent permission changes.

[0038] In one specific embodiment, based on the permission association data and the updated authorization result set, a permission pre-calculation result set for the corresponding management domain is generated, including: Retrieve resource records related to the target management domain from the permission association data, and read the final permission items of the instruction target subject under the management domain from the updated authorization result set. The permission items include at least: resource identifier, set of allowed operation types, applicable constraint flags, and permission decision results. Based on the resource identifier of the permission item, multiple permission items are grouped according to the resource dimension to obtain the resource permission set under the target management domain. The resource permission set is preferably expressed using a key-value structure of "resource identifier → permission item list". The permission determination specification is performed on multiple permission items in the resource permission set. Preferably, the permission items with conflicting permissions are processed according to the preset decision rule of "removing those with higher priority than authorization", and a single permission determination result is generated. The permission determination result includes at least: Allow, Deny, Allow-with-constraint, Inherit, etc. The permission determination results after the specification are reorganized into a structured mapping table according to the resource identifier, forming a permission pre-calculation result set. Preferably, the permission pre-calculation result set is represented by a structured mapping of "resource identifier → determination result", so that the permission tree can be directly compared and read without expanding it or re-executing the conflict resolution logic during authentication. The pre-computed permission result set is written into a preset result set storage structure. The result set storage structure preferably includes a relational database, key-value structured storage, or object storage. The storage key of the pre-computed permission result set is preferably prefixed with a management domain to achieve complete isolation between different management domains, for example: "auth:domain:order:user:123".

[0039] In another specific embodiment, a corresponding version number or digest verification value can also be generated for each pre-calculated result set, which facilitates the rapid verification of the consistency and validity of the permission results during subsequent permission changes, cache reclamation, or audit tracing.

[0040] In one embodiment, the method further includes: Real-time monitoring of resource change events related to permission resources in the target system, and determination of the changed permission resources and their corresponding management domains based on the resource change events; Based on the changed permission resources, identify the set of affected partition resources and determine the set of management entities that depend on the partition resources; Among them, resource change events preferably include adding resources, deleting resources, changing resource paths, merging or splitting businesses, etc.; the affected entities can be automatically deduced through the "dependency graph" or "resource reference table"; Based on the set of affected management entities, the corresponding permission items or permission constraints are recalculated to generate an updated set of management entity authorization results. The updated management entity authorization result set is applied to the permission association data, and incremental updates are performed on the permission records related to the partition resources. Based on the updated permission association data, the permission pre-calculation result set of the corresponding management domain is regenerated, and the cached content in the distributed cache layer is updated to ensure the real-time performance and consistency of the authentication results.

[0041] Specifically, in this embodiment, by real-time monitoring of change events related to permission resources and automatically identifying the affected partition resources and the management entities that depend on these resources, changes in the resource structure can be mapped to the permission structure in a timely manner. Then, permission items or constraints are recalculated for the affected entities and their authorization records are updated, while incremental updates are performed on the relevant permission-related data. Finally, the permission pre-calculation results of the management domain are regenerated and the distributed cache is updated to ensure real-time synchronization of authentication data. Thus, this embodiment keeps the permission system and resource structure dynamically consistent, which can effectively reduce the risks of permission lag, unauthorized residues, and permission mismatch caused by resource structure adjustments.

[0042] It should be understood that, although Figure 2 and Figure 3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 and Figure 3 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0043] In one embodiment, such as Figure 4 As shown, a permission management device is provided, including: a permission association module, a target determination module, a permission tree construction module, a change information generation module, and a permission change module, wherein: The permission association module is used to assign multiple partition resources obtained from the permission resource partitioning of the target system to the corresponding management domains, and to establish permission association data between multiple management entities and multiple partition resources, using the management domains as the permission scope. The target determination module is used to determine the sending body and the target body of the instruction in response to receiving the permission change instruction, and to determine the target management domain of the instruction corresponding to the permission change instruction based on the set of management domains associated with the sending body and the set of modifiable management domains of the target body. The permission tree construction module is used to identify the partition resources corresponding to the instruction target management domain as instruction target resources, and based on permission association data, to traverse the instruction target resources and construct the management permission tree of the instruction sending subject under the instruction target management domain. The change information generation module is used to select one or more permission leaf nodes from the management permission tree based on the permission change command, and generate permission change information for the target subject of the command based on the permission leaf node. The permission change module is used to change the management permissions of the target entity of the instruction to the target resource based on multiple permission change information.

[0044] For specific limitations regarding the access control device, please refer to the limitations on access control methods described above, which will not be repeated here. Each module in the aforementioned access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0045] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores access control data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements an access control method.

[0046] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0047] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: The multiple partition resources obtained from the permission resource partitioning of the target system are respectively assigned to the corresponding management domains, and the management domains are used as the permission scope to establish permission association data between multiple management entities and multiple partition resources; In response to receiving a permission change instruction, the sending subject and the target subject of the instruction are determined, and the target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the sending subject and the set of modifiable management domains of the target subject. The partition resources corresponding to the command target management domain are identified as command target resources. Based on the permission association data, the command target resources are traversed to construct the management permission tree of the command sending entity under the command target management domain. Based on the permission change command, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the command according to the permission leaf nodes; Based on multiple permission change information, change the management permissions of the target entity of the instruction to the target resource.

[0048] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: The multiple partition resources obtained from the permission resource partitioning of the target system are respectively assigned to the corresponding management domains, and the management domains are used as the permission scope to establish permission association data between multiple management entities and multiple partition resources; In response to receiving a permission change instruction, the sending subject and the target subject of the instruction are determined, and the target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the sending subject and the set of modifiable management domains of the target subject. The partition resources corresponding to the command target management domain are identified as command target resources. Based on the permission association data, the command target resources are traversed to construct the management permission tree of the command sending entity under the command target management domain. Based on the permission change command, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the command according to the permission leaf nodes; Based on multiple permission change information, change the management permissions of the target entity of the instruction to the target resource.

[0049] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0050] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0051] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for managing access permissions, characterized in that, include: Multiple partition resources obtained from the permission resource partitioning of the target system are assigned to their respective management domains, and the management domains are used as permission scopes to establish permission association data between multiple management entities and multiple partition resources. In response to receiving a permission change instruction, the instruction sending subject and the instruction target subject are determined, and the instruction target management domain corresponding to the permission change instruction is determined based on the set of management domains associated with the instruction sending subject and the set of changeable management domains of the instruction target subject. The partition resources corresponding to the instruction target management domain are determined as instruction target resources, and based on the permission association data, the instruction target resources are traversed to construct the management permission tree of the instruction sending entity under the instruction target management domain; Based on the permission change instruction, select one or more permission leaf nodes from the management permission tree, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; Based on multiple permission change information, the management permissions of the instruction target entity over the instruction target resource are changed.

2. The access control method according to claim 1, characterized in that, The step of assigning multiple partition resources obtained from the permission resource partitioning of the target system to corresponding management domains, and using the management domains as permission scopes, to establish permission association data between multiple management entities and multiple partition resources includes: Based on the business entities in the target system, determine the permission resources controlled by management permissions; Based on at least one or more of the subordinate relationship between the permission resources and business entities, isolation requirements, and access boundaries, the permission resources are partitioned to obtain multiple partitioned resources; The partitioned resources are assigned to a preset management domain, and one or more management entities are set up to be associated with the management domain; Based on the association between the management entity and the management domain, the management authority of the management entity over the partition resources within the management domain is determined; Based on the management permissions of the multiple management entities for the multiple partition resources, permission association data corresponding to the management permissions is established.

3. The access control method according to claim 1, characterized in that, The step of determining the instruction sending entity and the instruction target entity, and determining the instruction target management domain corresponding to the permission change instruction based on the set of management domains already associated with the instruction sending entity and the set of modifiable management domains of the instruction target entity, includes: Parse the permission change instruction to determine the type of the management entity corresponding to the target entity of the instruction. The management entity includes at least: user entities that can send and receive instructions and role entities that cannot send and receive instructions. In response to the user subject corresponding to the target subject of the instruction, the user management domain associated with the user subject is obtained, and the set of changeable management domains is generated based on the business scope that the user can be authorized to. Obtain the set of management domains associated with the instruction sending entity, and perform an intersection operation with the set of changeable management domains to obtain the intersection result; If the intersection result is not empty, then the intersection result is taken as the instruction target management domain; If the intersection result is empty, the permission change instruction is deemed invalid. If the target entity of the instruction is the role entity, then check whether there is a binding relationship between the instruction sending entity and the instruction target entity; If so, the set of management domains associated with the instruction sending subject shall be taken as the set of changeable management domains of the instruction target subject, and the set of changeable management domains shall be taken as the instruction target management domain; If not, the permission change instruction is deemed invalid.

4. The access control method according to claim 1, characterized in that, The step of traversing the target resource of the instruction based on the permission association data and constructing the management permission tree of the instruction sending entity under the management domain of the instruction target includes: The target resource of the instruction is parsed to obtain multiple resource nodes, and the resource hierarchy structure of the multiple resource nodes is determined. Using the instruction target management domain as the root node, and based on the resource hierarchy, traversing multiple resource nodes from top to bottom, determining the resource nodes without lower-level resources as resource leaf nodes, and generating the resource topology of the instruction target resource; Parse the permission association data to obtain the permission items of the instruction sending body for multiple resource leaf nodes; Based on the resource topology, the permission items of multiple resource leaf nodes are aggregated upwards from bottom to top to generate the permission items of the upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, so as to generate the management permission tree.

5. The access control method according to claim 4, characterized in that, Based on the resource topology, the permission items of multiple resource leaf nodes are aggregated upwards from bottom to top to generate the permission items of upper-level resource nodes, until the top-level permission items corresponding to the root node are obtained, in order to generate the management permission tree, including: Obtain multiple permission items and corresponding permission metadata of the resource leaf node, wherein the permission metadata includes at least: resource identifier, operation type, decision flag, source flag and applicable constraints; Based on the permission metadata, the multiple permission items of the resource leaf node are normalized and internal conflict is checked. If there is no internal conflict among the multiple permission items of the same resource leaf node, the multiple permission items are determined as leaf layer permission items and used as the convergence input of the upper layer resource node of the resource leaf node. Based on the resource identifier, multiple leaf layer permission items of multiple resource leaf nodes are aggregated to generate a candidate permission set for the upper-layer resource node. Based on the decision marker and the applicable constraints, determine whether there is one or more of the following conflicts: decision consistency conflict or constraint compatibility conflict among the multiple leaf layer permission items in the candidate permission set; In response, the decision consistency conflict and / or constraint compatibility conflict are handled according to a preset conflict resolution strategy, and multiple leaf layer permission items in the candidate permission set are merged according to a preset merging rule to update the candidate permission set. Obtain the existing authorization of the parent resource node, merge the updated candidate permission set with the existing authorization, and generate the upper-level permission set of the upper-level resource node; The set of upper-level permissions is used as the aggregate input for the next higher-level resource nodes, and so on, until the top-level permission item is obtained.

6. The access control method according to claim 1, characterized in that, The step of selecting one or more permission leaf nodes from the management permission tree based on the permission change instruction, and generating permission change information for the target subject of the instruction based on the permission leaf nodes, includes: Parse the permission change instruction to determine the change type, which includes at least: permission addition, permission revocation, and permission adjustment; Based on the change type and the target operation of the permission change instruction, match the set of permission leaf nodes corresponding to the target operation from the management permission tree; Parse the permission items and associated permission metadata corresponding to multiple permission leaf nodes in the permission leaf node set; Based on the permission item and the permission metadata, a permission change unit representing the direction and scope of permission change is generated. The permission change unit includes at least the target resource identifier, operation type, change action and applicable constraints. Multiple permission change units are aggregated to generate permission change information corresponding to the target subject of the instruction.

7. The access control method according to claim 6, characterized in that, The step of changing the management permissions of the instruction target subject to the instruction target resource based on multiple permission change information includes: Parse the permission change information to determine permission addition information, permission revocation information, and permission adjustment information; Based on the target resource identifier, locate the existing authorization records of the instruction target subject under the target resource node; The permission addition information is parsed to determine the new permission item and write it into the existing authorization record to form a new authorization; The permission revocation information is parsed, and the permission items to be deleted are identified and deleted from the existing authorization records to form a revocation of authorization; The permission adjustment information is parsed to determine the target permission and the target permission information, and the existing authorization records are replaced or overwritten based on the target permission information. In response to the addition, revocation, or adjustment of multiple of the aforementioned permission items, an updated instruction target subject authorization result set is generated.

8. An access control device, characterized in that, The device includes: The permission association module is used to assign multiple partition resources obtained from the permission resource partitioning of the target system to the corresponding management domains, and to establish permission association data between multiple management entities and multiple partition resources using the management domains as the permission scope. The target determination module is used to, in response to receiving a permission change instruction, determine the instruction sending body and the instruction target body, and determine the instruction target management domain corresponding to the permission change instruction based on the set of management domains associated with the instruction sending body and the set of changeable management domains of the instruction target body; The permission tree construction module is used to determine the partition resources corresponding to the instruction target management domain as instruction target resources, and based on the permission association data, to traverse the instruction target resources and construct the management permission tree of the instruction sending entity under the instruction target management domain. The change information generation module is used to select one or more permission leaf nodes from the management permission tree based on the permission change instruction, and generate permission change information for the target subject of the instruction according to the permission leaf nodes; The permission change module is used to change the management permissions of the instruction target subject to the instruction target resource based on multiple permission change information.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images