Authority management method and device, storage medium and electronic equipment

Abstract

The invention discloses an authority management method and device, a storage medium and electronic equipment, and belongs to the technical field of resource management. The resource initialization request carries user information of a target user, resource information of a target resource, and resource information and association relationships of all associated resources associated with the target resource; data in domain models are updated according to the resource initialization request, the domain models comprise a user domain, a resource domain, an action domain and an authority domain, the user domain is used for maintaining users, the resource domain is used for maintaining resources and association relationships thereof, and the action domain is used for maintaining access operation, access authority and association relationships thereof; the permission field is used for maintaining the incidence relation among resources, access permissions and users; and performing authority management on the target resource based on the updated domain model, thereby realizing refined authority management on each resource in the MLOps platform, and realizing high flexibility.

Description

Technical Field

[0001] This application belongs to the field of resource management technology, and in particular relates to a permission management method, device, storage medium and electronic device. Background Technology

[0002] Machine Learn Operations (MLOps) platforms are designed to automate the entire machine learning process, from data preparation and model training to deployment and monitoring, enabling organizations to develop and deploy machine learning models faster, more reliably, and at scale. MLOps platforms improve the reliability, repeatability, scalability, and security of machine learning systems by integrating various tools and technologies such as automated testing, continuous integration / continuous deployment (CI / CD), containerization, orchestration, monitoring, and log management.

[0003] Access control refers to the process of assigning and controlling user permissions within a system to ensure that users can only access or operate resources or services they are authorized to access. A common access control method is Role-Based Access Control (RBAC). RBAC assigns different roles to users, each bound to a specific set of permissions, including both resource and operational permissions. When a new user is added, assigning them a role completes access control. However, MLOps platforms contain various resources, such as datasets, operator models, cleaning rules, and machine resources, and the quantity of each resource accumulates over time. If the RBAC model is used to manage permissions for resources on an MLOps platform, it can only manage resources by broad categories. For example, roles such as developers, operations personnel, algorithm engineers, and administrators are predefined. Algorithm engineers have permissions for all datasets and operator models, while operations personnel have permissions for all machine resources. However, if a role is assigned to each resource, a large number of different roles need to be maintained, which not only weakens the representativeness of the roles but also increases the maintenance cost. Therefore, the RBAC model cannot manage permissions for every resource on an MLOps platform, and its permission management granularity is relatively coarse. Summary of the Invention

[0004] This application aims to address at least one of the technical problems existing in the prior art. To this end, this application proposes a permission management method, apparatus, storage medium, and electronic device, which can perform fine-grained permission management of MLOps platform resources with high flexibility.

[0005] Firstly, this application provides a method for managing access rights, including:

[0006] Obtain the resource initialization request sent by the business-side system for the target resource. The resource initialization request carries the user information of the target user, the resource information of the target resource, the resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource.

[0007] The domain model is updated according to the resource initialization request to grant the target user initial access to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access permissions, and their relationships, and the permission domain is used to maintain the relationships between the resource, the access permissions, and the user.

[0008] Access control is performed on the target resource based on the updated domain model.

[0009] Secondly, this application provides an access control device, comprising:

[0010] The acquisition unit is used to acquire a resource initialization request sent by the business-side system for the target resource. The resource initialization request carries user information of the target user, resource information of the target resource, resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource.

[0011] The model update unit is used to update the data in the domain model according to the resource initialization request, so as to grant the target user initial access rights to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access rights, and their relationships, and the permission domain is used to maintain the relationships between the resource, the access rights, and the user.

[0012] The permission management unit is used to manage permissions for the target resource based on the updated domain model.

[0013] In some embodiments, the permission management unit is specifically used for:

[0014] Based on the updated domain model and the authorization management page of the target resource, authorization is granted to the target resource, or the target resource and at least one of the associated resources.

[0015] In some embodiments, the user domain is further configured to maintain user groups and the association between the user and the user group, and the permission domain is further configured to maintain the association between the resource, the access permission, and the user group; the permission management unit is specifically configured to:

[0016] Access the authorization management page of the target resource. The authorization management page is used to provide at least one authorizable object and at least one first grantable permission corresponding to the target resource. The authorizable object includes users and / or user groups.

[0017] In response to a first user operation entered on the authorization management page, first authorization configuration information is obtained, the first authorization configuration information including a target authorizable object selected from the authorizable objects and a first target permission selected from the first grantable permissions;

[0018] Update the data in the permission domain and the user domain according to the first authorization configuration information, so as to grant the first target permission of the target resource to the target authorizable object.

[0019] In some embodiments, the authorization management page is further configured to provide associated resource interfaces corresponding to each of the authorizable objects, and the permission management unit is further configured to:

[0020] In response to the call operation of the associated resource interface, a list of associated resources of the target resource is displayed. The list of associated resources includes at least one authorizable associated resource associated with the target resource, and at least one second grantable permission corresponding to each authorizable associated resource.

[0021] In response to a second user operation inputting the associated resource list, second authorization configuration information is obtained, the second authorization configuration information including at least one target associated resource selected from the authorizable associated resources, and a second target permission selected from the second grantable permissions;

[0022] Update the data in the permission domain and the user domain according to the second authorization configuration information, so as to grant the second target permission of the target associated resource to the corresponding authoritative object.

[0023] In some embodiments, the permission management unit is used for:

[0024] Obtain the authentication request sent by the business-side system. The authentication request is used to instruct whether the user to be accessed has the permission to perform a target access operation on at least one resource to be accessed. The resource to be accessed includes the target resource, or the target resource and at least one associated resource.

[0025] Based on the authentication request, the authentication result of the user to be accessed is determined based on the updated domain model;

[0026] Based on the authentication result, the user to be accessed is controlled to perform the target access operation on the resource to be accessed.

[0027] In some embodiments, when the business-side system uses API authentication, the authentication request includes user information of the user to be accessed, resource information of at least one of the resources to be accessed, and at least one target access operation, with each resource to be accessed corresponding to one target access operation; the permission management unit is used for:

[0028] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined according to the permission domain, the action domain, and the user domain.

[0029] In some embodiments, the user domain is further configured to maintain user groups and the association between the user and the user group; the permission domain is further configured to maintain the association between the resource, the access permission, and the user group; the permission management unit is configured to:

[0030] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, query whether the user to be accessed has the permission for the corresponding target access operation of each resource to be accessed, based on the permission domain and the action domain.

[0031] If so, then the authentication result of the user to be accessed is determined to be successful.

[0032] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each of the resources to be accessed; when the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each of the access operations, determine that the authentication result of the user to be accessed is successful.

[0033] In some embodiments, when the business-side system uses annotation authentication, the authentication request includes the target authentication mode, the user information of the user to be accessed, and the resource information of the target resource and the corresponding target access operation; the permission management unit is used for:

[0034] Based on the target authentication mode, the resource information of the target resource, and the resource domain, at least one of the resources to be accessed is determined;

[0035] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined according to the permission domain, the action domain, and the user domain.

[0036] In some embodiments, the permission management unit is used for:

[0037] When the target authentication mode indicates that authentication is only performed on the current resource, the target resource is used as the resource to be accessed.

[0038] When the target authentication mode indicates authentication of the current resource and the input resource, the associated resource that is related to the target resource and whose association relationship is input is queried from the resource domain according to the resource information of the target resource, and the queried associated resource and the target resource are used as the resource to be accessed;

[0039] When the target authentication mode indicates authentication of the current resource and the output resource, the associated resource that is associated with the target resource and whose association relationship is output is queried from the resource domain according to the resource information of the target resource, and the queried associated resource and the target resource are used as the resource to be accessed;

[0040] When the target authentication mode indicates authentication for all resources, the associated resources related to the target resource are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resources to be accessed.

[0041] In some embodiments, the user domain is further configured to maintain user groups and the association between the user and the user group; the permission domain is further configured to maintain the association between the resource, the access permission, and the user group; the permission management unit is configured to:

[0042] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, and based on the permission domain and the action domain, query whether the user to be accessed has permission for the same target access operation for each of the resources to be accessed;

[0043] If so, then the authentication result of the user to be accessed is determined to be successful.

[0044] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has permission for the same target access operation for each of the resources to be accessed; when the user group to which the user to be accessed belongs has permission for the same target access operation for each of the access operations, determine that the authentication result of the user to be accessed is successful.

[0045] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the permission management method described in any of the above claims.

[0046] Fourthly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the permission management method described in any of the above claims.

[0047] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the permission management method described in any of the above claims.

[0048] The permission management method, apparatus, storage medium, electronic device, and computer program product provided in this application obtain a resource initialization request sent by the business-side system for a target resource. The resource initialization request carries user information of the target user, resource information of the target resource, resource information of all associated resources related to the target resource, and the association relationship between each associated resource and the target resource. Based on the resource initialization request, the data in the domain model is updated to grant the target user initial access permissions to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their association relationships, the action domain is used to maintain access operations, access permissions, and their association relationships, and the permission domain is used to maintain the association relationship between resources, access permissions, and users. Permission management of the target resource is performed based on the updated domain model. That is, during resource initialization, the permission mapping relationship and resource association relationship of the resource are maintained in the domain model. Permission management of the resource is performed based on the domain model, thereby enabling fine-grained permission management for each resource in the MLOps platform, providing high flexibility, and reducing the development and maintenance costs of the business-side system. Attached Figure Description

[0049] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart illustrating the permission management method provided in an embodiment of this application;

[0051] Figure 2 This is a schematic diagram of the architecture of the domain model provided in an embodiment of this application;

[0052] Figure 3 This is another flowchart illustrating the permission management method provided in the embodiments of this application;

[0053] Figure 4 A schematic diagram of the permission management device provided in this application embodiment;

[0054] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application;

[0055] Figure 6 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0056] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0057] In existing technologies, access control methods for platform resources mainly include two types: Role-Based Access Control (RBAC) and Access Control Lists (ACL). RBAC assigns permissions to users based on roles. For example, the system predefines roles such as developers, operations personnel, algorithm engineers, and administrators, and pre-binds corresponding permissions for resources such as development resources, machine resources, model operator resources, and all resources to these roles. When a new user is added, assigning a role completes access control, thus greatly reducing maintenance costs, which is why RBAC is widely used. ACL, on the other hand, maintains an association mapping table for each object (resource), recording the access permissions granted to the subject (user) accessing the object (resource). When a subject attempts to access an object, the system checks the association mapping table to determine whether access is permitted.

[0058] However, these two access control methods have some issues when dealing with resources on Machine Learn Operations (MLOps) platforms. Specifically:

[0059] The RBAC model cannot achieve fine-grained permission management for MLOps platform resources. This is mainly because MLOps platforms contain various resources, such as datasets, operator models, cleaning rules, machine resources, etc., and the quantity of each type of resource accumulates over time. If permission management were implemented for each dataset based on the RBAC model, the permutations and combinations of different permissions for different resources would require the system to maintain a large number of different roles. This not only weakens the representativeness of the roles but also increases the maintenance cost. Therefore, the RBAC model is more suitable for managing broad categories of resources. For example, algorithm engineers might have permissions for all datasets and operator models, while operations and maintenance personnel might have permissions for all machine resources. Thus, the RBAC model cannot provide fine-grained permission management for each individual resource.

[0060] For ACL models, since resources in MLOps platforms are often interconnected—for example, an ML algorithm model might depend on multiple datasets—directly using ACL models for access control can lead to the following problems: 1. When a user requests access to a specific ML algorithm model, they must sequentially request access to all its dependent datasets, performing multiple authorization operations. 2. When a business system requests access to an ML algorithm model, it may simultaneously access its dependent datasets. Therefore, in addition to authenticating the current ML algorithm model, authentication is required for each dependent dataset. In this scenario, when integrating the access control service, the business system needs to explicitly write code to assemble request parameters, resulting in significant intrusion into the business code and increasing the development and maintenance costs of the business system.

[0061] To address at least one of the aforementioned technical problems, embodiments of this application provide a permission management method, apparatus, storage medium, electronic device, and computer program product.

[0062] Please see Figure 1 , Figure 1 This is a flowchart illustrating the permission management method provided in this application embodiment. The permission management method is applied to an electronic device and can be executed by the electronic device or a functional module or entity within the electronic device. The electronic device is a backend device of a Machine Learn Operations (MLOps) platform. The target platform includes a business-side system and a permission management system. The permission management system can manage permissions for resources created by the business-side system, such as authorization and authentication management.

[0063] Specifically, this access control method includes the following steps 101-103, wherein:

[0064] 101. Obtain the resource initialization request sent by the business side system for the target resource. The resource initialization request carries the user information of the target user, the resource information of the target resource, the resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource.

[0065] User information includes a user's unique identifier, such as a user account. Resource information includes a resource's unique identifier and resource type, which includes, but is not limited to, datasets, sample sets, data cleaning rules, operator models, projects, and model testing. Relationships include inputs and outputs; for example, if resource A is an output resource of resource B, then resource A is an associated resource of resource B, and the relationship is output.

[0066] When a user creates a new resource through the business-side system, the newly created resource is automatically designated as the target resource, the creating user as the target user, and a resource initialization request is generated and sent to the access control system. Specifically, when a user wants to create the current resource, they need to fill out a form in the business-side system to initiate a request. The form must include at least the following information: the unique identifier and resource type of the current resource, the creating user of the current resource, and the unique identifier, resource type, and association relationship of the associated resources. Next, the business-side system queries the associated resources based on the form information, processes the logic, and generates the resource to realize the creation of the current resource. Afterwards, the user identifier of the creating user, the resource identifiers and resource types of the created and associated resources, and their association relationship are transmitted to the access control system. The access control system will configure the initial access permissions for the resource for the creating user based on this information, typically granting the creating user the highest access permissions for that resource.

[0067] It should be noted that during resource creation, in addition to handling the resource creation logic, the business-side system also needs to obtain relevant parameters of associated resources and assemble them to generate the resource initialization request. Therefore, this involves some intrusion into the business-side system code, but the degree of intrusion is relatively small. This cost is acceptable to a certain extent because typically only one creation or update method is provided for a resource, while multiple query methods can be provided. Maintaining resource relationships increases the maintenance cost of the corresponding resource creation or update methods, but it can significantly reduce the maintenance cost of the query methods. Overall, maintaining resource relationships can reduce the development and maintenance costs of the business-side system code to a certain extent.

[0068] 102. Update the data in the domain model according to the resource initialization request to grant the target user initial access to the target resource. The domain model includes user domain, resource domain, action domain and permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access permissions and their relationships, and the permission domain is used to maintain the relationships between resources, access permissions and users.

[0069] For example, see Figure 2 , Figure 2 This is a schematic diagram of the domain model architecture provided in this application embodiment. The domain model is based on the ACL model and incorporates the concept of roles from the RBAC model. The entire domain model consists of four parts: user domain, action domain, resource domain, and permission domain. The user domain is responsible for maintaining users, mainly maintaining user identification information, such as user accounts. The user domain can also be used to maintain user groups and the relationships between users and user groups. A user group is a collection of users, forming a many-to-many relationship with users. Both users and user groups can act as authorization subjects. When a user joins a user group, they will inherit the user group's permissions through a reference chain such as user-user group-permission, but the permission priority of the user group is lower than that of the user's permission priority, so as to achieve the effect of customized permissions for individual users within the group.

[0070] The Action Domain is designed based on the concept of roles in the RBAC model. It defines access operations and access permissions for a resource. Each access permission represents an operation group, which is a collection of access operations containing one or more different access operations at the same permission level. These are abstracted into objects with practical meaning. Users authorize resources using operation groups as the smallest unit. For example, access operations include, but are not limited to, "view," "edit," "reference," "download," and "manage." Access permissions, from lowest to highest, include "view only," "editable," "manageable," and "owner." "Viewable" can contain only the "view" access operation; "editable" can contain both "view" and "edit" access operations; and "manageable" can contain "view," "edit," "reference," "download," and "manage." "Owner" can contain all of the above access operations, and this permission cannot be removed by others; only the resource owner can actively transfer the "owner" permission. A resource must have one and only one owner.

[0071] The resource domain is responsible for maintaining resources and their relationships. Resource maintenance involves resource identification and resource types. For example, resource types include, but are not limited to, datasets, sample sets, data cleaning rules, operator models, projects, and model testing. Resource relationships include inputs and outputs.

[0072] The permission domain is designed based on the ACL model. It is responsible for maintaining the mapping relationships between users, actions, and resources, as well as the mapping relationships between user groups, actions, and resources. Simultaneously, the permission domain is responsible for providing services such as authorization, authentication, and permission query. Each mapping relationship is a permission record, and each permission record represents a user or user group's access rights to a certain resource. All permission records corresponding to the same resource can form a list. Based on this list and the data maintained by the user, action, and resource domains, fine-grained permission management for that resource can be achieved.

[0073] For the domain model described above, when it's necessary to initialize a newly created resource, it's equivalent to building information about creating a user, creating a resource, and initial access permissions in the permission and user domains, and building information about creating the resource and its associated resources in the resource domain. Typically, the initial access permissions a user has are the aforementioned "owner" permissions.

[0074] 103. Perform permission management on target resources based on the updated domain model.

[0075] Access control mainly includes authorization and authentication. For example, for an initialized resource, the resource owner can authorize other users or user groups to have certain access permissions to the resource based on the domain model. Or, when some users need to access the resource, they can be authenticated based on the domain model. Only after successful authentication can the user be allowed to perform the corresponding access operation on the resource.

[0076] For example, when performing authorization management, please refer to Figure 3 , Figure 3 This is another flowchart illustrating the permission management method provided in this application embodiment. Step 103 specifically includes:

[0077] 1031. Based on the updated domain model and the authorization management page of the target resource, authorize the target resource, or the target resource and at least one associated resource.

[0078] Each created resource (e.g., a target resource) can be configured with a resource permission management interface. Users can call this interface to request access to the authorization management page for the current resource. The authorization management system then verifies the user's access permissions. Generally, only users with management permissions for the current resource (i.e., users with the aforementioned "owner" and "manageable" permissions) are allowed to access the authorization management page and perform authorization operations on the current resource. Furthermore, because resources in the MLOps platform are highly interconnected, a user typically has management permissions for multiple resources. For example, an algorithm developer might independently complete the entire development process from dataset to operator to project. Therefore, in addition to authorizing the current resource, the authorization management page can also authorize related resources.

[0079] Typically, the content displayed on the authorization management page for each resource is primarily derived from the domain model, and it can display the following information: 1. Information on authorized users and user groups. 2. Information on permissions already granted to the current resource, such as which users or user groups have been granted which access permissions (users can usually only grant others permissions lower than their own). 3. Information on permissions that can be granted to the current resource, such as which access permissions can be granted and what access operations correspond to each access permission. Accordingly, users can configure access permissions on the authorization management page, including: 1. Deleting the access permissions of an authorized object. 2. Changing the access permissions of an authorized object. 3. Searching for and adding new authorized objects and granting them specific access permissions. 4. Managing access permissions for a batch of related resources of a given authorized object.

[0080] For example, when authorizing the current resource through the authorization management page, if the user domain is also used to maintain user groups and the association between users and user groups, and the permission domain is also used to maintain the association between resources, access permissions, and user groups, then step 1031 above may include:

[0081] Display the authorization management page of the target resource. The authorization management page is used to provide at least one authorizable object and at least one first grantable permission corresponding to the target resource. The authorizable object includes users and / or user groups.

[0082] In response to a first user action entered on the authorization management page, first authorization configuration information is obtained, which includes a target authorizable object selected from the authorizable objects and a first target permission selected from the first grantable permissions;

[0083] Update the data in the permission domain and the user domain according to the first authorization configuration information, so as to grant the first target permission of the target resource to the target authoritative object.

[0084] Specifically, the first user action is a selection action, and the first level of grantable permission is usually lower than the permission level already possessed by the target user. When a user with administrative privileges enters the authorization management page of the target resource, they can select one of the authorizable objects provided on the authorization management page as the target authorizable object, and select a first grantable permission for the target authorizable object as the first target permission. After the selection operation is completed, this content is submitted to the permission management system as the first authorization configuration information. Subsequently, the permission management system updates the data in the domain model based on the submitted information, mainly storing the relevant information of the target authorizable object, the first target permission, and the target resource in the aforementioned permission domain and user domain, thereby realizing authorization and displaying the authorization result to the user.

[0085] Because the user domain also maintains user groups and the relationships between users and user groups, users with management privileges can not only grant permissions to target resources to other users individually, but also grant permissions in batches. For example, when there are many users who need to be authorized, such as multiple algorithm developers participating in the development of the same project and needing to share resources, a user group can be created. All users in the user group share the permissions of all resources bound to the user group. In this case, it is only necessary to grant permissions to the target resources to the user group to complete the authorization of a batch of users.

[0086] Furthermore, when authorizing associated resources of the current resource through the authorization management page, the authorization management page can also be used to provide the associated resource interface corresponding to each authorizable object. In this case, step 1031 above also includes:

[0087] In response to the call operation of the associated resource interface, a list of associated resources of the target resource is displayed. The list of associated resources includes at least one authorizable associated resource associated with the target resource, and at least one second grantable permission corresponding to each authorizable associated resource.

[0088] In response to a second user operation inputting the list of associated resources, second authorization configuration information is obtained, which includes at least one target associated resource selected from the authorizable associated resources and a second target permission selected from the second grantable permissions;

[0089] Update the data in the permission domain and the user domain according to the second authorization configuration information, so as to grant the second target permission of the target associated resource to the corresponding authoritative object.

[0090] Specifically, authorizable associated resources are all or part of the associated resources of the target resource, and these are the associated resources that the current user can authorize. The second user action is a selection action. On the aforementioned authorization management page, an associated resource interface can be provided for each added authorized user. The user with management permissions (the current user) can click this interface. At this time, the permission management system will retrieve data from the domain model to generate a list of associated resources and display it to the user. The associated resource list mainly includes all the associated resources of the target resource that can be authorized by the current user, as well as the second authorizable permissions that the current user can grant. Typically, the level of the second authorizable permission is lower than the permission level that the current user already possesses.

[0091] Currently, users can select one or more target associated resources from these authorizable associated resources, and choose the desired second target permissions for each target associated resource. After the selection is completed, these contents are submitted to the permission management system as second authorization configuration information. Subsequently, the permission management system will update the data in the domain model based on the submitted information. For example, it will first perform deduplication, then compare and delete the old permission information, and generate a new permission information to be stored in the permission domain, thereby realizing the authorization of associated resources.

[0092] It should be noted that, in this embodiment of the application, when granting access permissions to a target resource or its associated resources to other users, it is only necessary to find and enter the authorization management page of the target resource to perform the operation. There is no need to enter the authorization management page of the associated resources. That is, assuming that an operator model depends on three associated resources, namely the dataset, cleaning rules, and computing resources, if it is necessary to authorize the operator model and its dependent resources, it is only necessary to call the authorization interface once to enter the authorization management page of the operator model. There is no need to enter the authorization management page of its dependent resources, thereby greatly simplifying the authorization process and reducing the complexity of the authorization operation.

[0093] In other embodiments, when authorization is required for the operator model and its three dependent resources, the user must first locate and access the operator model's authorization management page. This page then invokes the permission management system to grant access permissions to the operator model to other users and returns the authorization result. Next, the user locates and accesses the authorization management page of the first dependent resource, invoking the permission management system to grant access permissions to that resource to other users. This process is repeated for the second and third dependent resources. Clearly, authorizing the operator model and its three dependent resources requires calling the authorization interface four times to access different authorization management pages. The entire authorization process is complex and cumbersome, inefficient, and results in a poor user experience.

[0094] In addition to enabling authorization management for individual or batch users of target resources and their associated resources, it also allows for authentication management of target resources. Please see [link to relevant documentation]. Figure 3 Step 103 above specifically includes:

[0095] 1032. Obtain the authentication request sent by the business side system. The authentication request is used to instruct whether the user to be accessed has the permission to perform a target access operation on at least one resource to be accessed. The at least one resource to be accessed includes the target resource, or the target resource and at least one associated resource.

[0096] 1033. Based on the authentication request, determine the authentication result of the user to be accessed based on the updated domain model;

[0097] 1034. Based on the authentication result, control the user to be accessed to perform the target access operation on the resource to be accessed.

[0098] Since the domain model maintains not only resource and user information but also the relationships between resources, it can authenticate related resources simultaneously when authenticating the target resource. If authentication is successful, the user is allowed to perform the target access operation on the resource; if authentication fails, the user is prohibited from performing the target access operation on the resource.

[0099] Specifically, the access control system can provide two methods for business systems to access and implement authentication services: application programming interface (API) and annotation. That is, business systems can use either API authentication or annotation authentication, and can choose freely according to the specific needs of the scenario.

[0100] In some embodiments, when the business-side system uses API authentication, the authentication request includes user information of the user to be accessed, resource information of the at least one resource to be accessed, and at least one target access operation, with each resource to be accessed corresponding to one target access operation. In this case, step 1033 specifically includes:

[0101] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined based on the permission domain, the action domain, and the user domain.

[0102] In other words, when using API authentication, an authentication mechanism needs to be configured at the API interface, and a list needs to be passed to the permission management system. Each element in the list contains the following information: the resource identifier and resource type of all resources requiring authentication, the target access operation that the user needs to perform on each resource, and user information. API authentication requires the business-side system to provide complete parameter information for each resource requiring authentication. For example, if access to the above operator model is required, the resources requiring authentication include the operator model and its three dependent related resources. That is, the list needs to contain complete parameter information (resource identifier, resource type, and corresponding target access operation) for the operator model and the three related resources. Therefore, API authentication may cause some intrusion into the code of the business-side system, but its advantage lies in the ability to customize the authentication strategy for each resource. For example, different access permissions can be requested between the target resource and its related resources, and between related resources. For instance, the operator model may require "editable" permission, while its dependent dataset may only require "viewable" permission, and so on.

[0103] Furthermore, when the user domain is also used to maintain user groups and the relationships between users and user groups, and the permission domain is also used to maintain the relationships between resources, access permissions, and user groups, the above step "determine the authentication result of the user to be accessed based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, based on the permission domain, action domain, and user domain" specifically includes:

[0104] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, query whether the user to be accessed has the corresponding target access operation permission for each resource to be accessed, based on the permission domain and action domain.

[0105] If so, then the authentication result of the user to be accessed is determined to be successful.

[0106] If not, based on the permission domain, action domain, and user domain, query whether the user group to which the user to be accessed belongs has the corresponding target access operation permission for each resource to be accessed; when the user group to which the user to be accessed belongs has the corresponding target access operation permission for each access operation, determine that the authentication result of the user to be accessed is successful.

[0107] For example, when authenticating the operator model and its three dependent resources, the system first checks if the user has access permissions to all of them. If so, it then checks if the operation group corresponding to the user's access permissions for each resource contains the corresponding target access operation. If both are present, authentication is successful; otherwise, authentication fails. If the user does not have access permissions, the system further checks if the user group to which the user belongs has them. If the user group does, and the operation group corresponding to the user's access permissions for each resource contains the corresponding target access operation, authentication is successful; otherwise, authentication fails. This process ensures that user permissions have a higher priority than user group permissions, achieving the effect of customizing special permissions for certain individuals within a group. It should be understood that if neither the user domain nor the permission domain maintains user group information, then when authenticating the operator model and its three dependent resources, authentication is only successful if the user seeking access has permissions for the corresponding target access operation for all four resources; otherwise, authentication fails directly without further querying user group permissions. In some embodiments, when the business-side system uses annotation authentication, the authentication request includes the target authentication mode, the user information of the user to be accessed, and the resource information of the target resource and the corresponding target access operation. In this case, step 1033 specifically includes:

[0108] Based on the target authentication mode, the resource information of the target resource, and the resource domain, at least one resource to be accessed is identified;

[0109] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined according to the permission domain, action domain, and user domain.

[0110] When using annotation-based authentication, the parameters that need to be passed in the annotation include: the resource identifier and resource type of the current resource (i.e., the target resource mentioned above), user information, the target authentication mode, and the target access operation that the user needs to perform on the current resource. In other embodiments, since most application systems have already integrated a complete user login service, user information can also be obtained from the Single Sign-On (SSO) service without being passed through annotations.

[0111] In MLOps platforms, considering that resource dependencies are primarily inputs and outputs—meaning other resources are inputs to the current resource and other resources are outputs—four authentication modes can be designed: authentication only for the current resource, authentication for the current resource and its input resources, authentication for the current resource and its output resources, and authentication for all resources. When using annotation-based authentication, the target authentication mode passed in the annotation must be used to determine which resources actually need authentication, i.e., which resources are to be accessed.

[0112] Furthermore, the above step of "determining at least one resource to be accessed based on the target authentication mode, the resource information of the target resource, and the resource domain" specifically includes:

[0113] When the target authentication mode indicates that authentication is only performed on the current resource, the target resource is treated as the resource to be accessed.

[0114] When the target authentication mode indicates authentication of the current resource and the input resource, the system queries the resource domain for associated resources that are related to the target resource and whose association relationship is the input, based on the resource information of the target resource, and uses the queried associated resources and the target resource as resources to be accessed.

[0115] When the target authentication mode indicates authentication of the current resource and the output resource, based on the resource information of the target resource, query the associated resources in the resource domain that are related to the target resource and whose relationship is output, and use the queried associated resources and the target resource as the resources to be accessed;

[0116] When the target authentication mode indicates that all resources are authenticated, the associated resources related to the target resource are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as resources to be accessed.

[0117] Annotation-based authentication authenticates all resources under the corresponding authentication mode, and all resources require the same authentication permissions. For example, when the target authentication mode indicates authentication of the current resource and input resources, and the target access operation is edit, the permission management system will verify whether the current user has edit permissions for the current resource and all its input resources. The advantage of annotation-based authentication is that annotations can be used directly without additional authentication mechanism configuration, resulting in less code intrusion into the business system and lower development costs. However, it cannot achieve the customized authentication effect of API authentication, and its granularity is coarser. In practical applications, annotation-based authentication can be used for simple authentication scenarios, while API authentication can be used for complex authentication scenarios, allowing the business system to perform individual authentication for certain related resources.

[0118] Furthermore, when the user domain is also used to maintain user groups and the relationships between users and user groups, and the permission domain is also used to maintain the relationships between resources, access permissions, and user groups, the above step "determine the authentication result of the user to be accessed based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, based on the permission domain, the action domain, and the user domain" specifically includes:

[0119] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, and based on the permission domain and the action domain, query whether the user to be accessed has the permission to perform the same target access operation for each resource to be accessed.

[0120] If so, then the authentication result of the user to be accessed is determined to be successful.

[0121] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission to access the same target operation for each resource to be accessed; when the user group to which the user to be accessed belongs has the permission to access the same target operation for each operation to be accessed, determine that the authentication result of the user to be accessed is successful.

[0122] Similar to the API authentication method described above, annotation authentication first checks whether the user to be accessed has access permissions and whether the operation group corresponding to the permissions contains the target access operation. If so, authentication is considered successful. If the user to be accessed does not have access permissions, it further checks whether the user group to which the user belongs has access permissions and whether the operation group corresponding to the permissions contains the target access operation. If so, authentication is considered successful; otherwise, authentication is considered unsuccessful.

[0123] As described above, the permission management method provided in this application obtains a resource initialization request sent by the business-side system for a target resource. The resource initialization request carries user information of the target user, resource information of the target resource, resource information of all associated resources related to the target resource, and the association relationship between each associated resource and the target resource. Based on the resource initialization request, the method updates the data in the domain model to grant the target user initial access permissions to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their association relationships, the action domain is used to maintain access operations, access permissions, and their association relationships, and the permission domain is used to maintain the association relationship between resources, access permissions, and users. Permission management of the target resource is performed based on the updated domain model. That is, during resource initialization, the permission mapping relationship and resource association relationship of the resource are maintained in the domain model, and permission management of the resource is performed based on the domain model. This not only enables fine-grained permission management for each resource in the MLOps platform with high flexibility but also helps reduce the development and maintenance costs of the business-side system.

[0124] Based on the method described in the above embodiments, this application also provides a permission management device for executing the steps in the above permission management method. Please refer to... Figure 4 , Figure 4 This is a schematic diagram of the structure of the permission management device 200 provided in this application embodiment. The permission management device 200 is applied to an electronic device and can be executed by the electronic device or a functional module or entity within the electronic device. The electronic device is a backend device of a Machine Learn Operations (MLOps) platform. The target platform includes a business-side system and a permission management system. The permission management system can manage permissions for resources created by the business-side system, such as authorization and authentication management.

[0125] Specifically, the permission management device 200 includes an acquisition unit 201, a model update unit 202, and a permission management unit 203, wherein:

[0126] The acquisition unit 201 is used to acquire the resource initialization request sent by the business side system for the target resource. The resource initialization request carries the user information of the target user, the resource information of the target resource, the resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource.

[0127] The model update unit 202 is used to update the data in the domain model according to the resource initialization request, so as to grant the target user initial access rights to the target resource. The domain model includes a user domain, a resource domain, a permission domain, and an action domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access rights and their relationships, and the permission domain is used to maintain the relationship between the resource, the access rights and the user.

[0128] The permission management unit 203 is used to manage permissions for the target resource based on the updated domain model.

[0129] In some embodiments, the permission management unit 203 is specifically used for:

[0130] Based on the updated domain model and the authorization management page of the target resource, authorize the target resource, or the target resource and at least one associated resource.

[0131] In some embodiments, the user domain is further used to maintain user groups and the association between users and user groups, and the permission domain is further used to maintain the association between resources, access permissions, and user groups; the permission management unit 203 is specifically used for:

[0132] Access the authorization management page of the target resource. The authorization management page is used to provide at least one authorizable object and at least one first grantable permission corresponding to the target resource. The authorizable object includes users and / or user groups.

[0133] In response to a first user action entered on the authorization management page, first authorization configuration information is obtained, which includes a target authorizable object selected from the authorizable objects and a first target permission selected from the first grantable permissions;

[0134] Update the data in the permission domain and the user domain according to the first authorization configuration information, so as to grant the first target permission of the target resource to the target authoritative object.

[0135] In some embodiments, the authorization management page is further configured to provide an associated resource interface for each authorizable object, and the permission management unit 203 is further configured to:

[0136] In response to the call operation of the associated resource interface, a list of associated resources of the target resource is displayed. The list of associated resources includes at least one authorizable associated resource associated with the target resource, and at least one second grantable permission corresponding to each authorizable associated resource.

[0137] In response to a second user operation inputting the list of associated resources, second authorization configuration information is obtained, which includes at least one target associated resource selected from the authorizable associated resources and a second target permission selected from the second grantable permissions;

[0138] Update the data in the permission domain and the user domain according to the second authorization configuration information, so as to grant the second target permission of the target associated resource to the corresponding authoritative object.

[0139] In some embodiments, the permission management unit 203 is used for:

[0140] Obtain the authentication request sent by the business-side system. The authentication request is used to instruct whether the user to be accessed has the permission to perform a target access operation on at least one resource to be accessed. The resource to be accessed includes the target resource, or the target resource and at least one associated resource.

[0141] Based on the authentication request, the authentication result of the user to be accessed is determined based on the updated domain model;

[0142] Based on the authentication result, the system controls the user to perform the target access operation on the resource to be accessed.

[0143] In some embodiments, when the business-side system uses API authentication, the authentication request includes user information of the user to be accessed, resource information of at least one resource to be accessed, and at least one target access operation, with each resource to be accessed corresponding to one target access operation; the permission management unit 203 is used for:

[0144] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined based on the permission domain, the action domain, and the user domain.

[0145] In some embodiments, the user field is further used to maintain user groups and the association between users and user groups, and the permission field is further used to maintain the association between resources, access permissions, and user groups; the permission management unit 203 is used for:

[0146] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, query whether the user to be accessed has the permission for the corresponding target access operation of each resource to be accessed, based on the permission domain and the action domain.

[0147] If so, then the authentication result of the user to be accessed is determined to be successful.

[0148] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each resource to be accessed; when the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each access operation, determine that the authentication result of the user to be accessed is successful.

[0149] In some embodiments, when the business-side system uses annotation authentication, the authentication request includes the target authentication mode, the user information of the user to be accessed, and the resource information of the target resource and the corresponding target access operation; the permission management unit 203 is used for:

[0150] Based on the target authentication mode, the resource information of the target resource, and the resource domain, at least one resource to be accessed is identified;

[0151] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined based on the permission domain, the action domain, and the user domain.

[0152] In some embodiments, the permission management unit 203 is used for:

[0153] When the target authentication mode indicates that authentication is only performed on the current resource, the target resource is treated as the resource to be accessed.

[0154] When the target authentication mode indicates authentication of the current resource and the input resource, the associated resources that are related to the target resource and whose relationship is input are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed;

[0155] When the target authentication mode indicates authentication of the current resource and the output resource, the associated resources that are related to the target resource and whose relationship is output are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed.

[0156] When the target authentication mode indicates that all resources are authenticated, the associated resources related to the target resource are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed.

[0157] In some embodiments, the user field is further used to maintain user groups and the association between users and user groups, and the permission field is further used to maintain the association between resources, access permissions, and user groups; the permission management unit 203 is used for:

[0158] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, and based on the permission domain and the action domain, query whether the user to be accessed has the permission to perform the same target access operation for each resource to be accessed.

[0159] If so, then the authentication result of the user to be accessed is determined to be successful.

[0160] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission to access the same target operation for each resource to be accessed; when the user group to which the user to be accessed belongs has the permission to access the same target operation for each operation to be accessed, determine that the authentication result of the user to be accessed is successful.

[0161] It should be noted that the specific details of each module unit in the above-mentioned permission management device 200 have been described in detail in the embodiments of the above-mentioned permission management method, and will not be repeated here.

[0162] In some embodiments, the access control device in this application can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a server, which can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. This application does not impose specific limitations on the embodiments.

[0163] In some embodiments, such as Figure 5 As shown, this application embodiment also provides an electronic device 300, including a processor 301, a memory 302, and a computer program stored in the memory 302 and executable on the processor 301. When the program is executed by the processor 301, it implements the various processes of the above-described permission management method embodiment and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0164] It should be noted that the electronic devices in the embodiments of this application include the aforementioned mobile electronic devices and non-mobile electronic devices.

[0165] Figure 6 A schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application.

[0166] The electronic device 400 includes, but is not limited to, components such as: radio frequency unit 401, network module 402, audio output unit 403, input unit 404, sensor 405, display unit 406, user input unit 407, interface unit 408, memory 409, and processor 410.

[0167] Those skilled in the art will understand that the electronic device 400 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 410 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 6 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0168] In some embodiments, the processor 410 is used for:

[0169] Obtain the resource initialization request sent by the business-side system for the target resource. The resource initialization request carries the user information of the target user, the resource information of the target resource, the resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource.

[0170] The domain model is updated based on the resource initialization request to grant the target user initial access to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access permissions and their relationships, and the permission domain is used to maintain the relationship between the resource, the access permission and the user.

[0171] Access control for the target resource is performed based on the updated domain model.

[0172] In some embodiments, the processor 410 is used for:

[0173] Based on the updated domain model and the authorization management page of the target resource, authorize the target resource, or the target resource and at least one associated resource.

[0174] In some embodiments, the user domain is further used to maintain user groups and the association between users and user groups, and the permission domain is further used to maintain the association between resources, access permissions, and user groups; the authorization management page based on the updated domain model and the target resource authorizes the target resource, or the target resource and at least one associated resource, including:

[0175] Access the authorization management page of the target resource. The authorization management page is used to provide at least one authorizable object and at least one first grantable permission corresponding to the target resource. The authorizable object includes users and / or user groups.

[0176] In response to a first user action entered on the authorization management page, first authorization configuration information is obtained, which includes a target authorizable object selected from the authorizable objects and a first target permission selected from the first grantable permissions;

[0177] Update the data in the permission domain and the user domain according to the first authorization configuration information, so as to grant the first target permission of the target resource to the target authoritative object.

[0178] In some embodiments, the authorization management page is further configured to provide an associated resource interface for each authorizable object, and the processor 410 is further configured to:

[0179] In response to the call operation of the associated resource interface, a list of associated resources of the target resource is displayed. The list of associated resources includes at least one authorizable associated resource associated with the target resource, and at least one second grantable permission corresponding to each authorizable associated resource.

[0180] In response to a second user operation inputting the list of associated resources, second authorization configuration information is obtained, which includes at least one target associated resource selected from the authorizable associated resources and a second target permission selected from the second grantable permissions;

[0181] Update the data in the permission domain and the user domain according to the second authorization configuration information, so as to grant the second target permission of the target associated resource to the corresponding authoritative object.

[0182] In some embodiments, the processor 410 is used for:

[0183] Obtain the authentication request sent by the business-side system. The authentication request is used to instruct whether the user to be accessed has the permission to perform a target access operation on at least one resource to be accessed. The resource to be accessed includes the target resource, or the target resource and at least one associated resource.

[0184] Based on the authentication request, the authentication result of the user to be accessed is determined based on the updated domain model;

[0185] Based on the authentication result, the system controls the user to perform the target access operation on the resource to be accessed.

[0186] In some embodiments, when the business-side system uses API authentication, the authentication request includes user information of the user to be accessed, resource information of at least one resource to be accessed, and at least one target access operation, with each resource to be accessed corresponding to one target access operation; the processor 410 is used to:

[0187] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined based on the permission domain, the action domain, and the user domain.

[0188] In some embodiments, the user field is further used to maintain user groups and the association between users and user groups, and the permission field is further used to maintain the association between resources, access permissions, and user groups; the processor 410 is used to:

[0189] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, query whether the user to be accessed has the permission for the corresponding target access operation of each resource to be accessed, based on the permission domain and the action domain.

[0190] If so, then the authentication result of the user to be accessed is determined to be successful.

[0191] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each resource to be accessed; when the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each access operation, determine that the authentication result of the user to be accessed is successful.

[0192] In some embodiments, when the business-side system uses annotation authentication, the authentication request includes the target authentication mode, the user information of the user to be accessed, and the resource information of the target resource and the corresponding target access operation; the processor 410 is used to:

[0193] Based on the target authentication mode, the resource information of the target resource, and the resource domain, at least one resource to be accessed is identified;

[0194] Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined based on the permission domain, the action domain, and the user domain.

[0195] In some embodiments, the processor 410 is used for:

[0196] When the target authentication mode indicates that authentication is only performed on the current resource, the target resource is treated as the resource to be accessed.

[0197] When the target authentication mode indicates authentication of the current resource and the input resource, the associated resources that are related to the target resource and whose relationship is input are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed;

[0198] When the target authentication mode indicates authentication of the current resource and the output resource, the associated resources that are related to the target resource and whose relationship is output are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed.

[0199] When the target authentication mode indicates that all resources are authenticated, the associated resources related to the target resource are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resource to be accessed.

[0200] In some embodiments, the user field is further used to maintain user groups and the association between users and user groups, and the permission field is further used to maintain the association between resources, access permissions, and user groups; the processor 410 is used to:

[0201] Based on the user information of the user to be accessed and the resource information of the resource to be accessed, and based on the permission domain and the action domain, query whether the user to be accessed has the permission to perform the same target access operation for each resource to be accessed.

[0202] If so, then the authentication result of the user to be accessed is determined to be successful.

[0203] If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission to access the same target operation for each resource to be accessed; when the user group to which the user to be accessed belongs has the permission to access the same target operation for each operation to be accessed, determine that the authentication result of the user to be accessed is successful.

[0204] It should be understood that, in this embodiment, the input unit 404 may include a graphics processing unit (GPU) 4041 and a microphone 4042. The GPU 4041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 406 may include a display panel 4061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 407 includes at least one of a touch panel 4071 and other input devices 4072. The touch panel 4071 is also called a touch screen. The touch panel 4071 may include a touch detection device and a touch controller. Other input devices 4072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be described in detail here.

[0205] The memory 409 can be used to store software programs and various data. The memory 409 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 409 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 409 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0206] Processor 410 may include one or more processing units; processor 410 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 410.

[0207] This application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described permission management method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0208] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0209] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described permission management method.

[0210] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0211] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0212] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0213] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

[0214] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0215] In the description of this application, "multiple" means two or more.

[0216] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0217] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for managing access permissions, characterized in that, include: Obtain the resource initialization request sent by the business-side system for the target resource. The resource initialization request carries the user information of the target user, the resource information of the target resource, the resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource. The domain model is updated according to the resource initialization request to grant the target user initial access to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access permissions, and their relationships, and the permission domain is used to maintain the relationships between the resource, the access permissions, and the user. Access control is performed on the target resource based on the updated domain model.

2. The access control method according to claim 1, characterized in that, The permission management of the target resource based on the updated domain model includes: Based on the updated domain model and the authorization management page of the target resource, authorization is granted to the target resource, or the target resource and at least one of the associated resources.

3. The access control method according to claim 2, characterized in that, The user domain is also used to maintain user groups and the association between users and user groups; the permission domain is also used to maintain the association between resources, access permissions, and user groups; the authorization management page based on the updated domain model and the target resource, granting authorization to the target resource, or the target resource and at least one of the associated resources, includes: Access the authorization management page of the target resource. The authorization management page is used to provide at least one authorizable object and at least one first grantable permission corresponding to the target resource. The authorizable object includes users and / or user groups. In response to a first user operation entered on the authorization management page, first authorization configuration information is obtained, the first authorization configuration information including a target authorizable object selected from the authorizable objects and a first target permission selected from the first grantable permissions; Update the data in the permission domain and the user domain according to the first authorization configuration information, so as to grant the first target permission of the target resource to the target authorizable object.

4. The access control method according to claim 3, characterized in that, The authorization management page is also used to provide an associated resource interface corresponding to each of the authorized objects. The authorization management page, based on the updated domain model and the target resource, authorizes the target resource, or the target resource and at least one of the associated resources, further includes: In response to the call operation of the associated resource interface, a list of associated resources of the target resource is displayed. The list of associated resources includes at least one authorizable associated resource associated with the target resource, and at least one second grantable permission corresponding to each authorizable associated resource. In response to a second user operation inputting the associated resource list, second authorization configuration information is obtained, the second authorization configuration information including at least one target associated resource selected from the authorizable associated resources, and a second target permission selected from the second grantable permissions; Update the data in the permission domain and the user domain according to the second authorization configuration information, so as to grant the second target permission of the target associated resource to the corresponding authoritative object.

5. The access control method according to any one of claims 1-4, characterized in that, The permission management of the target resource based on the updated domain model includes: Obtain the authentication request sent by the business-side system. The authentication request is used to instruct whether the user to be accessed has the permission to perform a target access operation on at least one resource to be accessed. The resource to be accessed includes the target resource, or the target resource and at least one associated resource. Based on the authentication request, the authentication result of the user to be accessed is determined based on the updated domain model; Based on the authentication result, the user to be accessed is controlled to perform the target access operation on the resource to be accessed.

6. The access control method according to claim 5, characterized in that, When the business-side system uses API authentication, the authentication request includes user information of the user to be accessed, resource information of at least one resource to be accessed, and at least one target access operation, with each resource to be accessed corresponding to one target access operation; The step of determining the authentication result of the user to be accessed based on the updated domain model according to the authentication request includes: Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined according to the permission domain, the action domain, and the user domain.

7. The access control method according to claim 6, characterized in that, The user domain is also used to maintain user groups and the association between users and user groups; the permission domain is also used to maintain the association between resources, access permissions, and user groups; determining the authentication result of the user to be accessed based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, based on the permission domain, the action domain, and the user domain, includes: Based on the user information of the user to be accessed and the resource information of the resource to be accessed, query whether the user to be accessed has the permission for the corresponding target access operation of each resource to be accessed, based on the permission domain and the action domain. If so, then the authentication result of the user to be accessed is determined to be successful. If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each of the resources to be accessed; when the user group to which the user to be accessed belongs has the permission for the corresponding target access operation of each of the access operations, determine that the authentication result of the user to be accessed is successful.

8. The access control method according to claim 5, characterized in that, When the business-side system uses annotation authentication, the authentication request includes the target authentication mode, the user information of the user to be accessed, the resource information of the target resource, and the corresponding target access operation. The step of determining the authentication result of the user to be accessed based on the updated domain model according to the authentication request includes: Based on the target authentication mode, the resource information of the target resource, and the resource domain, at least one of the resources to be accessed is determined; Based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, the authentication result of the user to be accessed is determined according to the permission domain, the action domain, and the user domain.

9. The access control method according to claim 8, characterized in that, The step of determining at least one of the resources to be accessed based on the target authentication mode, the resource information of the target resource, and the resource domain includes: When the target authentication mode indicates that authentication is only performed on the current resource, the target resource is used as the resource to be accessed. When the target authentication mode indicates authentication of the current resource and the input resource, the associated resource that is related to the target resource and whose association relationship is input is queried from the resource domain according to the resource information of the target resource, and the queried associated resource and the target resource are used as the resource to be accessed; When the target authentication mode indicates authentication of the current resource and the output resource, the associated resource that is associated with the target resource and whose association relationship is output is queried from the resource domain according to the resource information of the target resource, and the queried associated resource and the target resource are used as the resource to be accessed; When the target authentication mode indicates authentication for all resources, the associated resources related to the target resource are queried from the resource domain based on the resource information of the target resource, and the queried associated resources and the target resource are used as the resources to be accessed.

10. The access control method according to claim 8, characterized in that, The user domain is also used to maintain user groups and the association between users and user groups; the permission domain is also used to maintain the association between resources, access permissions, and user groups; determining the authentication result of the user to be accessed based on the user information of the user to be accessed, the resource information of the resource to be accessed, and the target access operation, based on the permission domain, the action domain, and the user domain, includes: Based on the user information of the user to be accessed and the resource information of the resource to be accessed, and based on the permission domain and the action domain, query whether the user to be accessed has permission for the same target access operation for each of the resources to be accessed; If so, then the authentication result of the user to be accessed is determined to be successful. If not, based on the permission domain, the action domain, and the user domain, query whether the user group to which the user to be accessed belongs has permission for the same target access operation for each of the resources to be accessed; when the user group to which the user to be accessed belongs has permission for the same target access operation for each of the access operations, determine that the authentication result of the user to be accessed is successful.

11. An access control device, characterized in that, include: The acquisition unit is used to acquire a resource initialization request sent by the business-side system for the target resource. The resource initialization request carries user information of the target user, resource information of the target resource, resource information of all associated resources associated with the target resource, and the association relationship between each associated resource and the target resource. The model update unit is used to update the data in the domain model according to the resource initialization request, so as to grant the target user initial access rights to the target resource. The domain model includes a user domain, a resource domain, an action domain, and a permission domain. The user domain is used to maintain users, the resource domain is used to maintain resources and their relationships, the action domain is used to maintain access operations, access rights, and their relationships, and the permission domain is used to maintain the relationships between the resource, the access rights, and the user. The permission management unit is used to manage permissions for the target resource based on the updated domain model.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the permission management method as described in any one of claims 1-10.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the permission management method as described in any one of claims 1-10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the permission management method as described in any one of claims 1-10.

Images