Method, apparatus and device for changing authority and medium

Abstract

The application discloses a permission changing method, device and equipment, and a storage medium, and relates to the technical field of cloud computing. The method comprises the following steps: in response to a permission changing application instruction, obtaining initial changing information to be changed, wherein the initial changing information comprises an initial changing operation; determining target changing information which has a business dependency relationship with the initial changing information; constructing a permission changing task according to the target changing information, so that the user end executes the permission changing task which has passed the examination and approval. The application can correctly execute changing actions without understanding complex changing scenes, improve the permission changing efficiency, and improve the experience of the user applying for the permission changing.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, apparatus, device and medium for changing permissions. Background Technology

[0002] With the rapid development of cloud computing technology, private clouds, with their advantages of high security and high controllability, have become a popular choice for enterprise IT infrastructure construction. In the operation of a private cloud environment, changes such as configuration adjustments to cloud resources directly affect business continuity and data security. Therefore, implementing multi-dimensional risk control management for private cloud resource changes has become a core requirement for ensuring stable enterprise operation.

[0003] However, current mainstream private cloud management platforms require users to manually select each change operation and resource one by one when initiating a permission change request. Only by selecting and applying for all involved change operations and resources can a deployment task be successfully initiated. This purely manual privilege escalation method heavily relies on the user's understanding of the change actions, which leads to low efficiency in permission changes and a poor user experience when requesting permission changes.

[0004] Therefore, how to improve the execution efficiency of private cloud resource changes is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] The main purpose of this application is to provide a method, apparatus, device and medium for changing permissions, which aims to improve the execution efficiency of private cloud resource changes.

[0006] To achieve the above objectives, this application provides a permission modification method, which includes: In response to a permission change request instruction, the system obtains the initial change information to be changed, which includes the initial change operation. Identify target change information that has a business dependency relationship with the initial change information; Based on the target change information, a permission change task is constructed so that the user terminal can execute the approved permission change task.

[0007] In one embodiment, the target change information includes a target change operation and a target change resource; the step of determining the target change information that has a business dependency relationship with the initial change information includes: Based on the initial change operation, a matching judgment is made in the preset combination operation. The combination operation includes a core operation and non-core operations other than the core operation. The core operation refers to the change operation that depends on the non-core operation to be completed in cooperation when the core operation is executed. Determine whether the initial change operation is the core operation, and obtain the determination result; If the determination result indicates that the initial change operation is the core operation, then the non-core operation is taken as the target change operation.

[0008] In one embodiment, the initial change information further includes a first change resource; the step of determining the target change information that has a business dependency relationship with the initial change information includes: Determine whether the first changed resource is an isolated resource in the preset resource association relationship, wherein the preset resource association relationship includes the direct or indirect binding relationship between various cloud resources; If the first modified resource is not an isolated resource, based on the preset resource association relationship, hierarchical expansion is performed starting from the first modified resource, and the hierarchical expansion result is used as the second modified resource. The target changed resource is determined based on the judgment result and the second changed resource.

[0009] In one embodiment, the step of hierarchical expansion based on a preset resource association relationship, starting with the first changed resource, includes: Based on the preset resource association relationship, obtain the first-level associated changed resource that is directly associated with the first changed resource; Based on the preset resource association relationship, obtain the second-level associated change resource that is directly associated with the first-level associated change resource; The first modified resource, the first-layer associated modified resource, and the second-layer associated modified resource are used as a candidate resource set, and the candidate resource set is used as the hierarchical expansion result.

[0010] In one embodiment, the step of determining the target changed resource based on the judgment result and the second changed resource includes: If the determination result indicates that the initial change operation is the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation and the second resource type corresponding to the target change operation, respectively. The resource node that is successfully matched will be used as the target resource to be changed.

[0011] In one embodiment, the step of determining the target changed resource based on the judgment result and the second changed resource includes: If the determination result indicates that the initial change operation is not the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation; The resource node that is successfully matched will be used as the target resource to be changed.

[0012] In one embodiment, the step of constructing a permission change task based on the target change information includes: If the determination result indicates that the initial change operation is the core operation, the permission change task is constructed based on the initial change operation, the target change operation, and the target change resource. If the determination result indicates that the initial change operation is not the core operation, the permission change task is constructed based on the initial change operation and the target change resource.

[0013] Furthermore, to achieve the above objectives, this application also provides a permission changing device, the permission changing device comprising: The acquisition module is used to acquire the initial change information to be changed in response to the permission change request instruction, wherein the initial change information includes the initial change operation; The query module is used to determine target change information that has a business dependency relationship with the initial change information; The module is used to construct permission change tasks based on the target change information, so that the user terminal can execute the approved permission change tasks.

[0014] In addition, to achieve the above objectives, this application also proposes a permission change device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the permission change method as described above.

[0015] In addition, to achieve the above objectives, this application also provides a storage medium, which is a computer-readable storage medium, on which a program implementing the permission change method is stored, and the program implementing the permission change method is executed by a processor to implement the steps of the permission change method as described above.

[0016] This application provides a permission change method. In response to a permission change application instruction, this application obtains initial change information to be changed, the initial change information including an initial change operation; determines target change information that has a business dependency relationship with the initial change information; and constructs a permission change task based on the target change information, so that the user terminal can execute the approved permission change task.

[0017] This application, in response to a permission change request instruction, obtains the initial change information to be changed, including the initial change operation. Then, it identifies the target change information that has a business dependency on the initial change information and constructs a permission change task based on the target change information. This task is then executed by the user after approval. Compared to traditional solutions that require manually selecting complete change operations and resources one by one, this application provides a permission change method that derives the required target change content based on the user's selected initial change content and pre-fills the target change content. Users can correctly execute the change without needing a deep understanding of the change action, thus improving the efficiency of permission changes and enhancing the user experience when requesting permission changes. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the first embodiment of the permission modification method of this application; Figure 2 This is a schematic diagram of the resource replenishment process involved in one embodiment of the permission change method of this application; Figure 3 This is a schematic diagram illustrating the application process of risk control parameters in one embodiment of the permission modification method of this application; Figure 4 This is a schematic diagram of the module structure of the permission modification device in this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the permission change method in the embodiments of this application.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] Current mainstream private cloud management platforms require users to manually select each change operation and resource when initiating a permission change request. Only after selecting and applying for all relevant change operations and resources can a deployment task be successfully initiated. This purely manual privilege escalation method heavily relies on the user's understanding of the change actions, leading to inefficient permission changes and a poor user experience.

[0025] Therefore, how to improve the execution efficiency of private cloud resource changes is a technical problem that urgently needs to be solved in this field.

[0026] The main solution of this application is: in response to a permission change request instruction, obtain the initial change information to be changed, the initial change information including the initial change operation; determine the target change information that has a business dependency relationship with the initial change information; construct a permission change task based on the target change information, so that the user terminal can execute the approved permission change task.

[0027] This application, in response to a permission change request instruction, obtains the initial change information to be changed, including the initial change operation. Then, it identifies the target change information that has a business dependency on the initial change information and constructs a permission change task based on the target change information. This task is then executed by the user after approval. Compared to traditional solutions that require manually selecting complete change operations and resources one by one, this application provides a permission change method that derives the required target change content based on the user's selected initial change content and pre-fills the target change content. Users can correctly execute the change without needing a deep understanding of the change action, thus improving the efficiency of permission changes and enhancing the user experience when requesting permission changes.

[0028] It should be noted that the executing entity of the method in each embodiment of the permission change method in this application can be the backend service system of the cloud management platform, or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a permission change device capable of the above functions. This embodiment does not specifically limit it in this way. The following uses the backend service system of the cloud management platform as the executing entity as an example to describe this embodiment and the following embodiments.

[0029] Based on this, this application proposes a permission modification method according to the first embodiment, please refer to... Figure 1 The permission change method includes steps S10 to S30: Step S10: In response to the permission change request instruction, obtain the initial change information to be changed, the initial change information including the initial change operation.

[0030] A permission change request instruction is a signal triggered when a user initiates a permission change request on the cloud management platform's permission request interface. This instruction is submitted from the front-end page to the back-end service system, instructing the back-end service system to begin processing the permission change request. Initial change information is a collection of changes selected by the user on the front-end page. This information includes at least the selected change operation and may also include the selected change resource.

[0031] In response to a permission change request instruction triggered by a user on the permission request interface of the cloud management platform, the system obtains the change information corresponding to the instruction and uses the set of change content selected by the user on the front-end page as the initial change information to be changed. The initial change information includes at least the change operation selected by the user.

[0032] In one feasible implementation, after logging into the cloud management platform, the user enters the permission change application page. On this page, the user selects the desired change operation (e.g., "delete virtual machine") through interactive components such as drop-down menus or checkboxes. After making the selection, the user clicks the "submit" button. The front-end page encapsulates the user's selected content into a permission change application instruction and sends it to the back-end service system. After receiving the instruction, the back-end service system parses out the initial change operation selected by the user.

[0033] In another feasible implementation, the user not only selects the change operation on the front-end page, but also specifies the specific resource instance to which the change operation will be applied (e.g., selecting a specific virtual machine instance). The front-end page encapsulates the change operation and the changed resource together as initial change information and submits it to the back-end service system.

[0034] Step S20: Determine the target change information that has a business dependency relationship with the initial change information.

[0035] Business dependencies refer to the business logic layer of a cloud management platform, where the complete execution of a change operation depends on the coordination of other change operations and / or other change resources. These coordinating change operations and resources have business dependencies on each other. Target change information refers to other change operations and / or other change resources, derived from business dependencies, that are needed to achieve a complete change action, in addition to the initial change information selected by the user.

[0036] After the backend service system obtains the initial change information submitted by the user, it analyzes and matches the initial change information according to the pre-configured business dependency rules to determine the target change information that has a business dependency relationship with the initial change information.

[0037] In this embodiment, the target change information includes target change operations and target change resources. Step S20 may include: Step S201: Based on the initial change operation, a matching judgment is made in the preset combination operation. The combination operation includes a core operation and non-core operations other than the core operation. The core operation refers to a change operation that depends on the non-core operation to be completed in collaboration when the core operation is executed. Step S202: Determine whether the initial change operation is the core operation, and obtain the determination result; Step S203: If the determination result indicates that the initial change operation is the core operation, then the non-core operation is taken as the target change operation.

[0038] A target change operation refers to other change operations that need to be executed in conjunction with the initial change operation, determined based on the matching result of the initial change operation and the preset combination operation. A target change resource refers to a target resource node that is determined to act when the initial change operation and / or the target change operation are executed, based on the hierarchical expansion result of the association relationship between the first change resource and the preset resource, and the judgment result of whether the initial change operation is the core operation.

[0039] Pre-defined combination operations refer to logical sets of multiple change operations that cloud service administrators pre-identify and register based on business scenarios. Each combination operation describes all the change operations included in a complete change action. Combination operations include core operations and non-core operations. Core operations are the main operations in the current change action, which depend on other non-core operations in the combination operation for successful execution. For example, in the "Delete Virtual Machine" combination operation, "Delete Virtual Machine" is the core operation, while "Unbind Public IP", "Update Backend Pool", and "Delete Virtual Network Interface Card" are non-core operations. Non-core operations are auxiliary change operations other than core operations in the combination operation. These operations do not constitute the main body of the change action themselves, but they need to cooperate with the core operations to complete.

[0040] After receiving the initial change operation submitted by the user, the backend service system matches this operation with each registered combination of operations in the system. First, it determines which combination of operations the initial change operation belongs to. Then, within that combination, it further determines whether the initial change operation is marked as a core operation. If the determination result indicates that the initial change operation is a core operation within that combination, the backend service system extracts all non-core operations from that combination and pre-fills them as target change operations.

[0041] For example, the cloud service provider administrator pre-registers the "Delete Virtual Machine - General Zone" combined operation in the system. This combined operation includes "Delete Virtual Machine" (core operation), "Unbind Public IP" (non-core operation), "Update Backend Pool" (non-core operation), and "Delete Virtual Network Interface Card" (non-core operation). When the user submits the initial change operation "Delete Virtual Machine," the backend service system matches the "Delete Virtual Machine - General Zone" combined operation in the combined operations and determines that "Delete Virtual Machine" is the core operation. Therefore, it automatically pre-fills "Unbind Public IP," "Update Backend Pool," and "Delete Virtual Network Interface Card" as the target change operations. If the user submits the initial change operation "Unbind Public IP," it is a non-core operation in the combined operations, and the backend service system does not pre-fill the operation.

[0042] Step S30: Construct a permission change task based on the target change information, so that the user terminal can execute the approved permission change task.

[0043] A permission change task refers to a change request unit that includes complete change operations and resources, can be submitted for approval, and can be executed by the user after approval. This task is constructed by the backend service system based on the initial change information submitted by the user and the derived target change information. The user terminal refers to the device or functional module that receives and executes the approved permission change task. Approval means that the permission change task has completed the approval process and obtained permission to execute.

[0044] After identifying the target change information that has a business dependency on the initial change information, a permission change task is constructed based on the target change information. The constructed permission change task is then submitted for approval. After the permission change task is approved, the user client executes the approved permission change task. In this way, the user client executes a complete permission change task that has been supplemented based on the target change information, without having to manually select each complete change operation and change resource.

[0045] This application embodiment, in response to a permission change request instruction, obtains the initial change information to be changed, which includes the initial change operation. Then, it determines the target change information that has a business dependency on the initial change information and constructs a permission change task based on the target change information, allowing the user to execute the approved permission change task. Thus, compared to traditional solutions that require manually selecting complete change operations and resources one by one, this application provides a permission change method that derives the required target change content based on the user's selected initial change content and pre-fills the target change content. Users can correctly execute the change without needing a deep understanding of the change action, achieving correct execution of change actions without understanding complex change scenarios, improving permission change efficiency and enhancing the user experience when applying for permission changes.

[0046] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Furthermore, the initial change information also includes a first changed resource, please refer to... Figure 2 Step S20 includes: Step S204: Determine whether the first changed resource is an isolated resource in the preset resource association relationship, wherein the preset resource association relationship includes the direct or indirect binding relationship between various cloud resources; Step S205: If the first changed resource is not an isolated resource, based on the preset resource association relationship, perform hierarchical expansion starting from the first changed resource, and use the hierarchical expansion result as the second changed resource. Step S206: Determine the target changed resource based on the judgment result and the second changed resource.

[0047] Preset resource associations refer to structured data stored in the cloud management platform that establishes direct or indirect binding relationships between various cloud resources. These relationships are recorded and saved in real-time when users create and bind resources on the cloud management platform. Direct binding relationships refer to direct configurations between two cloud resources, such as the binding between a virtual machine and a virtual network interface card (NIC). Indirect binding relationships refer to associations between two cloud resources established through one or more intermediate resources, such as the indirect association between a virtual machine and a backend server pool established through a virtual NIC. Isolated resources are resource nodes that do not have direct or indirect binding relationships with any other resources in the preset resource associations. Hierarchical expansion refers to the process of expanding outwards layer by layer according to the preset resource associations, starting with the user-selected first change resource as the starting node, to obtain other associated resource nodes. The second change resource refers to the set of candidate resources obtained through hierarchical expansion.

[0048] After the backend service system receives the first changed resource submitted by the user, it queries the preset resource association relationships to see if there are any other related resources for that resource. If the query result shows that the first changed resource is an isolated resource, that is, it has no direct or indirect related resources, then no resource expansion is required. If the query result shows that the first changed resource is not an isolated resource, the backend service system starts from that resource and expands outward layer by layer according to the preset resource association relationships to form a candidate resource set. This set includes the first changed resource itself and its related resources. The result of the hierarchical expansion is used as the second changed resource. Then, based on the combined operation judgment result and the hierarchical expansion result, the target changed resource is further filtered and determined.

[0049] In this embodiment, step S205 may include: Step A10: Obtain the first-level associated changed resource that is directly associated with the first changed resource according to the preset resource association relationship; Step A20: Based on the preset resource association relationship, obtain the second-layer associated change resource that is directly associated with the first-layer associated change resource; Step A30: The first modified resource, the first layer associated modified resource, and the second layer associated modified resource are taken as a candidate resource set, and the candidate resource set is taken as the hierarchical expansion result.

[0050] The first-level associated changed resource refers to a resource node that is directly bound to the first changed resource in the preset resource association relationship. The second-level associated changed resource refers to a resource node that is directly bound to the first-level associated changed resource in the preset resource association relationship. The candidate resource set is a resource set composed of the first changed resource, the first-level associated changed resource, and the second-level associated changed resource.

[0051] The backend service system starts with the first changed resource as the initial node. It first queries all resource nodes directly connected to the first changed resource in the preset resource association relationships, designating these nodes as the first-level associated changed resources. Then, starting with each node in the first-level associated changed resources, it continues to query all resource nodes directly connected to those nodes, designating these nodes as the second-level associated changed resources. After obtaining the second-level associated changed resources, further expansion stops, and the first changed resource itself, the first-level associated changed resources, and the second-level associated changed resources are merged into a candidate resource set. The expansion depth is limited to two levels to ensure sufficient coverage of associated resources while controlling the size of the candidate resource set, avoiding the inclusion of irrelevant resources in the change task due to over-expansion.

[0052] For example, the user selects a virtual machine instance as the first resource to be changed. The backend service system, based on preset resource associations, queries resources directly associated with this virtual machine, including a virtual network interface card (NIC) and a public IP address (Internet Protocol). These two are designated as the first-level associated change resources. Continuing to query resources directly associated with the virtual NIC, it finds that the virtual NIC is associated with a backend server pool, which is designated as the second-level associated change resource. Thus, the virtual machine, virtual NIC, public IP address, and backend server pool are collectively considered as the candidate resource set.

[0053] In this embodiment, step S206 may include: Step B10: If the determination result indicates that the initial change operation is the core operation, obtain the resource type of each resource node in the second change resource; Step B20: Match the resource type of each resource node with the first resource type corresponding to the initial change operation and the second resource type corresponding to the target change operation, respectively. Step B30: Select the successfully matched resource node as the target resource to be changed.

[0054] Resource type is attribute information used in cloud management platforms to identify the category to which a cloud resource belongs, such as virtual machine resources, virtual network interface resources, public IP resources, and backend server pool resources. The first resource type refers to the type of the target resource affected by the initial change operation; for example, the first resource type corresponding to the "delete virtual machine" operation is "virtual machine resource." The second resource type refers to the type of the target resource affected by the target change operation; for example, the second resource type corresponding to the "delete virtual network interface" operation is "virtual network interface resource."

[0055] If the initial change operation is determined to be the core operation, the backend service system first iterates through each resource node in the second change resource list to obtain the resource type of each node. Then, for each resource node, its resource type is matched with both the first and second resource types: if a resource node's resource type matches the first resource type, then that resource node is the resource affected by the initial change operation; if a resource node's resource type matches the second resource type, then that resource node is the resource affected by the target change operation. All successfully matched resource nodes are then used as target change resources and populated into the final change content.

[0056] In this embodiment, step S206 may further include: Step C10: If the determination result is that the initial change operation is not the core operation, obtain the resource type of each resource node in the second change resource; Step C20: Match the resource type of each resource node with the first resource type corresponding to the initial change operation; Step C30: Select the successfully matched resource node as the target resource to be changed.

[0057] If the initial change operation is determined to be a non-core operation, and no additional change operations are required, the backend service system only needs to match the corresponding change resource for the initial change operation. Specifically, the backend service system iterates through each resource node in the second change resource list, obtains the resource type of each resource node, and then matches the resource type of each resource node with the first resource type corresponding to the initial change operation. The resource node that successfully matches is taken as the target change resource.

[0058] For example, the initial change operation submitted by the user is "delete virtual network interface card". This operation is not a core operation in any combined operation, so no other change operations need to be pre-filled. The backend service system matches the resource type of each resource node in the candidate resource set (including virtual machines, virtual network interface cards, public IPs, and backend server pools) obtained by hierarchical expansion with the resource type "virtual network interface card resource" corresponding to the "delete virtual network interface card" operation. The virtual network interface card node in the candidate resource set that is matched is taken as the target change resource.

[0059] In this embodiment, step S30 may include: Step S301: If the determination result is that the initial change operation is the core operation, construct the permission change task based on the initial change operation, the target change operation, and the target change resource; Step S302: If the determination result is that the initial change operation is not the core operation, construct the permission change task based on the initial change operation and the target change resource.

[0060] If the initial change operation is determined to be a core operation, the backend service system combines the user-submitted initial change operation, the derived target change operation, and the target change resource obtained through resource matching into a complete permission change task. If the initial change operation is determined to be a non-core operation, since no additional change operation is needed, the backend service system only combines the user-submitted initial change operation and the matched target change resource into a permission change task.

[0061] For example, such as Figure 2The diagram illustrates the resource replenishment process. First, it determines whether the first changed resource is an isolated resource within a preset resource association relationship. If the first changed resource is an isolated resource within the preset resource association relationship, it is used as the target changed resource. If the first changed resource is not an isolated resource within the preset resource association relationship, the first-level associated changed resources directly related to the first changed resource are obtained based on the preset resource association relationship. Then, the second-level associated changed resources directly related to the first-level associated changed resources are obtained based on the preset resource association relationship. The first changed resource, the first-level associated changed resources, and the second-level associated changed resources are used as a candidate resource set. This candidate resource set is then used as the hierarchical expansion structure. The result of the hierarchical expansion is the second changed resource. Then, it is determined whether the initial change operation is a core operation. If the initial change operation is a core operation, the resource type of each resource node in the second changed resource is obtained, and the resource type of each resource node is matched with the first resource type corresponding to the initial change operation and the second resource type corresponding to the target change operation. The resource node that is successfully matched is taken as the target changed resource. If the initial change operation is not a core operation, the resource type of each resource node in the second changed resource is obtained, and the resource type of each resource node is matched with the first resource type corresponding to the initial change operation. The resource node that is successfully matched is taken as the target changed resource.

[0062] This application embodiment determines the target changed resource by judging whether the first changed resource is an isolated resource. If it is not isolated, it performs two-level resource association extension and combines the operation judgment result with resource type matching. In this way, the associated resources required for the change can be automatically completed, avoiding the need for users to manually search and select associated resources step by step, further reducing the complexity of user operations and improving the efficiency of permission change.

[0063] Based on the first or second embodiment of this application, in the third embodiment of this application, the content that is the same as or similar to the first or second embodiment described above can be referred to the above description and will not be repeated hereafter. Furthermore, the permission change method of this application also includes a standardized risk control parameter application mechanism, please refer to... Figure 3 The mechanism includes: Step D10: After the user initiates a change on the cloud management platform, the cloud management platform saves the risk control parameters returned by the change platform. In step D20, when a user initiates a deployment task on the cloud management platform, the cloud management platform matches valid risk control parameters for each specific subtask of the deployment task and issues cloud service processing in an agreed format. In step D30, after processing, the cloud service provider calls the change platform with the risk control parameters to execute the change. The change platform skips the duplicate approval after recognizing the validity of the risk control parameters.

[0064] The change platform refers to the platform used for permission change approval, risk control parameter generation, and validity verification. Risk control parameters are unique identifiers calculated by the change platform based on the user's submitted change permission application information and a preset risk control strategy. These parameters are used by the change platform to verify whether the current change operation has completed permission approval during cross-platform change execution. Their specific form can be a string, a numeric code, or a composite identifier containing a timestamp and feature information. The risk control parameter application mechanism refers to saving the risk control parameters generated by the change platform during the change permission application stage and transmitting these parameters across platforms during subsequent deployment and execution stages. This allows the change platform to identify the approval status of the change application based on these parameters, thereby preventing downstream platforms from triggering a secondary approval process due to their inability to perceive the upstream approval result. Through this mechanism, the entire process from a user initiating a change on the cloud management platform to the final completion of the change only requires one approval step, eliminating the need to repeatedly submit change permission applications during cross-platform collaboration. The following detailed explanation of the risk control parameter application mechanism provided in this embodiment, along with specific steps, further illustrates this.

[0065] In this embodiment, step D10 may include: Step D101: In response to the user's request for change permissions submitted on the cloud management platform, obtain multi-dimensional change information, including change operation, change resources, business importance, scope of impact and duration of impact. Step D102: Send the multi-dimensional change information to the change platform so that the change platform can calculate the corresponding risk control parameters according to the preset risk control strategy; Step D103: Receive the risk control parameters returned by the change platform, and store the risk control parameters in association with the current change permission application. The risk control parameters are used to identify the validity of the current change application during subsequent change execution.

[0066] Multi-dimensional change information includes, but is not limited to, user-submitted change operations and changed resources, business importance (e.g., core business, general business), scope (e.g., single machine, cluster, global), and duration of impact (e.g., estimated duration of change operation).

[0067] When a user submits a change permission request on the front-end page, the cloud management platform's acquisition module responds to the submission by obtaining information such as the change operation, changed resources, business importance, scope, and duration of impact that the user has filled in. Subsequently, the cloud management platform assembles this information according to the interface format required by the change platform and sends it to the change platform via a preset communication protocol. Upon receiving the request, the change platform performs a comprehensive calculation based on its built-in risk control strategies (e.g., assigning different approval levels based on business importance, calculating risk coefficients based on the scope and duration of impact), generating a unique legality credential for this change request—the risk control parameter. The change platform returns this parameter to the cloud management platform, which, upon receiving it, associates it with the current change permission request number and saves it to its local database for use when issuing subsequent deployment tasks.

[0068] In this embodiment, step D20 may include: Step D201: In response to a user-triggered deployment task issuance instruction, obtain at least one subtask contained in the deployment task, wherein the subtask is an independent execution unit formed by splitting the deployment task during specific execution; Step D202: Determine the change content corresponding to each of the sub-tasks, and match the target risk control change order in each valid risk control change order according to the change content; Step D203: Extract the risk control parameters stored in the target risk control change order, and send the risk control parameters to the cloud service provider in accordance with the preset transmission format and the corresponding sub-task.

[0069] A deployment task is a complete change execution command initiated by the user on the cloud management platform. During actual execution, this task may involve resource operations from different cloud service providers, and is therefore broken down into multiple independently executed sub-tasks by the cloud management platform. Each sub-task corresponds to a specific operation unit. A valid risk control change order refers to a change permission application form submitted by the user, approved, and within its valid timeframe. A preset transmission format refers to the risk control parameter data exchange format pre-agreed between the cloud management platform and the cloud service provider, such as transmission via extensions of specific message header fields or transmission via standardized fields in the request body.

[0070] After a user triggers a deployment task on the cloud management platform, the platform's build module responds by first splitting the deployment task into at least one sub-task according to preset splitting rules. Then, for each sub-task, it retrieves the changes involved, such as modified operations and resources. Using these changes as matching criteria, it performs a precise match among multiple valid risk control change orders stored in the database, identifying the one that matches the sub-task's content as the target risk control change order. Upon successful matching, it extracts the associated risk control parameters from the target risk control change order and sends these parameters, along with the sub-task content, to the corresponding cloud service provider in the agreed-upon transmission format (e.g., adding an "X-Risk-Control-Params" field to the HTTP request header or as a separate field under the JSON root node).

[0071] In this embodiment, step D30 may include: Step D301: Obtain the execution result returned by the cloud service provider, wherein the execution result includes the risk control parameters; Step D302: Based on the risk control parameters in the execution result, call the change execution interface of the change platform to trigger the change platform to perform validity verification on the risk control parameters; Step D303: Receive the verification pass result returned by the change platform, skip the repeated approval process for the current change, and directly complete the change execution.

[0072] The execution result is the response information returned by the cloud service provider to the cloud management platform after completing the subtask. This information contains the risk control parameters carried and saved by the cloud service provider during execution. The change execution interface is the application programming interface provided by the change platform to trigger actual change operations.

[0073] After receiving the subtask carrying risk control parameters, the cloud service provider, upon completing the execution of the changed content, returns the risk control parameters as is in the execution result to the cloud management platform. Upon receiving the execution result, the cloud management platform parses the risk control parameters and uses them as input parameters to call the change execution interface of the change platform. Upon receiving the call request, the change platform verifies the validity of the input risk control parameters, including but not limited to verifying whether the parameter exists in an approved change record, whether it is within its validity period, and whether it matches the currently executed change content. If the verification passes, the change platform returns a verification result to the cloud management platform. Based on this, the cloud management platform confirms that the current change is a legitimate change that has already been approved, skipping the duplicate approval process and directly completing the change operation.

[0074] This application embodiment uses a standardized risk control parameter application mechanism to ensure that a change action triggers only one approval process during cross-platform collaboration, avoiding duplicate submissions and approvals during user changes to platform-as-a-service resources, thereby further improving change efficiency and enhancing user experience.

[0075] This application also provides a permission changing device, please refer to... Figure 4 The permission change device includes: The acquisition module 10 is used to acquire the initial change information to be changed in response to the permission change application instruction, wherein the initial change information includes the initial change operation; Query module 20 is used to determine target change information that has a business dependency relationship with the initial change information; The construction module 30 is used to construct a permission change task based on the target change information, so that the user terminal can execute the approved permission change task.

[0076] Optionally, the target change information includes target change operations and target change resources; the query module 20 is further used for: Based on the initial change operation, a matching judgment is made in the preset combination operation. The combination operation includes a core operation and non-core operations other than the core operation. The core operation refers to the change operation that depends on the non-core operation to be completed in cooperation when the core operation is executed. Determine whether the initial change operation is the core operation, and obtain the determination result; If the determination result indicates that the initial change operation is the core operation, then the non-core operation is taken as the target change operation.

[0077] Optionally, the initial change information further includes a first change resource; the target change information that determines a business dependency with the initial change information is used for: Determine whether the first changed resource is an isolated resource in the preset resource association relationship, wherein the preset resource association relationship includes the direct or indirect binding relationship between various cloud resources; If the first modified resource is not an isolated resource, based on the preset resource association relationship, hierarchical expansion is performed starting from the first modified resource, and the hierarchical expansion result is used as the second modified resource. The target changed resource is determined based on the judgment result and the second changed resource.

[0078] Optionally, the hierarchical expansion based on the preset resource association relationship, starting from the first changed resource, is used for: Based on the preset resource association relationship, obtain the first-level associated changed resource that is directly associated with the first changed resource; Based on the preset resource association relationship, obtain the second-level associated change resource that is directly associated with the first-level associated change resource; The first modified resource, the first-layer associated modified resource, and the second-layer associated modified resource are used as a candidate resource set, and the candidate resource set is used as the hierarchical expansion result.

[0079] Optionally, the step of determining the target changed resource based on the judgment result and the second changed resource is used for: If the determination result indicates that the initial change operation is the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation and the second resource type corresponding to the target change operation, respectively. The resource node that is successfully matched will be used as the target resource to be changed.

[0080] Optionally, the step of determining the target changed resource based on the judgment result and the second changed resource is used for: If the determination result indicates that the initial change operation is not the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation; The resource node that is successfully matched will be used as the target resource to be changed.

[0081] Optionally, the building module 30 is further configured to: If the determination result indicates that the initial change operation is the core operation, the permission change task is constructed based on the initial change operation, the target change operation, and the target change resource. If the determination result indicates that the initial change operation is not the core operation, the permission change task is constructed based on the initial change operation and the target change resource.

[0082] The permission changing device provided in this application, employing the permission changing method described in the above embodiments, can solve the technical problem of low efficiency in permission changing. Compared with the prior art, the beneficial effects of the permission changing device provided in this application are the same as those of the permission changing method described in the above embodiments, and other technical features in the permission changing device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0083] This application provides a permission change device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the permission change method in the first embodiment described above.

[0084] The following is for reference. Figure 5 It shows a structural diagram of a device suitable for implementing the permission change device in the embodiments of this application. Figure 5 The illustrated device for changing permissions is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0085] like Figure 5 As shown, the permission change device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the permission change device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the permission change device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show permission change devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0086] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0087] The permission changing device provided in this application, employing the permission changing method in the above embodiments, can solve the technical problem of low efficiency in permission changing. Compared with the prior art, the beneficial effects of the permission changing device provided in this application are the same as those of the permission changing method provided in the above embodiments, and other technical features in this permission changing device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0088] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0089] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0090] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the permission change method in the above embodiments.

[0091] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0092] The aforementioned computer-readable storage medium may be included in the rights-changing device; or it may exist independently and not be assembled into the rights-changing device.

[0093] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the permission change device, the permission change device: in response to a permission change application instruction, obtains initial change information to be changed, the initial change information including an initial change operation; determines target change information that has a business dependency relationship with the initial change information; and constructs a permission change task based on the target change information, so that the user terminal can execute the approved permission change task.

[0094] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0095] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0096] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0097] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described permission change method, thereby solving the technical problem of low efficiency in permission change. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the permission change method provided in the above embodiments, and will not be repeated here.

[0098] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent scope of this application.

Claims

1. A method for changing permissions, characterized in that, The permission change method includes: In response to a permission change request instruction, the system obtains the initial change information to be changed, which includes the initial change operation. Identify target change information that has a business dependency relationship with the initial change information; Based on the target change information, a permission change task is constructed so that the user terminal can execute the approved permission change task.

2. The permission change method as described in claim 1, characterized in that, The target change information includes the target change operation and the target change resource; The step of determining the target change information that has a business dependency relationship with the initial change information includes: Based on the initial change operation, a matching judgment is made in the preset combination operation. The combination operation includes a core operation and non-core operations other than the core operation. The core operation refers to the change operation that depends on the non-core operation to be completed in cooperation when the core operation is executed. Determine whether the initial change operation is the core operation, and obtain the determination result; If the determination result indicates that the initial change operation is the core operation, then the non-core operation is taken as the target change operation.

3. The permission change method as described in claim 2, characterized in that, The initial change information also includes the first changed resource; The step of determining the target change information that has a business dependency relationship with the initial change information includes: Determine whether the first changed resource is an isolated resource in the preset resource association relationship, wherein the preset resource association relationship includes the direct or indirect binding relationship between various cloud resources; If the first modified resource is not an isolated resource, based on the preset resource association relationship, hierarchical expansion is performed starting from the first modified resource, and the hierarchical expansion result is used as the second modified resource. The target changed resource is determined based on the judgment result and the second changed resource.

4. The permission change method as described in claim 3, characterized in that, The step of hierarchical expansion based on preset resource association relationships, starting from the first changed resource, includes: Based on the preset resource association relationship, obtain the first-level associated changed resource that is directly associated with the first changed resource; Based on the preset resource association relationship, obtain the second-level associated change resource that is directly associated with the first-level associated change resource; The first modified resource, the first-layer associated modified resource, and the second-layer associated modified resource are used as a candidate resource set, and the candidate resource set is used as the hierarchical expansion result.

5. The permission change method as described in claim 4, characterized in that, The step of determining the target changed resource based on the judgment result and the second changed resource includes: If the determination result indicates that the initial change operation is the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation and the second resource type corresponding to the target change operation, respectively. The resource node that is successfully matched will be used as the target resource to be changed.

6. The permission change method as described in claim 4, characterized in that, The step of determining the target changed resource based on the judgment result and the second changed resource includes: If the determination result indicates that the initial change operation is not the core operation, the resource type of each resource node in the second changed resource is obtained; The resource type of each resource node is matched with the first resource type corresponding to the initial change operation; The resource node that is successfully matched will be used as the target resource to be changed.

7. The permission change method as described in claim 4, characterized in that, The step of constructing the permission change task based on the target change information includes: If the determination result indicates that the initial change operation is the core operation, the permission change task is constructed based on the initial change operation, the target change operation, and the target change resource. If the determination result indicates that the initial change operation is not the core operation, the permission change task is constructed based on the initial change operation and the target change resource.

8. A permission changing device, characterized in that, The permission change device includes: The acquisition module is used to acquire the initial change information to be changed in response to the permission change request instruction, wherein the initial change information includes the initial change operation; The query module is used to determine target change information that has a business dependency relationship with the initial change information; The module is used to construct permission change tasks based on the target change information, so that the user terminal can execute the approved permission change tasks.

9. A permission changing device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the permission change method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the permission change method as described in any one of claims 1 to 7.

Images