Authority control method, authority control apparatus, electronic device, and storage medium

Abstract

The present application relates to the technical field of control, and provides an authority control method, an authority control apparatus, an electronic device, and a storage medium. The method comprises: performing identity authentication on an object identity of a target object; if the identity authentication is passed, acquiring a service platform bound to the target object, and determining a channel bound to the service platform, wherein a preset character of the preset object and data operation authority of the service platform associated with the preset character are allocated to the channel; and if the target object is the same as the preset object, allocating the data operation authority to the target object, so that the target object operates data of the service platform on the basis of the data operation authority. In this way, unified authority management can be performed on a plurality of service platforms, thereby facilitating maintenance of authority management, and improving the efficiency and security of authority management.

Description

Authorization control method, authorization control device, electronic device, and storage medium Technical Field

[0001] The present application relates to the field of control technology, and in particular to an authority control method, an authority control device, an electronic device, and a storage medium. Background Art

[0002] Permission management across various service platforms is a critical issue. Traditionally, permissions management is implemented independently on each service platform. When a user accesses multiple service platforms, permissions must be managed individually for each platform. This results in inconsistent and difficult-to-maintain permissions management, reducing both efficiency and security.

[0003] Summary of the Invention

[0004] The main purpose of the embodiments of this application is to propose a permission control method, permission control device, electronic device and storage medium, aiming to achieve unified permission management of multiple service platforms, facilitate the maintenance of permission management, and improve the efficiency and security of permission management.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a permission control method, the method comprising:

[0006] Authenticating the target object's identity;

[0007] If the identity authentication is successful, the service platform bound to the target object is obtained, and the channel bound to the service platform is determined; the channel is assigned a preset role of the preset object and the data operation authority of the service platform associated with the preset role;

[0008] If the target object is the same as the preset object, the data operation permission is assigned to the target object, so that the target object can operate the data of the service platform according to the data operation permission.

[0009] In some embodiments, authenticating the target object's identity includes:

[0010] determining an object type of the target object according to the object identity of the target object;

[0011] If the object type is a business object and the object identity does not have an authorization identifier of the service platform, verifying the first binding relationship between the target object and the service platform;

[0012] If the first binding relationship indicates that the target object is bound to the service platform, the channel is verified.

[0013] In some embodiments, if the first binding relationship indicates that the target object is bound to the service platform, verifying the channel includes:

[0014] If the first binding relationship indicates that the target object is bound to the service platform, obtaining the channel status of the channel;

[0015] If the channel status indicates that the channel is in an enabled state, verifying the second binding relationship between the channel and the service platform;

[0016] If the second binding relationship indicates that the channel is bound to the service platform, and the service platform is in an enabled state, the period for binding the channel to the service platform is verified.

[0017] In some embodiments, after determining the object type of the target object according to the object identity of the target object, the permission control method further includes:

[0018] If the object type is a business object and the object identity has the authorization identifier, verify the channel;

[0019] If the object type is a system object and the object identity has a first system identifier, the third binding relationship between the target object and the service platform is verified; if the object type is a system object and the object identity has a second system identifier, the permission status of the target object to the service platform is verified.

[0020] In some embodiments, authenticating the target object's identity further includes:

[0021] In response to a login request from a target object carrying the object identity, performing a login verification on the object identity to obtain a login session identifier;

[0022] In response to a verification code request from the target object carrying the login session identifier, obtaining a verification code;

[0023] In response to a login request from the target object carrying the verification code, the verification code is verified.

[0024] In some embodiments, authenticating the target object's identity further includes:

[0025] determining an object state of the target object according to the object identity;

[0026] If the object status is not frozen, the object identity is cryptographically verified.

[0027] In some embodiments, after enabling the target object to operate the data of the service platform according to the data operation permission, the permission control method further includes:

[0028] Recording operation information after the target object operates on the data into a log;

[0029] The log is stored in a preset blockchain network.

[0030] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a permission control device, comprising:

[0031] An identity authentication module, used to authenticate the identity of the target object;

[0032] An acquisition module is used to obtain the service platform bound to the target object if the identity authentication is passed, and determine the channel bound to the service platform; the channel is assigned a preset role of a preset object and the data operation permission of the service platform associated with the preset role;

[0033] The authority control module is used to assign the data operation authority to the target object if the target object is the same as the preset object, so that the target object can operate the data of the service platform according to the data operation authority.

[0034] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the permission control method described in the first aspect when executing the computer program.

[0035] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the permission control method described in the first aspect above.

[0036] The permission control method, permission control device, electronic device, and storage medium proposed in this application perform identity authentication on the target object to restrict and filter the object identity. If the identity authentication is successful, the service platform bound to the target object is obtained, and the channel bound to the service platform is determined. The channel is assigned a preset role of the preset object and the data operation permission of the service platform associated with the preset role. If the target object is the same as the preset object, the data operation permission is assigned to the target object, so that the target object can operate on the data of the service platform according to the data operation permission, thereby realizing unified management of the permissions of multiple service platforms bound to the target object, improving the efficiency and security of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is a flowchart of a permission control method provided in an embodiment of the present application;

[0038] FIG2 is a flow chart of step S110 in FIG1 ;

[0039] FIG3 is another flow chart of the permission control method provided in an embodiment of the present application;

[0040] FIG4 is a flow chart of step S230 in FIG2 ;

[0041] FIG5 is another flow chart of step S110 in FIG1 ;

[0042] FIG6 is another flow chart of step S110 in FIG1 ;

[0043] FIG7 is another flow chart of the permission control method provided in an embodiment of the present application;

[0044] FIG8 is a schematic diagram of the structure of the permission control device provided in an embodiment of the present application;

[0045] FIG9 is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0047] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0049] Permission management across various service platforms (application systems) is a critical issue. Traditionally, permissions management is implemented independently on each service platform. When a user accesses multiple service platforms, permissions must be managed individually for each platform. This results in inconsistent and difficult-to-maintain permissions management, reducing both efficiency and security.

[0050] Based on this, the embodiments of the present application provide a permission control method, a permission control device, an electronic device and a computer-readable storage medium, which aim to achieve unified permission management of multiple service platforms, facilitate the maintenance of permission management, and improve the efficiency and security of permission management.

[0051] The permission control method, permission control device, electronic device and computer-readable storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the permission control method in the embodiments of the present application is described.

[0052] The permission control method provided in the embodiment of the present application relates to the field of control technology. The permission control method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the permission control method, etc., but is not limited to the above forms.

[0053] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0054] Figure 1 is an optional flow chart of the permission control method provided in an embodiment of the present application, which is applied to a permission management system. The permission management system is a cloud computing-based system, including a front-end, a back-end and a database. The front-end adopts the vue.js framework, the back-end adopts the spring boot framework, and the database can adopt at least one of MySQL, Redis, and MongoDB. The permission management system can be connected to multiple service platforms to implement permission control of multiple service platforms. The permission management system uses the concept of user permission center to centralize the permission management of all application systems into a centralized system for management. The security design of the permission management system includes identity authentication, permission control and data encryption. Among them, identity authentication adopts JWT (JSON Web Token) technology. A token will be generated after the target object logs in, and each request needs to carry a token for identity authentication. Permission control adopts the RBAC (Role-Based Access Control) model. The target object needs to be assigned roles and permissions before it can access resource data. Data encryption adopts the RSA encryption algorithm, which can encrypt and store sensitive information of the target object, such as passwords. Docker containerization technology is used to package the front-end, back-end, and database into images, which are then orchestrated and deployed using Docker Compose. This allows the rights management system to be deployed on different server nodes, or the front-end, back-end, and database to be deployed on server nodes with communication links. The rights management system can be managed through a front-end web interface or called through an API interface. The rights management system can run on various operating systems and database platforms. The operating system can be Windows or Linux, and the database platform can be Oracle or MySQL, etc. At the same time, Nginx reverse proxy and HTTPS protocol are used to ensure the security of data transmission. The method in Figure 1 may include, but is not limited to, steps S110 to S130.

[0055] Step S110, performing identity authentication on the target object;

[0056] Step S120: If the identity authentication is successful, the service platform bound to the target object is obtained, and the channel bound to the service platform is determined; the channel is assigned a preset role of the preset object and the data operation authority of the service platform associated with the preset role;

[0057] Step S130: If the target object is the same as the preset object, the data operation authority is assigned to the target object, so that the target object can operate the data of the service platform according to the data operation authority.

[0058] In steps S110 to S130 of the embodiment of the present application, the target object's identity is authenticated to restrict and filter the object's identity. If the authentication is successful, the role of the object's identity in the service platform binding channel is determined, and the data of the service platform is operated according to the data operation permissions of the service platform associated with the role. This achieves unified management of the permissions of multiple service platforms bound to the target object, improving the efficiency and security of permission management.

[0059] Please refer to FIG. 2 . In some embodiments, step S110 may include but is not limited to steps S210 to S230 :

[0060] Step S210, determining the object type of the target object according to the object identity of the target object;

[0061] Step S220: If the object type is a business object and the object identity does not have the authorization identifier of the service platform, then verify the first binding relationship between the target object and the service platform;

[0062] Step S230: If the first binding relationship indicates that the target object is bound to the service platform, the channel is verified.

[0063] In step S210 of some embodiments, the rights management system includes a user login interface, which is used to display the service platform that the user can access. The service platform can be an application, a website, etc. The target object is the user, and the object identity of the target object can be the user's account, user name, email address, password, etc. The rights management system includes two user systems, that is, two object types, including business objects and system objects. Business objects are ordinary users of the rights management system, and system objects are developers of the rights management system, etc. Business object tables and system object tables can be designed in the database. The business object table is used to store the object identity of business objects, and the system object table is used to store the object identity of system objects. An identification field can also be designed in the database to identify the object type.

[0064] Specifically, the user selects one or more service platforms on the login interface. When the service platform is in a normal, active state, the user enters their account number, username, email address, and password on the login interface. Based on the account number, username, and email address, the user searches the database's business object table for an object identity that matches the account number, username, and email address. If the object identity exists in the business object table, the target object's object type is determined to be a business object. If the object identity does not exist in the business object table, the user searches the database's system object table for an object identity that matches the account number, username, and email address. If the object identity exists in the system object table, the target object's object type is determined to be a system object. If the object identity does not exist in the system object table, the target object's object identity is incorrectly entered. Alternatively, based on the account number, username, and email address, the user searches the database for an object identity that matches the account number, username, and email address, and the object type is determined based on the object identity's identification field. If no matching object identity is found, the target object's object identity is incorrectly entered. If the number of incorrect object identity entries reaches a preset threshold, the target object is prohibited from logging in for a preset period of time.

[0065] If the account, username, and email address entered by the user match those in the database, a password verification process is performed. The password entered by the user is compared with the password in the database that matches the account, username, and email address. If the passwords are identical, the password verification succeeds. If they are different, the password is incorrect and the verification fails. If the number of incorrect password entries reaches a preset threshold, the target user is blocked from logging in for a preset period of time.

[0066] The login interface also includes a registration function and a password retrieval function. In response to a user's registration request, the object identity entered by the user during the registration phase is stored in the database. In response to a user's password retrieval request, the password re-entered by the user is stored in the database.

[0067] The password storage process is as follows: The target object's password set on the service platform and the target object's public key published by the service platform are obtained. The password is encrypted using the public key and stored in the database. Alternatively, in response to a password retrieval request, a password input interface is displayed. The password entered by the user in the password input decoder is obtained, encrypted using the public key, and the encrypted password is used to overwrite the password in the database.

[0068] After the password is verified, the user validity period can be checked. If the user validity period exceeds the preset validity period, login is prohibited. It is understandable that when the user sends a login request to the service platform, it will carry the token issued by the rights management system. The token has an validity period, and the user validity period refers to the validity period of the token.

[0069] In step S220 of some embodiments, if the object type is a business object, a check is performed to determine whether the target object can obtain authorization from the service platform. If the object identity has an authorization identifier from the service platform, this indicates that the target object can obtain authorization from the service platform. This means that the target object automatically obtains the relevant permissions from the service platform without the need for an administrator to manually assign permissions to the target object. If the object type is a business object and the object identity does not have an authorization identifier from the service platform, the first binding relationship between the target object and the service platform is verified. If the target object can obtain authorization from the service platform, the first binding relationship between the target object and the service platform is not verified.

[0070] In step S230 of some embodiments, a service platform may have multiple channels, and resource data of the service platform needs to be distributed through the channels, where the channels may be operating websites or mobile applications. If the first binding relationship indicates that the target object is bound to the service platform selected on the login interface, the channel is verified.

[0071] In the above steps S210 to S230, the first binding relationship needs to be verified only when the object type is a business object and does not have an authorization identifier. When the object type is a business object and has an authorization identifier, the first binding relationship does not need to be verified. Different verification logic can be implemented according to the object type and authorization identifier, which improves the efficiency of verification and realizes identity authentication of different object types.

[0072] Referring to FIG. 3 , in some embodiments, after step S210 , the permission control method may further include but is not limited to step S310 , step S320 , or step S330 :

[0073] Step S310: If the object type is a business object and the object identity has an authorization identifier, the channel is verified;

[0074] Step S320: If the object type is a system object and the object identity has the first system identifier, then verify the third binding relationship between the target object and the service platform;

[0075] Step S330: If the object type is a system object and the object identity has a second system identifier, the permission status of the target object to the service platform is verified.

[0076] In step S310 of some embodiments, if the object type is a business object and the object identity has an authorization identifier, it means that the business object can obtain authorization from the service platform. There is no need to verify the first binding relationship between the target object and the service platform, and the channel can be verified directly.

[0077] In step S320 of some embodiments, the binding logic between different object types and the service platform is different. For different object types, the binding relationship between the target object and the service platform is determined by distinguishing the object type. The first system identifier is the admin identifier. If the object type is a system object and the object identity has the admin identifier, the third binding relationship between the target object and the service platform is verified. When verifying the binding relationship, the list of service platforms bound to the target object is found in the database based on the object identity. The service platform in the service platform list is compared with the service platform selected by the target object on the login page. If the selected service platform exists in the service platform list, it means that the target object is bound to the selected service platform.

[0078] In some embodiments, in step S330, if the object type is a system object and the object identity has a second system identifier, the target object's permission status for the service platform is verified, where the second system identifier is a common identifier and the permission status indicates whether the target object has menu permissions for the service platform. It is understood that the menu permissions for the target object for the service platform can be obtained by searching a database to determine the permission status.

[0079] In the above steps S310 to S330, the verification logic is differentiated according to the different object types, so that the permission control method can be applied to different objects, thereby improving the applicability of the permission management system.

[0080] Referring to FIG. 4 , in some embodiments, step S230 may include but is not limited to steps S410 to S430:

[0081] Step S410: If the first binding relationship indicates that the target object is bound to the service platform, the channel status of the channel is obtained;

[0082] Step S420: If the channel status indicates that the channel is in an enabled state, verify the second binding relationship between the channel and the service platform;

[0083] Step S430: If the second binding relationship indicates that the channel is bound to the service platform, and the service platform is in an enabled state, the term of the channel binding to the service platform is verified.

[0084] In step S410 of some embodiments, if the first binding relationship indicates that the target object is bound to the service platform, channel verification is performed. During channel verification, the channel status, whether the channel is bound to the service platform, and the duration of the channel binding to the service platform are sequentially verified. The channel status of the channel is then obtained to perform channel status verification. The channel status includes an enabled state and a disabled state. The enabled state indicates that the channel can be used, while the disabled state indicates that the channel cannot be used. If the channel status is disabled, it indicates that the channel status verification has failed and identity authentication has failed.

[0085] In step S420 of some embodiments, if the channel status indicates that the channel is in an enabled state, the second binding relationship between the channel and the service platform is checked to determine whether the channel is bound to the service platform. Simultaneously, the platform status of the service platform is checked to ensure that the platform status is enabled.

[0086] In step S430 of some embodiments, if the second binding relationship indicates that the channel is bound to the service platform, and the service platform is in an enabled state, the term of the channel binding service platform is compared with the preset validity period. If the term exceeds the preset validity period, it means that the second binding relationship is invalid and the identity authentication fails. If the term does not exceed the preset validity period, it means that the second binding relationship is within the validity period. If the second binding relationship indicates that the channel is not bound to the service platform, or the service platform is in a disabled state, it means that the channel verification fails and the identity authentication fails. It can be understood that if there is a hierarchical relationship between channels, all superiors are recursively performed to perform the verification logic of steps S410 to S430.

[0087] The above steps S410 to S430 only perform channel verification on the business object, which can ensure that the channel bound to the service platform is in an enabled state and the binding relationship is established, while improving the efficiency of verification.

[0088] Please refer to FIG. 5 . In some embodiments, step S110 may further include, but is not limited to, steps S510 to S530:

[0089] Step S510: In response to a login request from a target object carrying an object identity, a login verification is performed on the object identity to obtain a login session identifier;

[0090] Step S520, in response to the target object's request to send a verification code carrying the login session identifier, obtain a verification code;

[0091] Step S530: In response to the target object's login request carrying the verification code, verify the verification code.

[0092] In step S510 of some embodiments, if the target object turns on the dual authentication function, the identity of the object needs to be dual authenticated. The dual authentication method can be selected from the account + fingerprint, account + verification code and other methods. The user needs to provide multiple authentication factors at the same time to pass the identity authentication, and the security of identity authentication is improved through multi-factor authentication. In the account + fingerprint authentication method, the account entered by the user is compared with the preset account in the database, and the fingerprint entered by the user is compared with the preset fingerprint in the database. If both are the same, it means that the identity authentication is successful. In the account + verification code authentication method, the target object sends a login request to the service platform, and the service platform forwards the login request carrying the object identity to the authority management system, and the authority management system performs login verification based on the object identity. If the login verification is successful, the authority management system returns the login session identification code to the service platform, and the service platform returns the code to the web front-end corresponding to the target object. The login session identification is an identification indicating that the user needs to turn on dual authentication for login.

[0093] In step S520 of some embodiments, the web front end carries the code to transmit the verification code request to the service platform, the service platform transmits the verification code request to the rights management system, the rights management system sends a dual authentication verification code email to the service management platform, and the service management platform forwards the email to the web front end so that the target object receives the email and obtains the verification code. The verification code is a random 6-digit number generated based on the mailbox. It is understandable that various requests from the web front end, including login requests and verification code request, are forwarded through the gateway to the rights management system or the open interface open to the outside world of the rights management system, openapi, where openapi is not connected to the database, and all data forwarded to openapi is processed by the rights management system. When forwarded to the openapi interface, the data can be forwarded to the rights management system via the HTTP protocol.

[0094] In step S530 of some embodiments, the web front-end sends a login request to the service platform, carrying a verification code. The service platform then sends the login request to the rights management system, which verifies the verification code. If the verification code is verified, the rights management system generates an access token in response to the login request and forwards the access token to the web front-end via the service platform. This allows the user to log in directly with the still-valid access token the next time, without having to go through the code distribution and verification code distribution stages, thereby improving the efficiency of identity authentication. The access token can be valid for 12 hours, which can be set based on actual circumstances.

[0095] The above steps S510 to S530 further improve the security of identity authentication through dual authentication.

[0096] Please refer to FIG6 . In some embodiments, step S110 may further include but is not limited to steps S610 to S620 :

[0097] Step S610, determining the object state of the target object according to the object identity;

[0098] Step S620: If the object status is not frozen, perform a password verification on the object identity.

[0099] In step S610 of some embodiments, the object status is determined according to the object identity, such as account number, user name, etc. The object status includes a frozen state and a non-frozen state.

[0100] In step S620 of some embodiments, if the object status is frozen, the identity authentication fails. If the object status is not frozen, the password is verified to determine whether the target object needs to change the password. The password verification includes password expiration verification and password reset verification. During the password expiration verification, if the password expiration exceeds the validity period, the password needs to be changed. During the password reset verification, it is determined whether the user has sent a password reset request. When the password reset request is received, the password needs to be changed. When changing the password, two inputs can be set to determine whether the passwords entered twice are the same. If the passwords are the same, the password change is successful, otherwise the password needs to be reset.

[0101] In the above steps S610 to S620, by verifying the user status, a user in a frozen state cannot log in, thereby improving the security of identity authentication. By verifying whether the password needs to be modified, the security of the password can be guaranteed.

[0102] In step S120 of some embodiments, the rights management system uses unified authentication. Once identity authentication is passed, the user only needs to perform identity authentication once. Furthermore, the rights management system uses single sign-on. Once identity authentication is passed, the user can log in to the service platform, achieving access to multiple service platforms with only one login. The rights management system supports multiple languages, making it convenient for different users. The main functions of the rights management system include multiple modules such as platform management, platform menu management, user management, channel management, role management, access control module, rights management, and log management.

[0103] The platform management module primarily includes basic platform information and key pair management. Basic platform information includes the service platform name, logo, and website. Key pair management involves storing the service platform's RSA public key in the permissions management system's database. When the service platform connects to the permissions management system, data is transmitted via HTTP. The data must be signed with the service platform's RSA private key. The permissions management system verifies the signature using the public key to verify its legitimacy. The public key is then used to encrypt the original password, generating a ciphertext that is stored in the database.

[0104] The platform menu management module is responsible for maintaining the basic information of the menu, including the menu name, menu type, menu function, permission identifier, and remarks. The menu name can be the XX menu of the XX service platform, and the menu types include the start menu, control menu, shortcut menu, drop-down menu, and cascading menu. The permission identifier is used to identify the menu permissions corresponding to the service platform. The menu permissions are add, delete, modify, and check permissions. Each service platform can maintain its own menus separately, display all its own menus in the form of a menu list, and can use buttons to add, delete, modify, and check menus.

[0105] The channel management module includes functions such as channel information management, platform allocation for channel binding, and creation of channel master accounts. Channel information includes basic channel information, new channels, updated channels, service platform information bound to the channel, etc. Basic information can be the name and function of the channel. The platform allocation function refers to binding the platform to the channel and specifying the validity period. The permission management system has only one super administrator root who can create ordinary users and upgrade ordinary users to business system administrators. When creating a channel master account, each channel has only one master account as the owner of the channel. Each channel has a default master role (master account). The menu permissions of the channel are reflected through the master role, and the master role has all the menu permissions of the channel. The menu permissions of the ordinary role are part of the menu permissions of the main role.

[0106] The user management module includes functions such as user information management, user role assignment, and user permission management. User information includes the user's basic information, the user's corresponding role information, etc. Basic information includes name, email address, and address, etc. Role information includes role name, menu permissions corresponding to the role, notes, etc. User role assignment refers to assigning users to corresponding roles. User permission management is used to manage user permission information, including operations such as adding, deleting, and modifying. It can be understood that user permission information is reflected through roles. When it is necessary to manage user permissions, it is only necessary to edit the permissions for the role bound to the user.

[0107] The role management module includes functions such as role information management, role authority allocation, and role user management.

[0108] Role information includes basic role information, permissions, and more. Role permission assignment refers to assigning permissions to corresponding roles. Role user management refers to managing user information under a role, including operations such as adding, deleting, and modifying.

[0109] The permissions management module includes permissions information management, permissions role assignment, and permissions user management. Permission information includes basic service platform information and corresponding menu permissions. The permissions role assignment function is used to assign permissions to corresponding roles. Permission user management is used to manage the information of users with permissions, including operations such as adding, deleting, and modifying permissions.

[0110] The access control module includes access control and security logging. Access control is based on the user's role permissions and the role permissions stored in the permission management system. If the two role permissions are the same, access to the service platform is allowed. Security logging is used to record user access information, including access time and access content.

[0111] If identity authentication succeeds, the platform management module retrieves the service platform bound to the target object, and the channel management module determines the channel bound to the service platform. This service platform can be the service platform selected by the target object on the login interface and bound to the target object. The channel is assigned a preset role for the preset object and the data operation permissions of the service platform associated with the preset role. Specifically, the preset role is assigned to the channel, and the channel is assigned data operation permissions of the service platform. The preset object is assigned to the preset role, and the preset role is assigned data operation permissions of the service platform.

[0112] In step S130 of some embodiments, the permission information of the service platform is obtained through the permission management module, and the permission is assigned to the main role of the channel through the permission management module to assign data operation permissions to the channel. The preset object is assigned to the preset role through the user management module, and the permission is assigned to the preset role through the role management module. The permission management system manages user permissions in a role-based manner and can flexibly adjust permissions, realize multi-user permission management of multiple service platforms, separate user permissions of different service platforms, improve the flexibility and scalability of permission management, and can adapt to different business needs. At the same time, the permission management system realizes the centralization of permission management, improves the efficiency and security of permission management. The permission management system of the embodiment of the present application can be easily extended to other business systems, and it only needs to add the corresponding permission information in the permission management module. The permission management system can also synchronize data with each service platform to ensure the consistency of user permission information of each service platform and the permission management system, thereby improving the accuracy and reliability of permission management.

[0113] If the target object is the same as the preset object, data operation permissions will be assigned to the target object, allowing the target object to add, delete, modify, and query data on the service platform based on the data operation permissions. If the target object is different from the preset object, it means that the target object does not have the corresponding data operation permissions and cannot operate on the data provided by the service platform to the channel.

[0114] Referring to FIG. 7 , in some embodiments, after step S150 , the permission control method may further include but is not limited to steps S710 to S720 :

[0115] Step S710, recording the operation information after the target object operates on the data into a log;

[0116] Step S720: Store the log in a preset blockchain network.

[0117] In step S710 of some embodiments, the maintenance plan of the rights management system includes log monitoring, performance optimization and version upgrades, and the log management module is responsible for functions such as log monitoring, performance optimization and version upgrades. Log monitoring uses ELK (Elasticsearch, Logstash, Kibana) technology to collect, analyze and display the logs of the rights management system. The log management module is also provided with an alarm mechanism. When the server where the rights management system is deployed has problems such as excessive CPU usage, too little server memory, server hard disk capacity below the preset capacity threshold, and too little remaining space in the virtual machine stack, the alarm mechanism can promptly discover and solve the problem. Performance optimization uses caching technology and load balancing technology to improve the response speed and concurrency capability of the system. Version upgrades use grayscale release and rollback mechanisms to ensure the stability and reliability of the system.

[0118] Through the access control module, the operation information after the target object operates on the channel data is recorded in the log. The operation information may include the data before the operation, the data after the operation, the specific data operation, the operation time, the user permission operation, etc. The permission operation includes login, permission application, permission authorization, permission management and other operations.

[0119] In step S720 of some embodiments, when the log does not contain sensitive data (object identity), the log is stored in a preset blockchain network. The preset blockchain network can be a public chain or a consortium chain. Public chains can ensure the openness and transparency of data, while consortium chains can ensure the privacy and security of data. Smart contracts are deployed on the blockchain network to implement permission management logic and can be written in smart contract languages ​​such as Solidity. When using smart contracts to implement permission management logic, a smart contract containing user information, role information, and permission information is created. When a user's permissions change, the information can be synchronized to the blockchain for storage. Among other things, smart contracts should have strong security to ensure that authorization information cannot be maliciously tampered with by unauthorized persons. Smart contracts should be scalable to meet the needs of continuously developing and growing applications. Smart contracts should be transparent so that administrators can manage them in terms of real-time monitoring and logging. Smart contracts should be easy to use so that users can easily use smart contracts to better manage their authorization information.

[0120] Through the above steps S710 to S720, the reliability of the log data can be guaranteed, so that problems in the rights management system can be located according to the log, which facilitates auditing and tracing, timely discovery and resolution of problems, and maintenance of the rights management system.

[0121] The permission control method of an embodiment of the present application includes: obtaining a business user based on the input account number, username, and email address. If the business user does not exist, obtaining a system user based on the input account number, username, and email address. Verifying whether the number of failed login attempts has reached a certain limit; if the limit is reached, login is prohibited. Verifying the password entered by the user; if the password verification fails, a failure message is recorded; if the threshold is reached, login is restricted. Verifying the user's validity period; if it has expired, login is prohibited. Verifying whether the service platform is authorized for all business users; if all business users are authorized for the platform, the platform-user binding relationship is not verified. Verifying the platform-user binding relationship based on user type. If the user is a business user, the platform information associated with all user roles is used to determine the binding. If the user is a system user and the system user identifier is an admin identifier, the user-platform binding relationship is verified. If the user is a system user and the system user identifier is a general identifier, the user is verified to have menu permissions for the corresponding platform. Channel verification is performed only for business users, sequentially verifying the channel status, verifying whether the channel is bound to the platform (and also verifying the platform's activation status), and verifying the validity period of the channel-platform binding. Verifying the user's status to ensure the user is not frozen. Verifying whether a password change is required, including password expiration and password reset. Update the login time. Verify whether two-factor authentication is required and generate an accessToken. If the previous verification fails, do not continue the verification and consider the identity authentication failed. If the identity authentication passes, obtain the service platform bound to the target object and determine the channel bound to the service platform. Assign the preset role to the channel and assign the channel data operation permissions of the service platform. Assign the preset object to the preset role and assign data operation permissions to the preset role. If the target object is the same as the preset object, assign the data operation permissions of the preset role to the target object, so that the target object can operate on the channel data according to the data operation permissions.

[0122] The permission management method can achieve secure management of user authorization and ensure the security and reliability of data. At the same time, the permission management method has good scalability and maintainability, which can meet the needs of users of different sizes and needs.

[0123] Referring to FIG8 , an embodiment of the present application further provides a permission control device that can implement the above-mentioned permission control method. The device includes:

[0124] The identity authentication module 810 is used to authenticate the identity of the target object;

[0125] The acquisition module 820 is used to obtain the service platform bound to the target object if the identity authentication is passed, and determine the channel bound to the service platform; the channel is assigned a preset role of the preset object and the data operation permissions of the service platform associated with the preset role;

[0126] The authority control module 830 is configured to assign data operation authority to the target object if the target object is the same as the preset object, so that the target object can operate the data of the service platform according to the data operation authority.

[0127] The specific implementation of the authority control device is basically the same as the specific embodiment of the above-mentioned authority control method, and will not be repeated here.

[0128] The present application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the aforementioned permission control method when executing the computer program. The electronic device can be any smart terminal, such as a tablet computer or an in-vehicle computer.

[0129] Please refer to FIG9 , which illustrates a hardware structure of an electronic device according to another embodiment. The electronic device includes:

[0130] The processor 910 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0131] The memory 920 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 920 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 920, and the processor 910 calls and executes the permission control method of the embodiments of this application;

[0132] Input / output interface 930, used to implement information input and output;

[0133] Communication interface 940, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0134] bus 950 , which transmits information between various components of the device (e.g., processor 910 , memory 920 , input / output interface 930 , and communication interface 940 );

[0135] The processor 910 , the memory 920 , the input / output interface 930 , and the communication interface 940 are connected to each other in communication within the device via a bus 950 .

[0136] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above-mentioned permission control method is implemented.

[0137] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0138] The permission control method, permission control device, electronic device, and computer-readable storage medium provided in the embodiments of the present application perform identity authentication on the target object to restrict and filter the object identity. If the identity authentication is successful, the role of the object identity in the service platform binding channel and the data operation permissions of the service platform associated with the role are determined, so that the data of the service platform can be operated according to the data operation permissions, thereby achieving unified management of the permissions of multiple service platforms bound to the target object, improving the efficiency and security of permission management.

[0139] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0140] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0141] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0142] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0143] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0144] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0146] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0148] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0149] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. The permission control method is characterized by: The method comprises: Authenticating the identity of the target object; If the identity authentication is passed, the service platform bound to the target object is obtained, and the channel bound to the service platform is determined; the channel is assigned a preset role of a preset object and the data operation authority of the service platform associated with the preset role; If the target object is the same as the preset object, the data operation authority is assigned to the target object, so that the target object operates the data of the service platform according to the data operation authority.

2. The permission control method according to claim 1, characterized in that: The authenticating the identity of the target object includes: determining the object type of the target object according to the object identity of the target object; If the object type is a business object, and the object identity does not have an authorization identifier of the service platform, verifying the first binding relationship between the target object and the service platform; If the first binding relationship indicates that the target object is bound to the service platform, the channel is verified.

3. The permission control method according to claim 2, characterized in that: If the first binding relationship indicates that the target object is bound to the service platform, verifying the channel includes: If the first binding relationship indicates that the target object is bound to the service platform, obtaining the channel status of the channel; If the channel status indicates that the channel is in an enabled state, verifying a second binding relationship between the channel and the service platform; If the second binding relationship indicates that the channel is bound to the service platform, and the service platform is in an enabled state, the period for binding the channel to the service platform is verified.

4. The permission control method according to claim 2, characterized in that: After determining the object type of the target object according to the object identity of the target object, the permission control method further includes: If the object type is a business object and the object identity has the authorization identifier, verifying the channel; If the object type is a system object and the object identity has a first system identifier, the third binding relationship between the target object and the service platform is verified; if the object type is a system object and the object identity has a second system identifier, the permission status of the target object to the service platform is verified.

5. The permission control method according to claim 2, characterized in that: The identity authentication of the target object also includes: In response to a login request from a target object carrying the object identity, performing a login verification on the object identity to obtain a login session identifier; In response to a request from the target object to send a verification code carrying the login session identifier, obtaining a verification code; In response to a login request from the target object carrying the verification code, the verification code is verified.

6. The permission control method according to claim 2, characterized in that: The identity authentication of the target object also includes: determining an object state of the target object according to the object identity; If the state of the object is not frozen, a password verification is performed on the identity of the object.

7. The permission control method according to any one of claims 1 to 6, characterized in that: After enabling the target object to operate the data of the service platform according to the data operation authority, the authority control method further includes: Recording operation information after the target object operates the data into a log; The log is stored in a preset blockchain network.

8. The authority control device is characterized in that: The device comprises: An identity authentication module, used to authenticate the object identity of the target object; An acquisition module, used for acquiring the service platform bound to the target object if the identity authentication is passed, and determining the channel bound to the service platform; the channel is assigned a preset role of a preset object and data operation permissions of the service platform associated with the preset role; The authority control module is used to assign the data operation authority to the target object if the target object is the same as the preset object, so that the target object can operate the data of the service platform according to the data operation authority.

9. An electronic device, characterized in that The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the permission control method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the permission control method according to any one of claims 1 to 7 is implemented.

Images