Method and apparatus for controlling communication permission in conference

Abstract

Provided in the present application is a method for controlling communication permission in a conference. The method is characterized by comprising: acquiring permission matching rules configured by a manager, wherein the permission matching rules comprise communication rules between a plurality of permission types; in response to an acquisition request from a target user, sending to the target user a target permission type corresponding to the target user, wherein a conference joined by the target user further comprises at least one participant; acquiring target media data sent by a target terminal corresponding to the target user, wherein the media data carries the target permission type; and on the basis of the target permission type, a permission type corresponding to the at least one participant and the permission matching rule, determining whether to send the target media data to the at least one participant, wherein each participant corresponds to one permission type. The method uses the permission matching rules to effectively improve the convenience and flexibility of communication permission management in a conference.

Description

Method and device for controlling communication rights in a conference

[0001] This application claims priority to Chinese patent application number 202410044042.9, filed on January 11, 2024, with the invention name “A method and device for controlling communication rights in a conference”, the entire contents of which are incorporated by reference into this application, and claims priority to Chinese patent application number 202410178057.4, filed on February 8, 2024, with the China Patent Office, with the application name “A method and device for controlling communication rights in a conference”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of conferences, and in particular to a method and device for controlling communication rights in a conference. Background Art

[0003] For information security reasons, many companies have strict rules regarding the sharing of internal information. As one of the most commonly used systems in companies, conferencing systems naturally need to adhere to these rules. For example, a company might require that content between different departments or across different regions not be shared. In short, every company has its own unique requirements.

[0004] Currently, the primary response to these demands is through configuration of the underlying network equipment in the conference system. This typically involves configuring the ports on the network equipment responsible for data exchange. For example, if Region A and Region B are not allowed to send audio to each other, this can be achieved by configuring the ports on the network equipment responsible for transmitting audio data.

[0005] However, relying solely on port settings to control communication permissions during meetings is far from meeting the diverse needs of enterprises. Summary of the Invention

[0006] The present application provides a method and device for controlling communication rights in a conference.

[0007] The first aspect of the present application provides a method for controlling communication permissions in a conference, the method comprising: obtaining permission matching rules configured by an administrator in a conference system, the permission matching rules including communication rules between multiple permission types, the conference system being used to convene a target conference; in response to an acquisition request from a target user, sending a target permission type corresponding to the target user to the target user, the conference to which the target user accesses also including at least one participating user; obtaining target media data sent by a target terminal corresponding to the target user, the media data carrying the target permission type; and determining whether to send the target media data to the at least one participating user based on the target permission type, the permission type corresponding to the at least one participating user, and the permission matching rules, wherein each participating user corresponds to one permission type.

[0008] This method only requires administrators to set it up in the conference system, avoiding the additional configuration of network equipment management systems outside the conference system, greatly improving the convenience of managing communication rights in the meeting; in addition, this method allows administrators to set the permission type of participants according to actual needs, and no longer limits the unit of permission management to the group corresponding to the network device port, effectively improving the flexibility of communication permission management in the meeting.

[0009] In one possible implementation, the permission type configured by the administrator and one or more of the following permission parameters are obtained: work number, region, department, IP address, access network type, and terminal device type; and the correspondence between the permission type configured by the administrator and the permission parameters is recorded.

[0010] In one possible implementation, the acquisition request of the target user carries the permission parameters of the target user. Based on the permission parameters of the target user and according to the permission type configured by the administrator and the correspondence between the permission parameters, the target permission type corresponding to the target user is determined; and the target permission type corresponding to the target user is sent to the target user.

[0011] In one possible implementation, the media data includes one or more of the following: audio data, video data, shared data, and message data, wherein the video data indicates data captured by a camera of the participating terminal, and the shared data indicates data of a shared desktop captured by the participating terminal.

[0012] In one possible implementation, the at least one participating user includes a first participating user, and when it is determined not to send the target media data to the first participating user, a first no-authorization indication message is sent to the first participating user, and the first no-authorization indication message is used to indicate that the first participating user does not have the authority to receive the target media data.

[0013] For conference participants who do not have the authority to obtain target media data, the purpose of ensuring that conference participants with different authority types receive different data in the same conference can be achieved by utilizing the authority-less indication information.

[0014] In one possible implementation, the at least one participating user includes a second participating user, and when it is determined not to send part of the target media data to the second participating user, a second no-authorization indication information and another part of the target media data are sent to the second participating user, and the second no-authorization indication information is used to indicate that the second participating user does not have the authority to receive the part of the target media data.

[0015] For participants who do not have the authority to obtain the complete target media data, the lack of authority indication information can be used to achieve the purpose of fine-grained management of the media data that participants can receive according to their authority types in the same conference.

[0016] In one possible implementation, the permission matching rule includes multiple communication rules, and whether to send the target media data to the at least one participating user is determined according to the permission matching rule, the target permission type, and the permission type corresponding to the at least one participating user, in descending order of priority of the multiple communication rules in the permission matching rule.

[0017] In a possible implementation, the permission type includes one or more of the following: a high-level user, a common user, and an external user, wherein the high-level user and the common user belong to the same enterprise, and the external user does not belong to the enterprise.

[0018] In a possible implementation manner, before obtaining the permission matching rule configured by the administrator, the method further comprises: opening the target conference. In a possible implementation manner, before obtaining the permission matching rule configured by the administrator, the method further comprises: opening the target conference.

[0019] The permission matching rules can be set before or during a meeting. Since the configuration is relatively simple, it allows administrators to configure it flexibly.

[0020] In one possible implementation, the method further includes: obtaining adjustments made by the administrator to the permission matching rules, and determining whether to send the target media data to the at least one participating user based on the adjusted permission matching rules, the permission type corresponding to the at least one participating user, and the target permission type.

[0021] During the meeting, managers can dynamically adjust the permission types of participants or update the communication rules between multiple permission types based on the actual situation of the meeting, thereby realizing real-time adjustment and application of permission matching rules.

[0022] In a possible implementation, the permission matching rule further includes a target topic in the conference, and the target media data is media data associated with the target topic.

[0023] When configuring permission matching rules, include topic identifiers to associate specific topics with permission matching rules, ultimately achieving the goal of controlling meeting permissions by topic. This allows for more precise and targeted communication permission control within meetings.

[0024] The second aspect of the present application provides a device for controlling communication rights in a conference, the system comprising: a communication module for obtaining a right matching rule configured by an administrator in a conference system, the right matching rule including communication rules between multiple right types, the conference system being used to convene a target conference; in response to an acquisition request from a target user, sending a target right type corresponding to the target user to the target user, the conference to which the target user accesses also including at least one participating user; obtaining target media data sent by a target terminal corresponding to the target user, the media data carrying the target right type; a processing module for determining whether to send the target media data to the at least one participating user based on the target right type, the right type corresponding to the at least one participating user and the right matching rule, wherein each participating user corresponds to one right type.

[0025] In one possible implementation, the communication module is also used to obtain the permission type configured by the manager and one or more of the following permission parameters: work number, region, department, IP address, access network type, and terminal device type; the processing module records the correspondence between the permission type configured by the manager and the permission parameters.

[0026] In one possible implementation, the acquisition request of the target user carries the permission parameters of the target user. The processing module is also used to determine the target permission type corresponding to the target user based on the permission parameters of the target user and the correspondence between the permission type configured by the administrator and the permission parameters; the communication module is also used to send the target permission type corresponding to the target user to the target user.

[0027] In one possible implementation, the media data includes one or more of the following: audio data, video data, shared data, and message data, wherein the video data indicates data captured by a camera of the participating terminal, and the shared data indicates data of a shared desktop captured by the participating terminal.

[0028] In one possible implementation, the at least one participating user includes a first participating user, the processing module is further used to determine not to send the target media data to the first participating user, and the communication module is further used to send a first no-authorization indication message to the first participating user, and the first no-authorization indication message is used to indicate that the first participating user does not have the authority to receive the target media data.

[0029] In one possible implementation, the at least one participating user includes a second participating user, the processing module is further used to determine not to send part of the target media data to the second participating user, and the communication module is further used to send a second no-authorization indication information and another part of the target media data to the second participating user, and the second no-authorization indication information is used to indicate that the second participating user does not have the authority to receive the part of the target media data.

[0030] In one possible implementation, the permission matching rule includes multiple communication rules, and the processing module is also used to determine whether to send the target media data to the at least one participating user according to the permission matching rule, the target permission type and the permission type corresponding to the at least one participating user in descending order of priority of the multiple communication rules in the permission matching rule.

[0031] In a possible implementation, the permission type includes one or more of the following: a high-level user, a common user, and an external user, wherein the high-level user and the common user belong to the same enterprise, and the external user does not belong to the enterprise.

[0032] In a possible implementation manner, the processing module is further configured to start the target conference before obtaining the permission matching rule configured by the administrator.

[0033] In a possible implementation, the permission matching rule further includes a target topic in the conference, and the target media data is media data associated with the target topic.

[0034] The third aspect of the present application provides a computing device cluster, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device performs the method provided by the first aspect or any possible design of the first aspect.

[0035] A fourth aspect of the present application provides a computer program product comprising instructions, which, when executed by a computer device cluster, causes the computer device cluster to perform the method provided in the first aspect or any possible design of the first aspect.

[0036] A fifth aspect of the present application provides a computer-readable storage medium comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method provided in the first aspect or any possible design of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0038] FIG1 is an architecture diagram of an internal conference system for an enterprise provided in an embodiment of the present application;

[0039] FIG2 is a diagram of a conference system architecture provided by an embodiment of the present application;

[0040] FIG3 is a flow chart of a communication permission control method provided in an embodiment of the present application;

[0041] FIG4 is a configuration interface provided in an embodiment of the present application;

[0042] FIG5 is another configuration interface provided in an embodiment of the present application;

[0043] FIG6 is another configuration interface provided in an embodiment of the present application;

[0044] FIG7 is a schematic diagram of the structure of a communication authority control device provided in an embodiment of the present application;

[0045] FIG8 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0046] FIG9 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0047] FIG10 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. The terms used in the implementation methods of the present application are only used to explain the specific embodiments of the present application and are not intended to limit the present application.

[0049] Instant Messaging (IM): Instant messaging is commonly seen in real-time communication systems that allow two or more people to use the Internet to instantly transmit text messages, files, voice and video.

[0050] Media data: Media data refers to the video data, shared data, audio data, and message data sent by participating terminals during the meeting.

[0051] Video data: Video data refers to the data collected by the camera of the participating terminal and sent by the participating terminal, such as the image of the participating terminal user, the surrounding environment of the participating location, etc.

[0052] Shared data: Shared data refers to the data collected by the shared desktop sent by the participating terminal. Specifically, it can be the desktop data of all or part of the participating terminal, or the display content of an application running on the participating terminal.

[0053] Audio data: Audio data refers to the sound data sent by the participating terminals, such as the sound emitted by the participating terminal users themselves or the sound of the videos they play, etc.

[0054] Message data: Message data refers to text messages sent by participating terminals, such as text communication content in the chat window of participating terminal users.

[0055] Figure 1 illustrates the architecture of an internal enterprise conferencing system. It illustrates two departments—Sales and Finance. A single meeting involves multiple employees from both the Sales and Finance departments. Each employee connects to a Selective Forwarding Unit (SFU) via a terminal (such as a personal computer (PC)). Data communication links are then established between the two SFUs, allowing access to the meeting. Specifically, different data communication links are established between the two SFUs based on the data type. Each communication link is terminated by ports within the respective SFUs specifically designed to transmit that data type. For example, communication link 1, specifically designed to transmit video data, terminates at ports SFU-S-1 and SFU-F-1. Communication link 2, specifically designed to transmit shared data, terminates at ports SFU-S-2 and SFU-F-2.

[0056] Generally speaking, the information processed on the computer desktops of employees in the finance department is mostly information that needs to be kept confidential internally, such as salary information, company fund usage, or accounting information. Therefore, the company can require that the desktop shared data of the finance department cannot be shared with other departments (including the sales department). To achieve this goal, the SFU on the finance department side can be set up, that is, port SFU-F-2 can only receive shared data, but not send shared data. In this way, during the meeting, when the employees of the sales department share their desktop, the employees of the finance department attending the meeting can see it; and when the employees of the finance department share their desktop, the employees of the sales department attending the meeting can see it. It is worth noting that other employees of the finance department attending the meeting can see the shared desktop at this time, because colleagues in the finance department may use other ports for data transmission.

[0057] It's important to understand that by configuring the SFU's port, you can achieve not only one-way control of data transmission, but also bidirectional control as needed. That is, in the example above, the Finance department wouldn't be able to view the Sales department's shared desktop. In other words, the communication link between the two departments' corresponding SFUs, used to transmit shared data, is disabled, but this doesn't affect employees from both departments from participating in the same meeting.

[0058] As the above examples show, configuring the ports of network devices (such as SFUs) can meet simple enterprise information security needs to a certain extent. However, this approach cannot meet complex and diverse information security needs. For example, if an enterprise stipulates that ordinary employees in the sales department cannot receive shared data from the finance department, but high-level employees in the sales department (such as managers) are authorized to receive shared data from the finance department, then this requirement may only be achieved by adding new ports or even new network devices for these high-level employees. This significantly increases the cost and difficulty of network equipment modification for the enterprise. Furthermore, although network devices (such as SFUs) are the underlying hardware of the conference system, modification or configuration of network devices must be performed outside of the conference system, which increases the workload of the enterprise's information technology (IT) staff. Finally, since the network device management system is usually independent of the conference system, when new rules need to be issued, IT staff must first be notified, and then the IT staff can use the network device management system to manage and configure the network devices. In other words, this approach cannot flexibly and timely manage and configure network devices, and naturally cannot flexibly meet the enterprise's information security needs.

[0059] In light of this, the present application proposes a method for controlling communication permissions in meetings. Specifically, the conference system can receive permission matching rules configured by enterprise managers at any time. During the meeting, the conference management server and media server implement communication permission control between multiple users based on these permission matching rules. The permission matching rules include communication permissions between participating roles. This method does not require the configuration or modification of network device ports, but instead relies on the conference system to complete communication permission control, greatly improving the efficiency and flexibility of communication permission control.

[0060] FIG2 shows a conference system architecture involved in this application. Generally speaking, the conference system 100 includes a conference management server 101, a media server 102, and a terminal device 104. In some possible cases, the conference system 100 also includes a message server 103.

[0061] On the one hand, the conference management server 101 is used to receive the permission matching rules configured by the enterprise management personnel, and on the other hand, it is used to send part or all of the permission matching rules to the media server 102 and the message server 103, so that the media server 102 and the message server 105 forward the received media data based on the received permission matching rules. The conference management server 101 can be an independent physical server or a physical server cluster. Of course, virtualization technology can also be used to implement the functions of the conference management server 101 through a virtualization instance (such as a virtual machine or container, etc.); its functions can also be implemented through a virtualization instance cluster. In some possible implementation methods, the conference management server 101 will also provide a configuration interface for receiving the permission matching rules configured by the enterprise management personnel. The configuration interface will be described in detail below.

[0062] In addition to being used to obtain part or all of the permission matching rules, the media server 102 is also used to establish a media data channel between terminal devices to achieve the forwarding of media data between terminal devices. The forwarding operation is performed based on the aforementioned permission matching rules. It should be noted that the media server 102 can be an SFU or a multi-point control unit (MCU). It should be understood that this application does not limit the implementation method of the media server 102. Corresponding to the existence of the media server 102, the conference management server 101 will provide a display window for displaying the video data and / or shared data of the terminal user.

[0063] In addition to obtaining some or all of the permission matching rules, message server 103 is also used to establish a message data channel between terminal devices to facilitate the forwarding of message data between them. This forwarding operation is based on the aforementioned permission matching rules. In response to the presence of message server 103, conference management server 101 provides a chat window to display the terminal user's message data.

[0064] It should be noted that in some possible scenarios, the media server 102 can be used to process various types of media data, so the message server 103 is optional. However, in some possible scenarios, there is a message server 103 specifically used to process message data. In this scenario, the media server 102 is used to process media data other than message data, and the message server 103 is specifically used to process message data. This application does not limit the name or number of servers that process media data, that is, for media data such as video data, shared data, audio data, and message data, dedicated servers can be used for data transmission. For example, the following will be expanded on the example of the media server 102 being used to process the first three types of data and the message server 103 being used to process message data.

[0065] Terminal device 104 is a multimedia device used to access the conference, such as a mobile phone, computer, or tablet. In some possible implementations, terminal device 104 can also be a virtual terminal provided by a cloud mobile phone service or cloud desktop service. End users use terminal device 104 and login credentials to access the conference and enable functions such as viewing, speaking, chatting, video, and sharing. In response to the presence of terminal device 104, conference management server 101 provides a login interface for obtaining and verifying the user's login credentials.

[0066] Next, the communication permission control method 200 provided by this application is introduced based on FIG3:

[0067] S201: The enterprise manager configures the permission matching rules in the configuration interface provided by the conference management server 101;

[0068] Permission matching rules indicate the communication rules between different permission types. Before introducing permission matching rules, we first introduce permission types.

[0069] From the mapping point of view, each user corresponds to a permission type, and the correspondence between this user and permission type can be configured by enterprise managers.

[0070] From the perspective of type classification, permission types can be simply divided into advanced users and ordinary users. Correspondingly, the permission matching rules should include the communication rules between advanced user permissions and low-level user permissions. In one possible implementation, permission types can be divided into high-level users, ordinary users, and external users. Correspondingly, the permission matching rules should include the communication rules between high-level users, ordinary users, and external users. It should be understood that this application does not limit the number of levels of division and naming of permission types. In other words, enterprise managers can set permission types with more hierarchical levels as needed. It should be understood that no matter how many permission types there are, the focus is that the communication rules between permission types at different levels have different settings.

[0071] From the perspective of parameter configuration, permission types can be configured according to the needs of the enterprise. For example, they can be configured based on one or more of the following parameters: user, department, region, access network type, Internet Protocol Address (IP Address), terminal device type, etc.

[0072] 4 shows a schematic diagram of a configuration interface 300 , which includes a parameter selection control 301 and a permission type selection control 302 .

[0073] Enterprise managers can use parameter selection control 301 to select one or more parameters to set as needed. Each parameter selection box provides a drop-down menu for the enterprise manager to select. Alternatively, the enterprise manager can enter information directly in the text box to achieve search or direct input. Specifically, the employee ID is used to identify the employee. Generally, each employee's employee ID is unique. Enterprise managers can use this parameter to configure permission types for specific employees. Regions can include the country, city, region, or administrative division where the enterprise's business location is located. Enterprise managers can use this parameter to configure permission types for participants in a specific region. IP addresses can include multiple IP addresses and multiple IP address segments. Enterprise managers can use this parameter to configure permission types for participants whose access points are located at a specific IP address or IP address segment. Access network types include intranet and extranet. Enterprise managers can use this parameter to configure permission types for participants whose access points are located at the intranet or extranet. Terminal device types include mobile phones, PCs, and tablet computers. Enterprise managers can use this parameter to configure permission types for participants whose access terminal devices are mobile phones, PCs, and tablet computers. After completing the setting of the above parameters, the permission type can be configured for the participants who meet the above parameters. As shown in the permission type selection control 302, by clicking the drop-down menu, the enterprise manager can select one of the multiple options for configuration.

[0074] As mentioned above, the permission matching rules indicate the communication rules between different permission types. Enterprise managers can set the permission matching rules through the configuration interface, or upload files or scripts carrying the permission matching rules to the conference management server 101 to complete the configuration.

[0075] 5 provides a schematic diagram of a configuration interface 400. The configuration interface 400 includes a permission type configuration control 401, a communication rule configuration control 402, and an add-item control 403.

[0076] Permission type configuration control 401 includes a sender and receiver. Enterprise administrators can configure these settings as needed. Communication rule configuration control 402 exemplifies four parameters: audio, video, sharing, and message, corresponding to audio data, video data, shared data, and message data, respectively. Enterprise administrators can select "allow" (√) or "disallow" (×) for each of these four parameters as needed.

[0077] As shown in the permission matching rules in the first row, when the permission type of the sender is high-level user and the permission type of the receiver is ordinary user, the ordinary user can receive audio data, video data, and message data from the high-level user in the meeting, but cannot receive the shared data of the high-level user. This may be because the desktop of the high-level user usually displays some confidential content or is not convenient to show to the participants with the ordinary user permission type.

[0078] In some possible implementations, when enterprise managers add a new row of rules using the add-in control 403, they can further select from "one-way" and "two-way" (not shown in the figure). Optionally, "one-way" will be the default option, and enterprise managers can check "two-way" as needed. Among them, "one-way" indicates that the setting of this rule is only for the situation where the "sender" sends media data to the "receiver" in the meeting, while "two-way" indicates that the setting of this rule is for both the situation where the "sender" sends media data to the "receiver" in the meeting, and the situation where the "receiver" sends media data to the "sender" in the meeting. For example, taking the first row as an example, when the user checks "two-way" when setting, a rule will be generated synchronously: when the permission type of the sender is an ordinary user, and the permission type of the receiver is a high-level user, the high-level user can receive audio data, video data and message data from ordinary users in the meeting, but cannot receive shared data from ordinary users. This setting can effectively improve the configuration efficiency of enterprise managers.

[0079] For example, FIG6 also provides a schematic diagram of a configuration interface 500. The permission matching rules shown in the configuration interface 500 include priority parameters, a sender, a receiver, a data type, and a rule. Among them, the types of the sender and the receiver include: high-level users, ordinary users, ordinary users, and all. Among them, all indicates that at least the first three are included. Optionally, all can also include any permission type, such as a newly added permission type. The data types include audio, video, sharing, and message, which correspond to audio data, video data, sharing data, and message data, respectively. The rules include two options: allow and prohibit. It should be noted that the priority, the smaller the number corresponding to the priority, the higher the priority of the rule. When the server needs to use the permission matching rules to determine whether data communication is allowed, it will be checked one by one in order of priority from high to low. For example, if a conference includes attendees with permissions of High-Confidentiality, Standard User, and External User, and a Standard User attempts to send a message to the conference chat window, the server will first check the rule with priority 1. If it determines that the sender of this rule is not a Standard User, it will consider it a match and then check the rule with priority 2. If it determines that the second rule allows Standard User attendees to send all types of data (such as audio, video, shared data, and messages) to High-Confidentiality attendees, then according to the priority 2 rule, the message will be sent to the High-Confidentiality attendee. Next, the server will check the rule with priority 3, which prohibits Standard User attendees from sending messages to External User attendees. Therefore, the server will not send messages to the External User attendee. Once all attendees have defined data transmission rules, the server will not perform further checks.

[0080] In some possible implementations, the server can provide a default fallback rule. When a permission type attempts to send a specific type of data to another permission type, if none of the rules set by the enterprise administrator match the data, the server will use the fallback rule to prohibit the transmission of the data. Optionally, enterprise administrators can select, delete, or modify the fallback clause as needed.

[0081] Similar to the rules shown in the configuration interfaces of FIG. 4 and FIG. 5 , enterprise managers can add, delete, modify, and perform other operations as needed.

[0082] It should be noted that, on the one hand, the occurrence time of the permission type configuration operation can be earlier than the occurrence time of the permission matching rule setting, or later than the occurrence time of the permission matching rule setting; on the other hand, the occurrence time of these two types of operations can be set in advance before the meeting starts, or can be set during the meeting.

[0083] S202: The conference management server 101 sends the permission matching rule to the media server 102;

[0084] When the enterprise manager completes configuring the authority matching rules, the conference management server 101 will send the complete or partial authority matching rules to the media server 102 .

[0085] Optionally, some of the permission matching rules refer to rules related only to the media server 102. When the media server 102 is used only to process media data other than message data, the media server 102 will receive permission matching rules with data types of video, sharing, audio, and all.

[0086] S203: The conference management server 101 sends the permission matching rule to the message server 103;

[0087] When the enterprise manager completes configuring the authority matching rules, the conference management server 101 will send the complete or partial authority matching rules to the message server 103 .

[0088] Optionally, the partial permission matching rules refer to rules only related to the message server 103. When the message server 103 is only used to process message data, the media server 102 will receive the data type of message and all permission matching rules.

[0089] S204: Multiple terminals obtain their respective permission types from the conference management server 101;

[0090] For example, when terminal user A attempts to use a terminal device to participate in a meeting, the terminal device must first obtain the corresponding permission type from the meeting management server 101. The attempt to use the terminal device to participate in a meeting can be an action in which the user opens or logs into a meeting application, or enters an account number and password and clicks confirm.

[0091] In some possible implementations, the terminal device can obtain its corresponding permission type without the user's awareness. Taking terminal user A as an enterprise employee as an example, when the employee attempts to access a meeting, the terminal device corresponding to the terminal user A will send one or more of the following parameters to the conference management server 101: work number, terminal device type, employee's region, employee's department, access point IP address, terminal device access network type, terminal device type. Corresponding to the aforementioned permission type configuration interface 300, the conference management server 101 will determine the permission type of the terminal user A based on the correspondence between the parameters set by the enterprise manager and the permission type, and then return the permission type to the terminal device.

[0092] In some possible implementations, when a terminal device attempts to use the terminal device to participate in a conference, the conference management server 101 sends a permission matching rule to the terminal device, and the terminal device determines the corresponding permission type according to the permission matching rule.

[0093] In some possible implementations, when end user A last participated in a conference, the terminal device stored the permission type from that time. Therefore, the terminal device corresponding to end user A will send the following parameters to conference management server 101, which may also include the user's last permission type. In this implementation, the terminal device may receive a response message from conference management server 101 indicating that the permission type remains unchanged, or a response message indicating that the permission type remains unchanged.

[0094] S205: Multiple terminal users establish a communication channel with the server using the terminal device 104, login credentials, and permission type;

[0095] After obtaining the corresponding permission type in S204, terminal user A can access the meeting using terminal device 104, login credentials, and permission type. The login credentials include but are not limited to the meeting link, account number and password, face recognition information, and fingerprint recognition information.

[0096] After the conference management server 101 confirms that the terminal device has accessed the conference, it will instruct the terminal device to establish a communication connection with the server. For example, the terminal device will establish a communication connection with the media server and the message server. Take the establishment of a communication connection between the terminal device and the media server as an example: the conference management server 101 sends an instruction to the terminal device instructing it to establish a communication connection with the media server, which carries the address of the media server 102 (such as an IP address), and the terminal device sends a communication channel establishment request carrying its permission type to the media server 102. In response to the communication channel establishment request, the media server 102 will establish a communication channel with the terminal device. Since establishing a communication channel between two devices belongs to the prior art, it will not be repeated in this application. It should be noted that while establishing the communication channel, the media server 102 also marks the terminal device according to the permission type carried in the communication channel establishment request. The establishment of the communication channel between the terminal device and the message server 103 can refer to the above content.

[0097] S206: End user A sends media data to the media server 102;

[0098] After the terminal device corresponding to the terminal user A establishes a communication channel with the media server 102, the terminal user A can participate in the conference, and the terminal device can receive and send data.

[0099] Next, let's take the example of three participants, namely terminal user A, terminal user B and terminal user C. When terminal user A attempts to share a document on his desktop and explain the document at the meeting, the media data sent uplink from the terminal device corresponding to terminal user A to the media server 102 may include video data, audio data and shared data, among which the video data is mainly used to display the personal image of terminal user A, the audio data includes the data explained by terminal user A, and the shared data includes the data corresponding to the document on his desktop.

[0100] S207: The media server 102 sends media data to other terminal users according to the permission matching rule;

[0101] After receiving the media data including the video data, audio data and shared data, the media server 102 determines whether to send part or all of the media data to other terminal users according to the permission matching rule.

[0102] Assume that the permission type corresponding to terminal user A is ordinary user, the permission type corresponding to terminal user B is high-security user, and the permission type corresponding to terminal user C is external user. Taking the permission matching rules shown in FIG6 as an example, the matching rule with priority 1 is first used. When the sender (high-security user) in the confirmation rule is inconsistent with the actual sender (ordinary user), the matching rule with priority 2 is sequentially judged. According to this matching rule, terminal user A can send any type of media data to terminal user B. Therefore, media server 102 will send all media data received from terminal user A to terminal user B. Next, the matching rule with priority 3 is judged. Although the sender and receiver in the matching rule with priority 3 are consistent with the actual situation in this example, because the data type is limited to message data, no match can be made. Therefore, the matching rule with priority 4 is next judged. According to this matching rule, terminal user A can send audio data to terminal user C. Therefore, media server 102 will send the audio data received from terminal user A to terminal user C. At this point, it's unclear whether end user A's video data and shared data can be sent to end user C. Therefore, the final decision is based on the lowest-priority fallback rule. According to this fallback rule, end user A's video data and shared data are prohibited from being sent to end user C. At this point, the media server 102 has sent the media data from end user A to other end users based on the permission matching rule.

[0103] In one possible implementation, a prompt will be displayed on the receiving end for audio data, shared data, and video data that are prohibited from transmission, such as displaying the words "Unauthorized Content." Therefore, according to the above example, the terminal device corresponding to terminal user C will display "Unauthorized Content" to inform terminal user C that it does not have permission to receive the audio data, video data, and shared data sent by terminal user A.

[0104] S208: Terminal user A sends message data to the message server 103;

[0105] In one possible implementation, in addition to sharing a document on their desktop and explaining it during the meeting, terminal user A also sends a text message in the chat window, such as the storage address of the shared document, so that participants can view the document themselves. In other words, terminal user A further sends message data to the message server 103.

[0106] S209: The message server 103 sends message data to other terminal users according to the authority matching rule;

[0107] After receiving the above message data, the message server 103 determines whether to send the message data to other terminal users according to the permission matching rule.

[0108] Still taking the permission matching rule shown in FIG. 6 as an example, according to a matching method similar to that in S207 , it can be determined that: terminal user B can see the message sent by terminal user A, while terminal user C cannot see the message sent by terminal user A.

[0109] In one possible implementation, a message prohibiting transmission of message data will be displayed on the receiving end, such as a message stating "Unauthorized Content." Therefore, according to the above example, the terminal device corresponding to terminal user C will display "Unauthorized Content" to indicate that terminal user C does not have permission to receive the message data sent by terminal user A.

[0110] As mentioned above, the message server 103 is not required as a server dedicated to processing message data, so the above steps S203, S208 and S209 are also optional.

[0111] It's important to note that the above method can be applied not only to the entire meeting, but also to one or more specific topics within the meeting. Specifically, when configuring permission matching rules, the topic identifier can be included to associate the specific topic with the permission matching rules, ultimately achieving the goal of controlling meeting permissions by topic. Based on this, communication permission control within the meeting can be implemented more accurately and targetedly.

[0112] In summary, this application proposes a method for controlling communication permissions in a conference. After the conference management server 101 obtains the permission matching rules configured by the enterprise management personnel, it sends the rules to the media server 102 and the message server 103. At the same time, before a terminal device enters the conference, the permission type corresponding to the terminal device is sent to the terminal device, so that the terminal device establishes a communication connection with the media server 102 and the message server 103 based on the permission type. After receiving media data from a terminal device, the media server 102 and the message server 103 can determine whether to forward the media data to other terminal devices based on the permission matching rules, thereby realizing communication permission control in the conference.

[0113] This method only requires enterprise managers to set it up in the conference system, avoiding the additional configuration of network equipment management systems outside the conference system, greatly improving the convenience of managing communication rights in meetings; in addition, this method allows enterprise managers to set it up as needed, and no longer limits the unit of permission management to the group corresponding to the network device port, effectively improving the flexibility of communication rights management in meetings.

[0114] The present application further provides a communication authority control device 600, as shown in FIG7 , comprising:

[0115] The communication module 601 is used to obtain the permission matching rules configured by the enterprise administrator in the configuration interface provided by the conference management server 101 in step S201, and is also used to obtain the acquisition request sent by at least one terminal in step S204, and based on the acquisition request, send a response message carrying the permission type to the at least one terminal. In step S205, the communication module 601 is used to receive the terminal user's login credentials and permission type. Furthermore, the communication module 601 is also used to obtain media data sent by the terminal user in step S206, where the media data includes one or more of the following: audio data, video data, shared data, and message data. After receiving the media data sent by the terminal user, the communication module 601 is also used to send the media data to other terminal users in step S207.

[0116] Processing module 602 is configured to establish a communication channel with the terminal device based on the terminal user's login credentials and permission type in step S205. After receiving the media data sent by the terminal device in step S206, processing module 602 is configured to determine, based on permission matching rules, which users to send the media data to and which users to send the no-permission indication information to. Optionally, for users sending media data, it is also necessary to determine whether to send complete or partial media data to these users, which is determined based on the permission matching rules.

[0117] Storage module 603 is used to store the permission matching rules configured by the enterprise administrator in step S201. Specifically, the permission matching rules also include the corresponding relationship between the permission type and permission parameters configured by the administrator. In one possible implementation, in order to implement the function of sending a no-authority indication message to the user in step S307, storage module 603 is also used to store the no-authority indication message.

[0118] The communication module 601, processing module 602, and storage module 603 can all be implemented via software or hardware. For example, the implementation of the communication module 601 will be described below using the communication module 601 as an example. Similarly, the implementation of the processing module 602 and storage module 603 can refer to the implementation of the communication module 601.

[0119] As an example of a software functional unit, the communication module 601 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the communication module 601 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0120] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0121] As an example of a hardware functional unit, the communication module 601 may include at least one computing device, such as a server. Alternatively, the communication module 601 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0122] The multiple computing devices included in the communication module 601 can be distributed in the same region or in different regions. The multiple computing devices included in the communication module 601 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the communication module 601 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0123] It should be noted that, in other embodiments, the communication module 601 can be used to execute any step in the communication authority control method 200, the processing module 602 can be used to execute any step in the communication authority control method 200, and the storage module 603 can be used to execute any step in the communication authority control method 200. The steps that the communication module 601, the processing module 602 and the storage module 603 are responsible for implementing can be specified as needed. The full functions of the communication authority control device 600 are realized by respectively implementing different steps in the communication authority control method 200 through the communication module 601, the processing module 602 and the storage module 603.

[0124] In summary, the communication authority control device 600 can be a software functional unit, a hardware functional unit, or a combination of a software functional unit and a hardware functional unit. For example, the communication authority control device 600 can be a cloud management platform.

[0125] Next, we will introduce the cloud management platform:

[0126] The cloud management platform is used to provide an access interface (such as an interface or application programming interface (API)). Tenants can operate the client remote access access interface to register a cloud account and password on the cloud management platform and log in to the cloud management platform. After the cloud management platform successfully authenticates the cloud account and password, the tenant can further pay to select and purchase a virtual machine with specific specifications (processor, memory, disk) on the cloud management platform. After the payment is successful, the cloud management platform provides the remote login account and password of the purchased virtual machine. The client can remotely log in to the virtual machine and install and run the tenant's application in the virtual machine.

[0127] The cloud management platform's logical functionalities are divided into the following: User Console, Compute Management Service, Network Management Service, Storage Management Service, Authentication Service, and Image Management Service. The User Console provides an interface or API for interacting with tenants. Compute Management Service manages servers running virtual machines and containers, as well as bare metal servers. Network Management Service manages network services (such as gateways and firewalls). Storage Management Service manages storage services (such as data bucket services). Authentication Service manages tenant accounts and passwords. Image Management Service manages virtual machine images.

[0128] The cloud management platform also provides a cloud management platform client for receiving control plane commands sent by the cloud management platform, creating and managing virtual machines throughout their life cycle on the server according to the control plane control commands.

[0129] Therefore, tenants can create, manage, log in to, and operate instances such as virtual machines, containers, and bare metal servers in cloud data centers through the cloud management platform.

[0130] This application also provides a computing device 700. As shown in Figure 8, computing device 700 includes a bus 702, a processor 704, a memory 706, and a communication interface 708. Processor 704, memory 706, and communication interface 708 communicate with each other via bus 702. Computing device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 700.

[0131] Bus 702 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG8 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 704 may include a path for transmitting information between various components of computing device 700 (e.g., memory 706, processor 704, and communication interface 708).

[0132] The processor 704 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0133] The memory 706 may include volatile memory, such as random access memory (RAM). The processor 704 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0134] The memory 706 stores executable program code, and the processor 704 executes the executable program code to respectively implement the functions of the aforementioned communication module 601, processing module 602, and storage module 603, thereby implementing the communication permission control method 200. That is, the memory 706 stores instructions for executing the communication permission control method 200.

[0135] The communication interface 703 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or a communication network.

[0136] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0137] As shown in Figure 9, the computing device cluster includes at least one computing device 700. The memory 706 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the communication permission control method 200.

[0138] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also respectively store some instructions for executing the communication permission control method 200. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for executing the communication permission control method 200.

[0139] It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions, each used to execute part of the functions of the communication permission control device 600. In other words, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more modules among the communication module 601, the processing module 602, and the storage module 603.

[0140] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network (WAN) or a local area network (LAN), among others. FIG. 10 illustrates a possible implementation. As shown in FIG. 10 , two computing devices 700A and 700B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700A stores instructions for executing the functions of the communication module 601. Simultaneously, the memory 706 in the computing device 700B stores instructions for executing the functions of the processing module 602 and the storage module 603.

[0141] The connection method between the computing device clusters shown in Figure 10 can be considered to be that the communication permission control method 200 provided in this application needs to frequently interact with enterprise managers and end users, so it is considered to entrust the functions implemented by the processing module 602 and the storage module 603 to the computing device 700B for execution.

[0142] It should be understood that the functionality of the computing device 700A shown in FIG10 may also be implemented by multiple computing devices 700. Similarly, the functionality of the computing device 700B may also be implemented by multiple computing devices 700.

[0143] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the communication permission control method 200.

[0144] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the communication permission control method 200.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A communication permission control method in a meeting, characterized in that, The method includes: Obtaining a permission matching rule configured by a management personnel in a conference system, where the permission matching rule includes communication rules between multiple permission types, and the conference system is used to hold a target conference; In response to a request for acquisition from a target user, sending the target permission type corresponding to the target user to the target user, where at least one participant user is also included in the target conference accessed by the target user; Obtaining target media data sent by a target terminal corresponding to the target user, where the media data carries the target permission type; Determining whether to send the target media data to the at least one participant user according to the target permission type, the permission types corresponding to the at least one participant user, and the permission matching rule, where each participant user corresponds to one permission type.

2. The method according to claim 1, characterized in that, The obtaining of the permission matching rule configured by the management personnel includes: Obtaining one or more of the permission types configured by the management personnel and the following permission parameters: Employee number, region, department, IP address, access network type, terminal device type; Recording the corresponding relationship between the permission types and permission parameters configured by the management personnel.

3. The method according to claim 2, wherein The request for acquisition from the target user carries the permission parameters of the target user. The sending the target permission type corresponding to the user to the user in response to the request for acquisition from the target user includes: Based on the permission parameters of the target user, determining the target permission type corresponding to the target user according to the corresponding relationship between the permission types and permission parameters configured by the management personnel; Sending the target permission type corresponding to the target user to the target user.

4. The method according to any one of claims 1 to 3, characterized in that, The media data includes one or more of the following: Audio data, video data, shared data, message data, where the video data indicates data collected by a camera of a participant terminal, and the shared data indicates data of a shared desktop collected by the participant terminal.

5. The method according to any one of claims 1 to 4, characterized in that The at least one participant user includes a first participant user. The method further includes: When it is determined not to send the target media data to the first participant user, sending a first no-permission indication message to the first participant user, where the first no-permission indication message is used to indicate that the first participant user does not have the permission to receive the target media data.

6. The method according to claim 5, wherein The at least one participant user includes a second participant user. The method further includes: When it is determined not to send a part of the target media data to the second participant user, sending a second no-permission indication message and another part of the target media data to the second participant user, where the second no-permission indication message is used to indicate that the second participant user does not have the permission to receive the part of the target media data.

7. The method according to any one of claims 1 to 6, characterized in that, The permission matching rule includes multiple communication rules. The determining whether to send the target media data to the at least one participant user according to the target permission type, the permission types corresponding to the at least one participant user, and the permission matching rule includes: According to the order of the priorities of multiple communication rules in the permission matching rules from high to low, determine whether to send the target media data to the at least one participating user according to the permission matching rules, the target permission type, and the permission types corresponding to the at least one participating user.

8. The method according to any one of claims 1 to 7, characterized in that, The permission types include one or more of the following: High-security-level users, ordinary users, external users. Among them, the high-security-level users and the ordinary users belong to the same enterprise, and the external users do not belong to the enterprise.

9. The method according to any one of claims 1 to 8, characterized in that, Before obtaining the permission matching rules configured by the management personnel, the method further includes: Start the target meeting.

10. The method according to any one of claims 1 to 9, characterized in that, The permission matching rules further include the target topic in the meeting, and the target media data is the media data associated with the target topic.

11. A communication permission control device in a conference, characterized in that, It includes: A communication module, configured to obtain the permission matching rules configured by the management personnel in the meeting system. The permission matching rules include communication rules between multiple permission types, and the meeting system is used to hold a target meeting; In response to a request for acquisition by a target user, send the target permission type corresponding to the target user to the target user. The meeting accessed by the target user further includes at least one participating user; obtain the target media data sent by the target terminal corresponding to the target user, and the media data carries the target permission type; A processing module, configured to determine whether to send the target media data to the at least one participating user according to the target permission type, the permission types corresponding to the at least one participating user, and the permission matching rules, where each participating user corresponds to one permission type.

12. The device according to claim 11, wherein, The communication module is further configured to obtain one or more of the permission types configured by the management personnel and the following permission parameters: employee number, region, department, IP address, access network type, terminal device type; the processing module records the corresponding relationship between the permission types configured by the management personnel and the permission parameters.

13. The device according to claim 12, wherein, The acquisition request of the target user carries the permission parameters of the target user, and the processing module is further configured to determine the target permission type corresponding to the target user based on the permission parameters of the target user according to the corresponding relationship between the permission types configured by the management personnel and the permission parameters. The communication module is further configured to send the target permission type corresponding to the target user to the target user.

14. The device according to any one of claims 11 to 13, characterized in that, The media data includes one or more of the following: audio data, video data, shared data, message data. Among them, the video data indicates the data collected by the camera of the participating terminal, and the shared data indicates the data of the shared desktop collected by the participating terminal.

15. The device according to any one of claims 11 to 14, characterized in that, The at least one participating user includes a first participating user. The processing module is further configured to determine not to send the target media data to the first participating user, and the communication module is further configured to send a first no-permission indication message to the first participating user, and the first no-permission indication message is used to indicate that the first participating user does not have the permission to receive the target media data.

16. The device according to claim 15, characterized in that, The at least one participating user includes a second participating user. The processing module is further configured to determine not to send a part of the target media data to the second participating user. The communication module is further configured to send second unauthorized indication information and another part of the target media data to the second participating user. The second unauthorized indication information is used to indicate that the second participating user does not have the permission to receive the part of the target media data.

17. The device according to any one of claims 11 to 16, characterized in that, The permission matching rule includes multiple communication rules. The processing module is further configured to determine whether to send the target media data to the at least one participating user according to the priority of the multiple communication rules in the permission matching rule from high to low, based on the permission matching rule, the target permission type, and the permission type corresponding to the at least one participating user.

18. The device according to any one of claims 11 to 17, characterized in that The permission type includes one or more of the following: high-security-level user, ordinary user, external user. Among them, the high-security-level user and the ordinary user belong to the same enterprise, and the external user does not belong to the enterprise.

19. The device according to any one of claims 11 to 18, characterized in that The processing module is further configured to start the target meeting before obtaining the permission matching rule configured by the administrator.

20. The device according to any one of claims 11 to 19, characterized in that, The permission matching rule further includes the target topic in the meeting, and the target media data is the media data associated with the target topic.

21. A cluster of computing devices, characterized in that, It includes at least one computing device, and each computing device includes a processor and a memory; The processor of the at least one computing device is configured to execute the instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 9.

22. A computer program product comprising instructions, characterized in that, When the instructions are run by the computer device cluster, the computer device cluster executes the method according to any one of claims 1 to 9.

23. A computer-readable storage medium, characterized in that, It includes computer program instructions. When the computer program instructions are executed by the computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 9.

Images