CN109598117A - Right management method, device, electronic equipment and storage medium - Google Patents

Right management method, device, electronic equipment and storage medium Download PDF

Info

Publication number
CN109598117A
CN109598117A CN201811246877.3A CN201811246877A CN109598117A CN 109598117 A CN109598117 A CN 109598117A CN 201811246877 A CN201811246877 A CN 201811246877A CN 109598117 A CN109598117 A CN 109598117A
Authority
CN
China
Prior art keywords
user
permission
resource
role
authority credentials
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201811246877.3A
Other languages
Chinese (zh)
Inventor
刘锦昌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Priority to CN201811246877.3A priority Critical patent/CN109598117A/en
Publication of CN109598117A publication Critical patent/CN109598117A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45Structures or tools for the administration of authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/10Office automation; Time management
    • G06Q10/103Workflow collaboration or project management

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Human Resources & Organizations (AREA)
  • Strategic Management (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Hardware Design (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Storage Device Security (AREA)

Abstract

The embodiment provides a kind of right management method, device, electronic equipment and storage mediums, are related to field of computer technology.This method comprises: extracting the identification information of the user from the request of the login authentication of user;Identification information based on the user obtains the role identification information of the user from user role contingency table;Role identification information based on the user obtained from role-security contingency table the user permission and authority credentials corresponding with the permission of the user;Permission based on the user obtains the resource that the user is able to access that from permission resource associations table;The operation that the user can execute the resource is determined based on the authority credentials.The technical solution of the embodiment of the present invention can be managed the operating right of user with more refining, and reduce the error rate of rights management.

Description

Right management method, device, electronic equipment and storage medium
Technical field
The present invention relates to field of computer technology, in particular to a kind of right management method, rights management device, Electronic equipment and computer readable storage medium.
Background technique
With the development of internet technology, the operation system of enterprise becomes to become increasingly complex, how to each industry of enterprise The user right system of business system, which is managed, becomes focus of attention.
Currently, the mode of permission control is mostly artificial addition permission, manual operation under each operation system of existing enterprise Very high human cost is not only needed, but also is easy error, it is difficult to the permission of the service resources of operation system be carried out finer Management.
It should be noted that information is only used for reinforcing the reason to background of the present invention disclosed in above-mentioned background technology part Solution, therefore may include the information not constituted to the prior art known to persons of ordinary skill in the art.
Summary of the invention
The embodiment of the present invention be designed to provide a kind of right management method, rights management device, electronic equipment and Computer readable storage medium, and then overcome one caused by the limitation and defect due to the relevant technologies at least to a certain extent A or multiple problems.
According to a first aspect of the embodiments of the present invention, a kind of right management method is provided, comprising: test from the login of user The identification information of the user is extracted in card request;Identification information based on the user obtains institute from user role contingency table State the role identification information of user;Role identification information based on the user obtains the user from role-security contingency table Permission and authority credentials corresponding with the permission of the user;Permission based on the user is obtained from permission resource associations table The resource for taking the user to be able to access that;The operation that the user can execute the resource is determined based on the authority credentials.
In some exemplary embodiments of the invention, aforementioned schemes are based on, the user is determined based on the authority credentials The operation that the resource can be executed, comprising: be added authority credentials corresponding with all kinds of permissions of the user, described in determination Total authority credentials of user;Determine that the user can be to the operation of resource execution based on total authority credentials of the user.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the right management method further include: connecing When receiving operational order of the user to the resource, the user total authority credentials corresponding with the resource is obtained;By institute The total authority credentials permission threshold value corresponding with the operational order for stating user is compared;If total authority credentials of the user is greater than Equal to the permission threshold value, then determine that the user is able to carry out the operational order.
In some exemplary embodiments of the invention, aforementioned schemes are based on, the permission based on the user is provided from permission The resource that the user is able to access that is obtained in the contingency table of source, comprising: obtain from permission resource table according to the capability identification of user The resource for taking the user to be able to access that, the resource include the service profile and business interface of operation system.
In some exemplary embodiments of the invention, aforementioned schemes are based on, the user role contingency table includes user Identification field, role identification field include role identification field, capability identification field and right in role-security management table The permission value field answered.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the right management method further include: connecing When receiving the login authentication request of the user of client transmission, the account of the user is extracted from login authentication request Family information;The receiving time of account information and login authentication request based on the user generates dynamic password;To institute It states client and returns to the dynamic password.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the right management method further include: pass through Unified account management system verifies the login authentication request of the user.
According to a second aspect of the embodiments of the present invention, a kind of rights management device is provided, comprising: information extraction unit is used In the identification information for extracting the user from the request of the login authentication of user;Role Information acquiring unit, for based on described The identification information of user obtains the role identification information of the user from user role contingency table;Authority information acquiring unit, For the role identification information based on the user obtained from role-security contingency table the user permission and with it is described The corresponding authority credentials of the permission of user;Resource acquisition unit, for the permission based on the user from permission resource associations table Obtain the resource that the user is able to access that;Operation determination unit, for determining that the user can be right based on the authority credentials The operation that the resource executes.
According to a third aspect of the embodiments of the present invention, a kind of electronic equipment is provided, comprising: processor;And memory, institute It states and is stored with computer-readable instruction on memory, realize when the computer-readable instruction is executed by the processor as above-mentioned Right management method described in first aspect.
According to a fourth aspect of the embodiments of the present invention, a kind of computer readable storage medium is provided, calculating is stored thereon with Machine program realizes the right management method as described in above-mentioned first aspect when the computer program is executed by processor.
In the technical solution provided by some embodiments of the present invention, on the one hand, based on the identification information of user from The role identification information of user is obtained in the role association table of family, the role identification information based on user is from role-security contingency table The permission of acquisition user and corresponding authority credentials, can accurately obtain the authority information of user;On the other hand, according to the power of user It limits and obtains the resource that user is able to access that from permission resource associations table, determine what user can execute resource based on authority credentials Operation, can be managed the operating right of user with more refining, and reduce the error rate of rights management, and permission maintenance is more square Just.
It should be understood that above general description and following detailed description be only it is exemplary and explanatory, not It can the limitation present invention.
Detailed description of the invention
The drawings herein are incorporated into the specification and forms part of this specification, and shows and meets implementation of the invention Example, and be used to explain the principle of the present invention together with specification.It should be evident that the accompanying drawings in the following description is only the present invention Some embodiments for those of ordinary skill in the art without creative efforts, can also basis These attached drawings obtain other attached drawings.In the accompanying drawings:
Fig. 1 shows the flow diagram of right management method according to some embodiments of the present invention;
Fig. 2 shows determine that user can be to the operation of resource execution based on authority credentials according to some embodiments of the present invention Flow diagram;
Fig. 3 shows the flow diagram of login authentication process according to some embodiments of the present invention;
Fig. 4 shows the schematic block diagram of the rights management device of an exemplary embodiment according to the present invention;
Fig. 5 shows the structural schematic diagram for being suitable for the computer system for the electronic equipment for being used to realize the embodiment of the present invention.
Specific embodiment
Example embodiment is described more fully with reference to the drawings.However, example embodiment can be real in a variety of forms It applies, and is not understood as limited to embodiment set forth herein;On the contrary, thesing embodiments are provided so that the present invention will be comprehensively and complete It is whole, and the design of example embodiment is comprehensively communicated to those skilled in the art.Identical appended drawing reference indicates in figure Same or similar part, thus repetition thereof will be omitted.
In addition, described feature, structure or characteristic can be incorporated in one or more implementations in any suitable manner In example.In the following description, many details are provided to provide and fully understand to the embodiment of the present invention.However, It will be appreciated by persons skilled in the art that technical solution of the present invention can be practiced without one or more in specific detail, Or it can be using other methods, constituent element, device, step etc..In other cases, it is not shown in detail or describes known side Method, device, realization or operation are to avoid fuzzy each aspect of the present invention.
Block diagram shown in the drawings is only functional entity, not necessarily must be corresponding with physically separate entity. I.e., it is possible to realize these functional entitys using software form, or realized in one or more hardware modules or integrated circuit These functional entitys, or these functional entitys are realized in heterogeneous networks and/or processor device and/or microcontroller device.
Flow chart shown in the drawings is merely illustrative, it is not necessary to including all content and operation/step, It is not required to execute by described sequence.For example, some operation/steps can also decompose, and some operation/steps can close And or part merge, therefore the sequence actually executed is possible to change according to the actual situation.
Fig. 1 shows the flow diagram of right management method according to some embodiments of the present invention.The rights management Method can be applied to the server of operation system, which may include multiple business submodules, such as insurance business Submodule, healthy business submodule, finance services submodule.
Shown in referring to Fig.1, in step s 110, the mark letter of the user is extracted from the request of the login authentication of user Breath.
In the exemplary embodiment, user operation system login interface input log-on message and click log in control it Afterwards, client used by a user sends login authentication request to the server of operation system.The server of operation system receives When the login authentication sent to client is requested, the hand of the identification information such as user of user is extracted from Sign-On authentication request Machine number or identification card number information.
In the step s 120, the identification information based on the user obtains the angle of the user from user role contingency table Color identification information.
In the exemplary embodiment, user role contingency table, that is, user _ role's table includes: user identifier i.e. User ID, role Identified role ID, wherein role ID is compound primary key, and User ID is the major key in user message table, and role ID is Role Information table Major key.Identification information, that is, User ID based on user inquires corresponding role ID from user role contingency table.The following table 1 is shown User role contingency table in example embodiment.
1. user role contingency table of table
User ID Role ID
string string
It can be one-to-one or one-to-many relationship between user and role.One user can have multiple role's examples Such as, the role of user can be the roles such as administrator, Project Manager, template development personnel, ordinary user.It logs in and tests in user After card passes through, the corresponding Role Information of user is obtained from user role contingency table based on the identification information of user.
In step s 130, the role identification information based on the user obtains the user from role-security contingency table Permission and authority credentials corresponding with the permission of the user.
In the exemplary embodiment, role-security contingency table, that is, role _ authority list may include: role ID, capability identification, with The corresponding authority credentials of permission, role can be the set of a certain number of permissions, and such as operating right addition of each permission is deleted Remove, modify, checking that operation is designed with an authority credentials, for example, check the authority credentials of permission be 1, to add the authority credentials of permission be 2, The authority credentials of modification authority is 4, the authority credentials of deletion permission is 8.Role ID based on user is obtained from role-security contingency table Take family permission and authority credentials corresponding with permission.The following table 2 shows the role-security contingency table in example embodiment.
2. role-security contingency table of table
Role ID Permission ID Authority credentials
string string int
In step S140, the permission based on the user obtains the user from permission resource associations table and is able to access that Resource.
In the exemplary embodiment, permission resource associations table (permissions_resources) may include: permission ID, Resource ID, can obtain the resource that user is able to access that according to the permission ID of user from permission resource associations table, and resource can be with For contents such as the service profile of operation system or business interfaces.After user login validation passes through, obtained according to the mark of user The Role Information for taking family obtains the authority information and authority credentials of user according to the Role Information of user, according to the power of user Limit information obtains the resource that user is able to access that.The following table 3 shows the permission resource associations table in example embodiment.
3. permission resource associations table of table
Permission ID Resource ID
string string
In step S150, the operation that the user can execute the resource is determined based on the authority credentials.
In the exemplary embodiment, for each resource, the operating right of user is added, delete, modify, checks operation It is designed with an authority credentials, such as checks that the authority credentials of permission is 1, the authority credentials of addition permission is 2, the authority credentials of modification authority Authority credentials for 4, deletion permission is 8.Authority credentials corresponding with the permission of user is added, determines total authority credentials of user, base The operation that user can execute resource is determined in total authority credentials of user.Such as the authority credentials of " edition owner " role is 15, " version The permission that master " role has addition model to the corresponding resource of its plate, deletes model, modifies model, checks model;Common meeting The authority credentials of member is 3, the permission that regular member has addition model, checks model.
According to the right management method in the example embodiment of Fig. 1, on the one hand, based on the identification information of user from user angle The role identification information of user is obtained in color contingency table, the role identification information based on user is obtained from role-security contingency table The permission of user and corresponding authority credentials can accurately obtain the authority information of user;On the other hand, according to the permission of user from The resource that user is able to access that is obtained in permission resource associations table, and the behaviour that user can execute resource is determined based on authority credentials Make, the operating right of user can be managed with more refining, reduce the error rate of rights management, permission maintenance is more square Just.
Further, in the exemplary embodiment, it is asked by login authentication of the unified account management system to the user It asks and is verified.Unified user management system includes user management module and authority management module, and user management module is used for The user information of all background application systems is uniformly stored and handled, such as identifies different use by globally unique User ID Family;Authority management module is used to provide empowerment management service to user and background application system, provides user, after user role arrives The mapping function of platform application system permission.Whether authority management module is stored with has the power for accessing some background application system The user role of limit and the user permissions such as example upload, download, delete in the operating right of background application system.
Fig. 2 shows determine that user can be to the operation of resource execution based on authority credentials according to some embodiments of the present invention Flow diagram.
Referring to shown in Fig. 2, in step S210, when receiving operational order of the user to the resource, obtain The user total authority credentials corresponding with the resource.
In the exemplary embodiment, user has different permission and authority credentials, each operating right to every kind of resource Such as it adds, delete, modifying, checking that operation is designed with an authority credentials, such as checking that the authority credentials of permission is 1, adds permission Authority credentials be 2, the authority credentials of modification authority is 4, deletes the authority credentials of permission is 8.A certain resource is deleted in user When operation, total authority credentials of user corresponding with the resource is obtained, for example, if user, which has the resource, checks permission and addition Permission, then total authority credentials is 3, checks, adds, deleting permission if user has the resource, total authority credentials is 15.
In step S220, total authority credentials of user permission threshold value corresponding with the operational order is compared Compared with.
In the exemplary embodiment, when user executes delete operation to resource such as some file, user and the money are obtained The permission threshold value such as 15 of total authority credentials of user and delete operation is compared by the corresponding total authority credentials in source, based on comparing As a result determine whether user is able to carry out delete operation.
In step S230, if total authority credentials of the user is more than or equal to the permission threshold value, the user is determined It is able to carry out the operational order.
In the exemplary embodiment, if the authority credentials of user is greater than the permission threshold value such as 15 of delete operation, determine user It is able to carry out the delete operation.Such as the power that " edition owner " role has addition model, deletes model, modifies model, checking model Limit, the weighted value of edition owner role are 15, and edition owner can be able to carry out the delete operation, and regular member has addition model, checks The permission of model is weighed, and the authority credentials of regular member is 3, and regular member cannot execute the delete operation.
Fig. 3 shows the flow diagram of login authentication process according to some embodiments of the present invention.
Referring to shown in Fig. 3, in step s310, in the login authentication request for receiving the user of client transmission When, the account information of the user is extracted from login authentication request;
In the exemplary embodiment, it when server receives the login authentication request of client transmission, is asked from Sign-On authentication The cell-phone number or identification card number information of the middle account information such as user for extracting user are asked,
In step s 320, the receiving time of account information and login authentication request based on the user generates Dynamic password.
In the exemplary embodiment, TOTP can be passed through based on the receiving time of the account information of user and the certification request The mode of (Time-Based One-Time Password, time-based disposal password algorithm) generates dynamic password.? Dynamic password can be generated using other hash algorithms based on the receiving time of the account information of user and the certification request. TOTP is a time-based disposal password algorithm (the also referred to as dynamic password of time synchronization), is to support the time as dynamic Extension of the factor based on HMAC disposal password algorithm.
In step S330, Xiang Suoshu client returns to the dynamic password.
In the exemplary embodiment, the dynamic password of generation is back to client, such as returns to identifying code to client, used Family carries out login authentication according to the identifying code.
In some embodiments, it is also possible to raw based on the receiving time that the account information of user and the login authentication are requested The public key is stored in certificate server by public key and private key in a pair, is sent to using the private key as dynamic password The client of user.In addition, in an embodiment of the present invention, additionally providing a kind of rights management device.It, should referring to shown in Fig. 4 Rights management device 400 may include information extraction unit 410, Role Information acquiring unit 420, authority information acquiring unit 430, resource acquisition unit 440 and operation determination unit 450.Wherein, information extraction unit 410 from the login of user for testing The identification information of the user is extracted in card request;Role Information acquiring unit 420 is used for the identification information based on the user The role identification information of the user is obtained from user role contingency table;Authority information acquiring unit 430 is used for based on described The role identification information of user obtains the permission of the user and the permission pair with the user from role-security contingency table The authority credentials answered;Resource acquisition unit 440 obtains the use from permission resource associations table for the permission based on the user The resource that family is able to access that;Operation determination unit 450 is used to determine that the user can be to the resource based on the authority credentials The operation of execution.
In some exemplary embodiments of the invention, aforementioned schemes are based on, operation determination unit 450 includes: total permission Authority credentials corresponding with all kinds of permissions of the user is added, determines total authority credentials of the user by determination unit;It determines single Member determines the operation that the user can execute the resource for total authority credentials based on the user.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the rights management device 400 further include: Total authority credentials acquiring unit, for obtaining the user and institute when receiving operational order of the user to the resource State the corresponding total authority credentials of resource;Comparing unit, for by total authority credentials of user power corresponding with the operational order Limit threshold value is compared;Execution unit determines institute if total authority credentials for the user is more than or equal to the permission threshold value It states user and is able to carry out the operational order.
In some exemplary embodiments of the invention, aforementioned schemes are based on, resource acquisition unit 440 is configured as: root The resource that the user is able to access that is obtained from permission resource table according to the capability identification of user, the resource includes operation system Service profile and business interface.
In some exemplary embodiments of the invention, aforementioned schemes are based on, the user role contingency table includes user Identification field, role identification field include role identification field, capability identification field and right in role-security management table The permission value field answered.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the rights management device 400 further include: Account information extraction unit, when for being requested in the login authentication for receiving the user that client is sent, from the login The account information of the user is extracted in checking request;Password generated unit, for based on the user account information and The receiving time of the login authentication request generates dynamic password;Return unit, for returning to the dynamic to the client Password.
In some exemplary embodiments of the invention, it is based on aforementioned schemes, the rights management device 400 further include: Unified authentication unit, for being verified by unified account management system to the login authentication request of the user.
Each functional module and above-mentioned rights management side due to the rights management device 400 of example embodiments of the present invention The step of example embodiment of method, is corresponding, therefore details are not described herein.
In an exemplary embodiment of the present invention, a kind of electronic equipment that can be realized the above method is additionally provided.
Below with reference to Fig. 5, it illustrates the computer systems 500 for the electronic equipment for being suitable for being used to realize the embodiment of the present invention Structural schematic diagram.The computer system 500 of electronic equipment shown in Fig. 5 is only an example, should not be to the embodiment of the present invention Function and use scope bring any restrictions.
As shown in figure 5, computer system 500 includes central processing unit (CPU) 501, it can be read-only according to being stored in Program in memory (ROM) 502 or be loaded into the program in random access storage device (RAM) 503 from storage section 508 and Execute various movements appropriate and processing.In RAM 503, it is also stored with various programs and data needed for system operatio.CPU 501, ROM 502 and RAM 503 is connected with each other by bus 504.Input/output (I/O) interface 505 is also connected to bus 504。
I/O interface 505 is connected to lower component: the importation 506 including keyboard, mouse etc.;It is penetrated including such as cathode The output par, c 507 of spool (CRT), liquid crystal display (LCD) etc. and loudspeaker etc.;Storage section 508 including hard disk etc.; And the communications portion 509 of the network interface card including LAN card, modem etc..Communications portion 509 via such as because The network of spy's net executes communication process.Driver 510 is also connected to I/O interface 505 as needed.Detachable media 511, such as Disk, CD, magneto-optic disk, semiconductor memory etc. are mounted on as needed on driver 510, in order to read from thereon Computer program be mounted into storage section 508 as needed.
Particularly, according to an embodiment of the invention, may be implemented as computer above with reference to the process of flow chart description Software program.For example, the embodiment of the present invention includes a kind of computer program product comprising be carried on computer-readable medium On computer program, which includes the program code for method shown in execution flow chart.In such reality It applies in example, which can be downloaded and installed from network by communications portion 509, and/or from detachable media 511 are mounted.When the computer program is executed by central processing unit (CPU) 501, executes and limited in the system of the application Above-mentioned function.
It should be noted that computer-readable medium shown in the present invention can be computer-readable signal media or meter Calculation machine readable storage medium storing program for executing either the two any combination.Computer readable storage medium for example can be --- but not Be limited to --- electricity, magnetic, optical, electromagnetic, infrared ray or semiconductor system, device or device, or any above combination.Meter The more specific example of calculation machine readable storage medium storing program for executing can include but is not limited to: have the electrical connection, just of one or more conducting wires Taking formula computer disk, hard disk, random access storage device (RAM), read-only memory (ROM), erasable type may be programmed read-only storage Device (EPROM or flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), light storage device, magnetic memory device, Or above-mentioned any appropriate combination.In the present invention, computer readable storage medium can be it is any include or storage journey The tangible medium of sequence, the program can be commanded execution system, device or device use or in connection.And at this In invention, computer-readable signal media may include in a base band or as carrier wave a part propagate data-signal, Wherein carry computer-readable program code.The data-signal of this propagation can take various forms, including but unlimited In electromagnetic signal, optical signal or above-mentioned any appropriate combination.Computer-readable signal media can also be that computer can Any computer-readable medium other than storage medium is read, which can send, propagates or transmit and be used for By the use of instruction execution system, device or device or program in connection.Include on computer-readable medium Program code can transmit with any suitable medium, including but not limited to: wireless, electric wire, optical cable, RF etc. are above-mentioned Any appropriate combination.
Flow chart and block diagram in attached drawing are illustrated according to the system of various embodiments of the invention, method and computer journey The architecture, function and operation in the cards of sequence product.In this regard, each box in flowchart or block diagram can generation A part of one module, program segment or code of table, a part of above-mentioned module, program segment or code include one or more Executable instruction for implementing the specified logical function.It should also be noted that in some implementations as replacements, institute in box The function of mark can also occur in a different order than that indicated in the drawings.For example, two boxes succeedingly indicated are practical On can be basically executed in parallel, they can also be executed in the opposite order sometimes, and this depends on the function involved.Also it wants It is noted that the combination of each box in block diagram or flow chart and the box in block diagram or flow chart, can use and execute rule The dedicated hardware based systems of fixed functions or operations is realized, or can use the group of specialized hardware and computer instruction It closes to realize.
Being described in unit involved in the embodiment of the present invention can be realized by way of software, can also be by hard The mode of part realizes that described unit also can be set in the processor.Wherein, the title of these units is in certain situation Under do not constitute restriction to the unit itself.
As on the other hand, present invention also provides a kind of computer-readable medium, which be can be Included in electronic equipment described in above-described embodiment;It is also possible to individualism, and without in the supplying electronic equipment. Above-mentioned computer-readable medium carries one or more program, when the electronics is set by one for said one or multiple programs When standby execution, so that the electronic equipment realizes such as above-mentioned right management method as described in the examples.
For example, the electronic equipment may be implemented as shown in Figure 1: step S110 is requested from the login authentication of user The middle identification information for extracting the user;Step S120, the identification information based on the user are obtained from user role contingency table Take the role identification information of the user;Step S130, based on the role identification information of the user from role-security contingency table The middle permission for obtaining the user and authority credentials corresponding with the permission of the user;Step S140, based on the user's Permission obtains the resource that the user is able to access that from permission resource associations table;Step S150 is determined based on the authority credentials The operation that the user can execute the resource.
It should be noted that although being referred to several modules for acting the device executed in the above detailed description Or unit, but this division is not enforceable.In fact, embodiment according to the present invention, above-described two Or more the feature and function of module or unit can be embodied in a module or unit.Conversely, above-described One module or the feature and function of unit can be to be embodied by multiple modules or unit with further division.
Through the above description of the embodiments, those skilled in the art is it can be readily appreciated that example described herein is implemented Mode can also be realized by software realization in such a way that software is in conjunction with necessary hardware.Therefore, according to the present invention The technical solution of embodiment can be embodied in the form of software products, which can store non-volatile at one Property storage medium (can be CD-ROM, USB flash disk, mobile hard disk etc.) in or network on, including some instructions are so that a calculating Equipment (can be personal computer, server, touch control terminal or network equipment etc.) executes embodiment according to the present invention Method.
Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to of the invention its Its embodiment.This application is intended to cover any variations, uses, or adaptations of the invention, these modifications, purposes or Person's adaptive change follows general principle of the invention and including the undocumented common knowledge in the art of the present invention Or conventional techniques.The description and examples are only to be considered as illustrative, and true scope and spirit of the invention are by following Claim is pointed out.
It should be understood that the present invention is not limited to the precise structure already described above and shown in the accompanying drawings, and And various modifications and changes may be made without departing from the scope thereof.The scope of the present invention is limited only by the attached claims.

Claims (10)

1. a kind of right management method characterized by comprising
The identification information of the user is extracted from the request of the login authentication of user;
Identification information based on the user obtains the role identification information of the user from user role contingency table;
Role identification information based on the user obtained from role-security contingency table the user permission and with it is described The corresponding authority credentials of the permission of user;
Permission based on the user obtains the resource that the user is able to access that from permission resource associations table;
The operation that the user can execute the resource is determined based on the authority credentials.
2. right management method according to claim 1, which is characterized in that determine user's energy based on the authority credentials Enough operations that the resource is executed, comprising:
Authority credentials corresponding with all kinds of permissions of the user is added, determines total authority credentials of the user;
Determine that the user can be to the operation of resource execution based on total authority credentials of the user.
3. right management method according to claim 2, which is characterized in that the right management method further include:
When receiving operational order of the user to the resource, the user total permission corresponding with the resource is obtained Value;
Total authority credentials of user permission threshold value corresponding with the operational order is compared;
If total authority credentials of the user is more than or equal to the permission threshold value, determine that the user is able to carry out the operation and refers to It enables.
4. right management method according to claim 1, which is characterized in that the permission based on the user is from permission resource The resource that the user is able to access that is obtained in contingency table, comprising:
The resource that the user is able to access that is obtained from permission resource table according to the capability identification of user, the resource includes industry The service profile and business interface of business system.
5. right management method according to any one of claim 1 to 4, which is characterized in that the user role association Table includes user identification field, role identification field, includes role identification field, capability identification in the role-security management table Field and corresponding permission value field.
6. right management method according to claim 1, which is characterized in that the right management method further include:
In the login authentication request for receiving the user of client transmission, from login authentication request described in extraction The account information of user;
The receiving time of account information and login authentication request based on the user generates dynamic password;
The dynamic password is returned to the client.
7. right management method according to claim 6, which is characterized in that account information and institute based on the user The receiving time for stating login authentication request generates dynamic password, comprising:
The receiving time of account information and login authentication request based on the user generates a pair of of public key and private key, will The private key is as the dynamic password.
8. a kind of rights management device characterized by comprising
Information extraction unit, for extracting the identification information of the user from the request of the login authentication of user;
Role Information acquiring unit obtains the user for the identification information based on the user from user role contingency table Role identification information;
Authority information acquiring unit, obtained from role-security contingency table for the role identification information based on the user described in The permission of user and authority credentials corresponding with the permission of the user;
Resource acquisition unit obtains the user from permission resource associations table for the permission based on the user and is able to access that Resource;
Operation determination unit, for determining that the user can be to the operation of resource execution based on the authority credentials.
9. a kind of electronic equipment characterized by comprising
Processor;And
Memory is stored with computer-readable instruction on the memory, and the computer-readable instruction is held by the processor The right management method as described in any one of claims 1 to 7 is realized when row.
10. a kind of computer readable storage medium, is stored thereon with computer program, the computer program is executed by processor Right management method of the Shi Shixian as described in any one of claims 1 to 7.
CN201811246877.3A 2018-10-24 2018-10-24 Right management method, device, electronic equipment and storage medium Pending CN109598117A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811246877.3A CN109598117A (en) 2018-10-24 2018-10-24 Right management method, device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811246877.3A CN109598117A (en) 2018-10-24 2018-10-24 Right management method, device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN109598117A true CN109598117A (en) 2019-04-09

Family

ID=65958145

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811246877.3A Pending CN109598117A (en) 2018-10-24 2018-10-24 Right management method, device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN109598117A (en)

Cited By (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110119488A (en) * 2019-04-12 2019-08-13 平安普惠企业管理有限公司 The control method and device that the page is shown
CN110516176A (en) * 2019-08-30 2019-11-29 北京东软望海科技有限公司 Processing method, device, electronic equipment and the readable storage medium storing program for executing of user's request
CN110516452A (en) * 2019-08-07 2019-11-29 浙江大搜车软件技术有限公司 RBAC access authorization for resource distribution method, device, electronic equipment and storage medium
CN110908735A (en) * 2019-11-19 2020-03-24 北京字节跳动网络技术有限公司 Automatic application program label loading and changing method and device and electronic equipment
CN111046354A (en) * 2019-11-05 2020-04-21 京东数字科技控股有限公司 Access and client access management method, system and medium
CN111062028A (en) * 2019-12-13 2020-04-24 腾讯科技(深圳)有限公司 Authority management method and device, storage medium and electronic equipment
CN111079126A (en) * 2019-11-11 2020-04-28 重庆首厚智能科技研究院有限公司 User authority management system based on hash algorithm
CN111131205A (en) * 2019-12-10 2020-05-08 上海众言网络科技有限公司 Authority management method and device based on Restful interface
CN111191221A (en) * 2019-12-30 2020-05-22 腾讯科技(深圳)有限公司 Method and device for configuring authority resources and computer readable storage medium
CN111222162A (en) * 2019-12-31 2020-06-02 中国铁道科学研究院集团有限公司电子计算技术研究所 Industry cloud resource access control method and device
CN111343172A (en) * 2020-02-20 2020-06-26 中国建设银行股份有限公司 Network access authority dynamic processing method and device
CN111343173A (en) * 2020-02-21 2020-06-26 腾讯云计算(北京)有限责任公司 Data access abnormity monitoring method and device
CN111353134A (en) * 2020-03-31 2020-06-30 中国建设银行股份有限公司 Authority management method and system
CN111428252A (en) * 2020-03-20 2020-07-17 郑州阿帕斯数云信息科技有限公司 User authority control method and device
CN111581633A (en) * 2020-03-31 2020-08-25 浪潮通用软件有限公司 Function authority control method, device and medium based on cloud computing
CN111641627A (en) * 2020-05-26 2020-09-08 深圳壹账通智能科技有限公司 User role authority management method and device, computer equipment and storage medium
CN111984949A (en) * 2020-08-24 2020-11-24 北京达佳互联信息技术有限公司 Authentication method, authentication device, electronic equipment and storage medium
CN112100585A (en) * 2020-08-19 2020-12-18 北京小米移动软件有限公司 Authority management method, device and storage medium
CN112449145A (en) * 2019-08-28 2021-03-05 杭州海康威视数字技术股份有限公司 Camera authority management method and device
CN112528249A (en) * 2020-12-18 2021-03-19 杭州立思辰安科科技有限公司 Authority management method and device suitable for network security management platform
CN112583877A (en) * 2019-09-30 2021-03-30 北京国双科技有限公司 Resource information processing method and device, storage medium and electronic equipment
CN112685730A (en) * 2021-03-18 2021-04-20 北京全息智信科技有限公司 Authority control method and device of operating system account and electronic equipment
CN112765589A (en) * 2019-11-01 2021-05-07 北京京东尚科信息技术有限公司 Permission relation visualization method and device in containerized application management cluster
CN113065122A (en) * 2021-04-01 2021-07-02 山东浪潮通软信息科技有限公司 Temporary authority management method, device and computer readable medium
CN113094332A (en) * 2021-04-23 2021-07-09 北京天空卫士网络安全技术有限公司 File management method and device
CN113222740A (en) * 2021-05-27 2021-08-06 中国工商银行股份有限公司 Asset management method, apparatus, computing device and medium executed by computing device
CN113392382A (en) * 2021-05-21 2021-09-14 乐刷科技有限公司 Data management method, electronic device and readable storage medium
CN113536255A (en) * 2021-07-27 2021-10-22 工银科技有限公司 Data processing method, device, equipment, storage medium and program product
CN113806724A (en) * 2021-09-29 2021-12-17 杭州迪普科技股份有限公司 Method and device for processing user login request
CN113947329A (en) * 2021-10-29 2022-01-18 中国建设银行股份有限公司 Merchant management method, device, equipment, medium and program product
CN114697074A (en) * 2022-02-23 2022-07-01 深圳爱捷云科技有限公司 Authority verification method, electronic device and storage medium
CN116821879A (en) * 2023-08-31 2023-09-29 四川集鲜数智供应链科技有限公司 Visual system role management system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103078859A (en) * 2012-12-31 2013-05-01 普天新能源有限责任公司 Service system authority management method, equipment and system
CN106682487A (en) * 2016-11-04 2017-05-17 浙江蘑菇加电子商务有限公司 User authority management method and system
CN106878325A (en) * 2017-03-20 2017-06-20 北京润科通用技术有限公司 A kind of method and device for determining access privilege
CN107844698A (en) * 2017-09-30 2018-03-27 平安科技(深圳)有限公司 Financial APP authority setting method, device, equipment and storage medium
CN108664811A (en) * 2018-05-11 2018-10-16 北京汉能光伏投资有限公司 A kind of right management method and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103078859A (en) * 2012-12-31 2013-05-01 普天新能源有限责任公司 Service system authority management method, equipment and system
CN106682487A (en) * 2016-11-04 2017-05-17 浙江蘑菇加电子商务有限公司 User authority management method and system
CN106878325A (en) * 2017-03-20 2017-06-20 北京润科通用技术有限公司 A kind of method and device for determining access privilege
CN107844698A (en) * 2017-09-30 2018-03-27 平安科技(深圳)有限公司 Financial APP authority setting method, device, equipment and storage medium
CN108664811A (en) * 2018-05-11 2018-10-16 北京汉能光伏投资有限公司 A kind of right management method and device

Cited By (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110119488A (en) * 2019-04-12 2019-08-13 平安普惠企业管理有限公司 The control method and device that the page is shown
CN110516452A (en) * 2019-08-07 2019-11-29 浙江大搜车软件技术有限公司 RBAC access authorization for resource distribution method, device, electronic equipment and storage medium
CN112449145A (en) * 2019-08-28 2021-03-05 杭州海康威视数字技术股份有限公司 Camera authority management method and device
CN112449145B (en) * 2019-08-28 2022-08-16 杭州海康威视数字技术股份有限公司 Camera authority management method and device
CN110516176A (en) * 2019-08-30 2019-11-29 北京东软望海科技有限公司 Processing method, device, electronic equipment and the readable storage medium storing program for executing of user's request
CN112583877B (en) * 2019-09-30 2022-11-22 北京国双科技有限公司 Resource information processing method and device, storage medium and electronic equipment
CN112583877A (en) * 2019-09-30 2021-03-30 北京国双科技有限公司 Resource information processing method and device, storage medium and electronic equipment
CN112765589A (en) * 2019-11-01 2021-05-07 北京京东尚科信息技术有限公司 Permission relation visualization method and device in containerized application management cluster
CN111046354A (en) * 2019-11-05 2020-04-21 京东数字科技控股有限公司 Access and client access management method, system and medium
CN111079126A (en) * 2019-11-11 2020-04-28 重庆首厚智能科技研究院有限公司 User authority management system based on hash algorithm
CN110908735A (en) * 2019-11-19 2020-03-24 北京字节跳动网络技术有限公司 Automatic application program label loading and changing method and device and electronic equipment
CN111131205A (en) * 2019-12-10 2020-05-08 上海众言网络科技有限公司 Authority management method and device based on Restful interface
CN111062028B (en) * 2019-12-13 2023-11-24 腾讯科技(深圳)有限公司 Authority management method and device, storage medium and electronic equipment
CN111062028A (en) * 2019-12-13 2020-04-24 腾讯科技(深圳)有限公司 Authority management method and device, storage medium and electronic equipment
CN111191221B (en) * 2019-12-30 2023-05-12 腾讯科技(深圳)有限公司 Configuration method and device of authority resources and computer readable storage medium
CN111191221A (en) * 2019-12-30 2020-05-22 腾讯科技(深圳)有限公司 Method and device for configuring authority resources and computer readable storage medium
CN111222162B (en) * 2019-12-31 2022-07-12 中国铁道科学研究院集团有限公司电子计算技术研究所 Industry cloud resource access control method and device
CN111222162A (en) * 2019-12-31 2020-06-02 中国铁道科学研究院集团有限公司电子计算技术研究所 Industry cloud resource access control method and device
CN111343172A (en) * 2020-02-20 2020-06-26 中国建设银行股份有限公司 Network access authority dynamic processing method and device
CN111343173A (en) * 2020-02-21 2020-06-26 腾讯云计算(北京)有限责任公司 Data access abnormity monitoring method and device
CN111343173B (en) * 2020-02-21 2022-08-26 腾讯云计算(北京)有限责任公司 Data access abnormity monitoring method and device
CN111428252A (en) * 2020-03-20 2020-07-17 郑州阿帕斯数云信息科技有限公司 User authority control method and device
CN111428252B (en) * 2020-03-20 2023-03-21 郑州阿帕斯数云信息科技有限公司 User authority control method and device
CN111353134B (en) * 2020-03-31 2022-04-05 中国建设银行股份有限公司 Authority management method and system
CN111581633A (en) * 2020-03-31 2020-08-25 浪潮通用软件有限公司 Function authority control method, device and medium based on cloud computing
CN111353134A (en) * 2020-03-31 2020-06-30 中国建设银行股份有限公司 Authority management method and system
CN111641627A (en) * 2020-05-26 2020-09-08 深圳壹账通智能科技有限公司 User role authority management method and device, computer equipment and storage medium
CN112100585A (en) * 2020-08-19 2020-12-18 北京小米移动软件有限公司 Authority management method, device and storage medium
CN111984949A (en) * 2020-08-24 2020-11-24 北京达佳互联信息技术有限公司 Authentication method, authentication device, electronic equipment and storage medium
CN111984949B (en) * 2020-08-24 2023-11-28 北京达佳互联信息技术有限公司 Authentication method, device, electronic equipment and storage medium
CN112528249A (en) * 2020-12-18 2021-03-19 杭州立思辰安科科技有限公司 Authority management method and device suitable for network security management platform
CN112685730B (en) * 2021-03-18 2021-06-22 北京全息智信科技有限公司 Authority control method and device of operating system account and electronic equipment
CN112685730A (en) * 2021-03-18 2021-04-20 北京全息智信科技有限公司 Authority control method and device of operating system account and electronic equipment
CN113065122A (en) * 2021-04-01 2021-07-02 山东浪潮通软信息科技有限公司 Temporary authority management method, device and computer readable medium
CN113094332A (en) * 2021-04-23 2021-07-09 北京天空卫士网络安全技术有限公司 File management method and device
CN113392382B (en) * 2021-05-21 2023-10-20 乐刷科技有限公司 Data management method, electronic device and readable storage medium
CN113392382A (en) * 2021-05-21 2021-09-14 乐刷科技有限公司 Data management method, electronic device and readable storage medium
CN113222740A (en) * 2021-05-27 2021-08-06 中国工商银行股份有限公司 Asset management method, apparatus, computing device and medium executed by computing device
CN113536255A (en) * 2021-07-27 2021-10-22 工银科技有限公司 Data processing method, device, equipment, storage medium and program product
CN113806724A (en) * 2021-09-29 2021-12-17 杭州迪普科技股份有限公司 Method and device for processing user login request
CN113806724B (en) * 2021-09-29 2024-02-09 杭州迪普科技股份有限公司 User login request processing method and device
CN113947329A (en) * 2021-10-29 2022-01-18 中国建设银行股份有限公司 Merchant management method, device, equipment, medium and program product
CN114697074A (en) * 2022-02-23 2022-07-01 深圳爱捷云科技有限公司 Authority verification method, electronic device and storage medium
CN116821879A (en) * 2023-08-31 2023-09-29 四川集鲜数智供应链科技有限公司 Visual system role management system
CN116821879B (en) * 2023-08-31 2023-11-07 四川集鲜数智供应链科技有限公司 Visual system role management system

Similar Documents

Publication Publication Date Title
CN109598117A (en) Right management method, device, electronic equipment and storage medium
CN108305072B (en) Method, apparatus, and computer storage medium for deploying a blockchain network
CA3087858C (en) Authentication and authorization using tokens with action identification
US20190034647A1 (en) Managing access to documents with a file monitor
CN108289098B (en) Authority management method and device of distributed file system, server and medium
CN108293045A (en) Single sign-on identity management between local and remote systems
US9973504B2 (en) Pre-authorizing a client application to access a user account on a content management system
KR20230005308A (en) Prevent deployment of unapproved packages in the cluster
CN110661776B (en) Sensitive data tracing method, device, security gateway and system
US20200159887A1 (en) Managing the display of hidden proprietary software code to authorized licensed users
CN109766708A (en) Access method, system, computer system and the storage medium of data resource
US10831904B2 (en) Automatically discovering attribute permissions
US20240007458A1 (en) Computer user credentialing and verification system
CN113190609A (en) Data warehouse management method, system, device, storage medium and electronic equipment
US11170080B2 (en) Enforcing primary and secondary authorization controls using change control record identifier and information
US20230179634A1 (en) Secure policy distribution in a cloud environment
US9355232B2 (en) Methods for governing the disclosure of restricted data
CN108228280A (en) The configuration method and device of browser parameters, storage medium, electronic equipment
CN109683942B (en) Script management method, script management device, script management medium and electronic equipment
WO2010012721A1 (en) Propagating information from a trust chain processing
CN113535574B (en) Automatic generation method, device, equipment and medium for test user data
US11977837B2 (en) Consent to content template mapping
US11558395B2 (en) Restricting access to cognitive insights
CN110401674B (en) Data access method, device, system, electronic equipment and computer readable medium
US11431711B2 (en) Method, device and computer program product for service access

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination