CN113806726A - Access control method and device, electronic equipment and storage medium - Google Patents
Access control method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN113806726A CN113806726A CN202110123099.4A CN202110123099A CN113806726A CN 113806726 A CN113806726 A CN 113806726A CN 202110123099 A CN202110123099 A CN 202110123099A CN 113806726 A CN113806726 A CN 113806726A
- Authority
- CN
- China
- Prior art keywords
- user
- service
- access
- user group
- service type
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001914 filtration Methods 0.000 claims abstract description 57
- 238000000034 method Methods 0.000 claims abstract description 40
- 230000006399 behavior Effects 0.000 claims description 66
- 238000004590 computer program Methods 0.000 claims description 9
- 230000004044 response Effects 0.000 claims description 6
- 201000010099 disease Diseases 0.000 description 15
- 208000037265 diseases, disorders, signs and symptoms Diseases 0.000 description 15
- 238000010586 diagram Methods 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 206010035664 Pneumonia Diseases 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24564—Applying rules; Deductive queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/445—Program loading or initiating
- G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
- G06F9/4451—User profiles; Roaming
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Computer Hardware Design (AREA)
- Storage Device Security (AREA)
Abstract
本发明提供了一种访问控制方法、装置、电子设备及存储介质，该方法包括：根据角色和业务权限划分用户群体，为每一用户群体配置行为过滤规则，并为每一业务类型配置对应于每一用户群体的业务权限信息；在用户登录到访问控制系统时，根据所述行为过滤规则确定该用户所属用户群体，并记录该用户所属用户群体；在用户登录到访问控制系统后，接收该用户针对任一业务类型的访问请求，根据为该业务类型配置的业务权限信息和对该用户所属用户群体的记录确定该用户对该业务类型的业务权限，根据该用户对该业务类型的业务权限对所述访问请求进行访问控制。本发明能够在同种角色不同业务权限的应用场景中实现对用户的行为限制。
The present invention provides an access control method, device, electronic device and storage medium. The method includes: dividing user groups according to roles and business rights, configuring behavior filtering rules for each user group, and configuring for each business type corresponding to The business authority information of each user group; when the user logs in to the access control system, the user group to which the user belongs is determined according to the behavior filtering rules, and the user group to which the user belongs is recorded; after the user logs in to the access control system, the user group is received. The user's access request for any service type determines the user's service authority for the service type according to the service authority information configured for the service type and the records of the user group to which the user belongs, according to the user's service authority for the service type. Access control is performed on the access request. The present invention can realize the behavior restriction of users in the application scenarios of the same role and different business rights.
Description
Technical Field
The present invention relates to the field of information security technologies, and in particular, to an access control method and apparatus, an electronic device, and a storage medium.
Background
Access control is a technique that restricts a user's access to certain information items, or the use of certain control functions, by a defined set of user identities and the items to which they belong. Access control is generally performed by assigning roles to users and assigning permissions to the roles, thereby restricting user behavior according to the roles.
The user behavior is limited according to the role, and the method is only suitable for a simpler application scene, but not suitable for a more complex application scene, for example, the behavior limitation of the user cannot be realized in the application scenes with the same role and different service permissions.
Disclosure of Invention
In view of this, the present invention provides an access control method, an access control apparatus, an electronic device, and a storage medium, which can implement behavior restriction on a user in application scenarios with the same role and different service permissions.
In order to achieve the purpose, the invention provides the following technical scheme:
an access control method comprising:
dividing user groups according to roles and service authorities, configuring behavior filtering rules for each user group, and configuring service authority information corresponding to each user group for each service type;
when a user logs in an access control system, determining a user group to which the user belongs according to the behavior filtering rule, and recording the user group to which the user belongs;
after a user logs in an access control system, receiving an access request of the user aiming at any service type, determining the service authority of the user to the service type according to service authority information configured for the service type and records of a user group to which the user belongs, and performing access control on the access request according to the service authority of the user to the service type.
An access control device comprising:
the configuration unit is used for dividing user groups according to roles and service authorities, configuring behavior filtering rules for each user group and configuring service authority information corresponding to each user group for each service type;
the recording unit is used for determining a user group to which the user belongs according to the behavior filtering rule and recording the user group to which the user belongs when the user logs in the access control system;
and the processing unit is used for receiving an access request of a user for any service type after the user logs in the access control system, determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and performing access control on the access request according to the service authority of the user for the service type.
An electronic device, comprising: the system comprises at least one processor and a memory connected with the at least one processor through a bus; the memory stores one or more computer programs executable by the at least one processor; the at least one processor, when executing the one or more computer programs, implements the steps in the above-described access control method.
A computer readable storage medium storing one or more computer programs which, when executed by a processor, implement the steps in the above-described access control method.
According to the technical scheme, the user groups are divided according to roles and service authorities, the behavior filtering rules are configured for each user group, and the service authority information corresponding to each user group is configured for each service type; when a user logs in the access control system, the user group to which the user belongs can be determined according to the behavior filtering rule; after a user logs in an access control system, when an access request of the user for any service type is received, the service authority of the user for the service type can be determined according to the service authority information configured for the service type and the record of the user group to which the user belongs, and the access control is performed on the access request according to the service authority information. It can be seen that, in the present invention, through the division of the user group, the users belonging to the same role are divided into different user groups due to different service permissions, so that access control can be performed on the access request of the user according to the service permission of the user group to which the user belongs, instead of performing access control on the access request of the user according to the service permission of the user role, and therefore, the behavior limitation of the user can be realized in the application scene of different service permissions of the same role.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive labor.
Fig. 1 is a flowchart of an access control method according to an embodiment of the present invention;
fig. 2 is a flowchart of an access control method according to a second embodiment of the present invention;
fig. 3 is a flowchart of an access control method provided in the third embodiment of the present invention;
fig. 4 is a flowchart of an access control method according to a fourth embodiment of the present invention;
fig. 5 is a schematic structural diagram of an access control device according to an embodiment of the present invention;
fig. 6 is a schematic structural diagram of an electronic device according to a first embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
In the embodiment of the invention, for the application scenes with the same role and different service permissions, the user groups are divided based on the role and the service permissions, so that the users belonging to the same role are divided into different user groups due to different service permissions, the access control can be performed on the access requests of the users according to the service permissions of the user groups to which the users belong, and the behavior limitation of the users with the same role and different service permissions can be realized.
Referring to fig. 1, fig. 1 is a flowchart of an access control method according to an embodiment of the present invention, and as shown in fig. 1, the method mainly includes the following steps:
In this embodiment, the roles that the user assumes in the access control system, for example, in the access control system related to medical services, the patient is one role and the doctor is the other role.
In this embodiment, the user groups are divided according to roles and service permissions, so that users belonging to the same role and the same service permission form one user group.
And 102, when the user logs in the access control system, determining a user group to which the user belongs according to the behavior filtering rule, and recording the user group to which the user belongs.
As can be seen from the method shown in fig. 1, in this embodiment, user groups are divided according to roles and service permissions, and by configuring a behavior filtering rule for each user group, users with different service permissions in the same role are divided into different user groups when logging in an access control system, and by configuring service permission information corresponding to each user group for each service type, when receiving an access request of a user for any service type, the service permission of the user for the service type can be determined according to the service permission information configured for the service type and a record of the user group to which the user belongs, and access control is performed on the access request according to the service permission information, so that behavior restriction on the user can be realized in an application scenario with different service permissions in the same role.
Referring to fig. 2, fig. 2 is a flowchart of an access control method according to a second embodiment of the present invention, and as shown in fig. 2, the method mainly includes the following steps:
in this embodiment, the behavior filtering rule configured for each user group includes at least one of the following:
rule 1: the login mode set for the user group, namely the user who logs in the access control system through the login mode set for the user group belongs to the user group;
rule 2: a user information list known to belong to the user group, that is, a user whose user information is located in the user information list known to belong to the user group belongs to the user group;
rule 3: and designating the user information list belonging to the user group, namely, the user information in the user information list designated to belong to the user group belongs to the user group.
In this embodiment, when the operations in steps 2022 to 2024 are performed on a certain user group, and it is not determined that the user belongs to the user group, it may be determined that the user does not belong to the user group.
In this embodiment, the user group to which the user belongs may be finally determined by performing the operations of step 2022 to step 2024 on each user group.
The above steps 2021 to 2024 are specific refinements of "determining the user group to which the user belongs according to the behavior filtering rule when the user logs in to the access control system" in step 102 shown in fig. 1.
As can be seen from the method shown in fig. 2, in this embodiment, user groups are divided according to roles and service permissions, a user who logs in to the access control system is divided into different user groups according to specific contents included in specific behavior filtering rules by configuring a behavior filtering rule for each user group, and service permission information corresponding to each user group is configured for each service type, so that when an access request of a user for any service type is received, the service permission of the user for the service type can be determined according to the service permission information configured for the service type and a record of the user group to which the user belongs, and access control is performed on the access request according to the service permission information, so that behavior restriction on the user can be realized in application scenarios with different service permissions in the same role.
Referring to fig. 3, fig. 3 is a flowchart of an access control method provided by a third embodiment of the present invention, and as shown in fig. 3, the method mainly includes the following steps:
In practical applications, the service authority may be various, such as various operation authorities for the service.
In this embodiment, the service authority information configured for each service type and corresponding to each user group includes a user group identifier and an access authority; wherein the access rights include permission to access and prohibition of access.
And step 302, when the user logs in the access control system, determining the user group to which the user belongs according to the behavior filtering rule, and adding the user group identification to which the user belongs to the user information.
In this embodiment, after determining the user group to which the user belongs according to the behavior filtering rule, the user group to which the user belongs may be recorded, so that the user group may be determined subsequently based on the record of the user group to which the user belongs, and the user group does not need to be determined again according to the behavior filtering rule.
In this embodiment, the recording the user group to which the user belongs specifically includes: and adding the user group identification to which the user belongs to the user information. Here, the user group identifier to which the user belongs is added to the user information, that is, the user group identifier to which the user belongs is used as one item of information included in the user information, so that the user group to which the user belongs can be determined subsequently only according to the user group identifier included in the user information.
The above step 302 is a detailed refinement of step 102 shown in fig. 1.
The above steps 3032 to 3033 are specific refinements of "determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs" in the step 103 shown in fig. 1.
In this embodiment, performing access control on the access request according to the service permission of the user for the service type specifically includes:
if the user's service authority to the service type is allowed to access, then the service is processed according to the access request, and a service processing result is returned;
and if the service authority of the user to the service type is access prohibition, returning an access response carrying the information indicating that the access is prohibited.
As can be seen from the method shown in fig. 3, in this embodiment, user groups are divided according to roles and service permissions; configuring a behavior filtering rule for each user group, so that users with the same role and different service authorities are divided into different user groups when logging in an access control system, and recording user group identifications of the users to which the users belong and adding the user information; by configuring the service authority information corresponding to each user group for each service type, when receiving an access request of a user for any service type, the service authority of the user for the service type can be determined according to the service authority information configured for the service type and the user group identification in the user information, and access control is performed on the access request according to the service authority information and the user group identification, so that behavior limitation on the user can be realized in application scenes with the same role and different service authorities.
Referring to fig. 4, fig. 4 is a flowchart of an access control method according to a fourth embodiment of the present invention, and as shown in fig. 4, the method mainly includes the following steps:
In practical applications, the service authority may be various, such as various operation authorities for the service.
In this embodiment, the service authority information configured for each service type and corresponding to each user group includes a user group identifier and an access authority; wherein the access rights include permission to access and prohibition of access.
In this embodiment, after determining the user group to which the user belongs according to the behavior filtering rule, the user group to which the user belongs may be recorded, so that the user group may be determined subsequently based on the record of the user group to which the user belongs, and the user group does not need to be determined again according to the behavior filtering rule.
In this embodiment, the recording the user group to which the user belongs specifically includes: and adding the user information into a user information list of a user group to which the user belongs.
The above step 402 is a detailed refinement of step 102 shown in fig. 1.
The above steps 4032 to 4035 are specific refinements of "determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs" in step 103 shown in fig. 1.
In this embodiment, performing access control on the access request according to the service permission of the user for the service type specifically includes:
if the user's service authority to the service type is allowed to access, then the service is processed according to the access request, and a service processing result is returned;
and if the service authority of the user to the service type is access prohibition, returning an access response carrying the information indicating that the access is prohibited.
As can be seen from the method shown in fig. 4, in this embodiment, user groups are divided according to roles and service permissions; configuring a behavior filtering rule for each user group, so that users with the same role and different service permissions are divided into different user groups when logging in an access control system, and user information is added into a user information list of the user group to which the user belongs; by configuring the service authority information corresponding to each user group for each service type, when receiving an access request of a user for any service type, the service authority of the user for the service type can be determined according to the service authority information configured for the service type and a user information list of the user group to which the user belongs, and access control is performed on the access request according to the service authority information, so that behavior limitation on the user can be realized in application scenes with the same role and different service authorities.
The access control method according to the embodiment of the present invention is described in detail above, and the following description is made with reference to specific examples:
suppose a company develops an access control system for medical services, which can provide medical services to patients, wherein the patients who suffer from a certain disease (such as new coronary pneumonia) can be provided with medical services with different business rights in the same role, for example, the patients who suffer from the certain disease are regarded as the same role, but when the medical services are provided, the patients who belong to the role and meet certain conditions can be provided with the certain medical services, and the patients who belong to the role and do not meet the certain conditions are not provided with the certain medical services, in which case, the situations of different business rights in the same role can occur.
For the above situation, the access control method provided by the above embodiment of the present invention may be adopted to realize the behavior limitation on the patient suffering from the specific disease, and the specific implementation process is as follows:
and step S1, dividing user groups according to roles and service authorities.
Specifically, for patients who have suffered from such a specific disease, the user groups are divided into two user groups according to whether or not to enjoy the specific medical service, wherein users in one user group (hereinafter, referred to as user group 1) enjoy the specific medical service and users in the other user group (hereinafter, referred to as user group 2) do not enjoy the specific medical service.
In addition, the same processing method as that in step S1 is also applied to patients with or suffering from other diseases, and will not be described herein and hereinafter.
Step S2, configuring behavior filtering rules for each user group, and configuring service authority information corresponding to each user group for each service type.
Specifically, the behavior filtering rule configured for the user group 1 specifically includes: the registration of the patient suffering from the specific disease, the patient known to be located in a certain place and in the user information list (hereinafter referred to as user information list 1) suffering from the specific disease, and the patient provided by the company and in the user information list (hereinafter referred to as user information list 2) suffering from the specific disease are completed by scanning the two-dimensional code provided by the doctor. The behavior filtering rules configured for the user group 2 are as follows: and filtering out the patients suffering from the specific disease by using the behavior filtering rule configured for the user group 1.
In addition, assume that there are service 1 and service 2, where service 1 is a specific medical service and service 2 is not a specific medical service. The service authority information configured for the two services is as follows:
1) the service authority information corresponding to the user group 1 configured for the service 1 comprises: identification and access permission of the user group 1; the service authority information corresponding to the user group 2 configured for the service 1 includes: identification and barring of access by the user population 2.
2) The service authority information corresponding to the user group 1 configured for the service 2 comprises: identification and access permission of the user group 1; the service authority information corresponding to the user group 2 configured for the service 2 includes: identification and permission of the user group 2.
And step S3, when the user logs in the access control system, determining the user group to which the user belongs according to the behavior filtering rule, and recording the user group to which the user belongs.
When a patient suffering from the specific disease logs in the access control system, if the patient suffering from the specific disease is registered by scanning the two-dimensional code provided by a doctor, or the patient in the user information list 1 or the user information list 2, the patient can be determined to belong to the user group 1, the patient can be added into the user information list of the user group 1, otherwise, the patient is determined to belong to the user group 2, and the patient can be added into the user information list of the user group 2.
Step S4, after the user logs in the access control system, receiving an access request of the user for any service type, determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and performing access control on the access request according to the service authority of the user for the service type.
After a patient suffering from the specific disease logs in the access control system, if the patient wants to access the service 1, an access request for the service 1 is triggered, after the access control system receives the access request, the access control system determines that only the patient in the user group 1 can access the service 1, so that the information of the patient is searched in a user information list of the user group 1, if the information is searched, the patient is determined to be allowed to access the service 1, so that the access request is subjected to service processing, and if the information is not searched, the patient is determined to be forbidden to access the service 1, so that an access response carrying indication forbidding access information can be returned, so that the patient knows that the patient cannot access the service 1.
After logging in the access control system, if a patient suffering from the specific disease wants to access the service 2, an access request for the service 2 is triggered, and after receiving the access request, the access control system determines that the patients in the user group 1 and the user group 2 can both access the service 2, so that the patient is determined to access the service 2, and thus the access request is subjected to service processing.
As can be seen from the above example, the patient suffering from the specific disease is divided into two user groups according to different access rights to the service 1 and the service 2, and the patient is divided into one of the two user groups when logging in the access control system by configuring the behavior filtering rules for the two user groups; by respectively configuring the service authority information corresponding to each user group for the service 1 and the service 2, when receiving an access request of a patient for the service 1 or the service 2, the service authority of the patient to the service type can be determined according to the service authority information configured for the service 1 or the service 2 and the record of the user group to which the patient belongs, and the access control is performed on the access request according to the service authority information, so that the behavior control of the patient suffering from the specific disease is realized.
An embodiment of the present invention further provides an access control apparatus, as shown in fig. 5, the apparatus includes:
a configuration unit 501, configured to divide user groups according to roles and service permissions, configure behavior filtering rules for each user group, and configure service permission information corresponding to each user group for each service type;
the recording unit 502 is used for determining a user group to which the user belongs according to the behavior filtering rule and recording the user group to which the user belongs when the user logs in the access control system;
the processing unit 503, after the user logs in the access control system, receives an access request of the user for any service type, determines the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and performs access control on the access request according to the service authority of the user for the service type.
In the device shown in figure 5 of the drawings,
the behavior filtering rule configured for each user group comprises at least one of the following: a login mode set for the user group, a user information list known to belong to the user group, and a user information list designated to belong to the user group;
the recording unit 502 determines the user group to which the user belongs according to the behavior filtering rule, and records the user group to which the user belongs, including:
for each of the user groups, the user group is,
when the behavior filtering rule configured for the user group comprises a login mode set for the user group, determining the login mode of the user, and if the login mode of the user is the same as the login mode set for the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list known to belong to the user group, if the user information is located in the user information list known to belong to the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list appointed to belong to the user group, if the user information is located in the user information list appointed to belong to the user group, determining that the user belongs to the user group.
In the device shown in figure 5 of the drawings,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording unit 502 records a user group to which the user belongs, and includes: adding the user group identification to which the user belongs to the user information;
the processing unit 503, determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, includes:
searching the service authority information configured for the service type for the user group identification in the user information;
and determining the access authority in the searched service authority information as the service authority of the user to the service type.
In the device shown in figure 5 of the drawings,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording unit 502 records a user group to which the user belongs, and includes: adding the user information into a user information list of a user group to which the user belongs;
the processing unit 503, determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, includes:
if the access rights in the service right information configured for the service type are all allowed to be accessed, determining that the service right of the user to the service type is allowed to be accessed;
if the access rights in the service right information configured for the service type are all access forbidding, determining that the service right of the user to the service type is access forbidding;
if the service type does not belong to the two conditions, determining that the access right in the service right information configured for the service type is the service right information allowing access, searching the user information in a user information list of a user group corresponding to the service right information allowing access, if the user information is searched, determining that the service right of the user to the service type is allowed access, otherwise, determining that the service right of the user to the service type is forbidden access.
In the device shown in figure 5 of the drawings,
the processing unit 503, performing access control on the access request according to the service authority of the user to the service type, includes:
if the user's service authority to the service type is allowed to access, then the service is processed according to the access request, and a service processing result is returned;
and if the service authority of the user to the service type is access prohibition, returning an access response carrying the information indicating that the access is prohibited.
An embodiment of the present invention further provides an electronic device, as shown in fig. 6, where the electronic device includes: at least one processor 601, and a memory 602 connected to the at least one processor 601 through a bus; the memory 602 stores one or more computer programs executable by the at least one processor 601; the at least one processor 601, when executing the one or more computer programs, implements the steps in the access control method shown in any of the flowcharts of fig. 1-4.
Embodiments of the present invention also provide a computer-readable storage medium storing one or more computer programs, which when executed by a processor implement the steps in the access control method shown in any of the flowcharts in fig. 1-4.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (12)
1. An access control method, characterized in that the method comprises:
dividing user groups according to roles and service authorities, configuring behavior filtering rules for each user group, and configuring service authority information corresponding to each user group for each service type;
when a user logs in an access control system, determining a user group to which the user belongs according to the behavior filtering rule, and recording the user group to which the user belongs;
after a user logs in an access control system, receiving an access request of the user aiming at any service type, determining the service authority of the user to the service type according to service authority information configured for the service type and records of a user group to which the user belongs, and performing access control on the access request according to the service authority of the user to the service type.
2. The method of claim 1,
the behavior filtering rule configured for each user group comprises at least one of the following: a login mode set for the user group, a user information list known to belong to the user group, and a user information list designated to belong to the user group;
the determining the user group to which the user belongs according to the behavior filtering rule includes:
for each of the user groups, the user group is,
when the behavior filtering rule configured for the user group comprises a login mode set for the user group, determining the login mode of the user, and if the login mode of the user is the same as the login mode set for the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list known to belong to the user group, if the user information is located in the user information list known to belong to the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list appointed to belong to the user group, if the user information is located in the user information list appointed to belong to the user group, determining that the user belongs to the user group.
3. The method of claim 1,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording of the user group to which the user belongs comprises: adding the user group identification to which the user belongs to the user information;
the determining the service authority of the user to the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs comprises the following steps:
searching the service authority information configured for the service type for the user group identification in the user information;
and determining the access authority in the searched service authority information as the service authority of the user to the service type.
4. The method of claim 1,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording of the user group to which the user belongs comprises: adding the user information into a user information list of a user group to which the user belongs;
the determining the service authority of the user to the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs comprises the following steps:
if the access rights in the service right information configured for the service type are all allowed to be accessed, determining that the service right of the user to the service type is allowed to be accessed;
if the access rights in the service right information configured for the service type are all access forbidding, determining that the service right of the user to the service type is access forbidding;
if the service type does not belong to the two conditions, determining that the access right in the service right information configured for the service type is the service right information allowing access, searching the user information in a user information list of a user group corresponding to the service right information allowing access, if the user information is searched, determining that the service right of the user to the service type is allowed access, otherwise, determining that the service right of the user to the service type is forbidden access.
5. The method according to claim 3 or 4,
the access control of the access request according to the service authority of the user to the service type includes:
if the user's service authority to the service type is allowed to access, then the service is processed according to the access request, and a service processing result is returned;
and if the service authority of the user to the service type is access prohibition, returning an access response carrying the information indicating that the access is prohibited.
6. An access control apparatus, characterized in that the apparatus comprises:
the configuration unit is used for dividing user groups according to roles and service authorities, configuring behavior filtering rules for each user group and configuring service authority information corresponding to each user group for each service type;
the recording unit is used for determining a user group to which the user belongs according to the behavior filtering rule and recording the user group to which the user belongs when the user logs in the access control system;
and the processing unit is used for receiving an access request of a user for any service type after the user logs in the access control system, determining the service authority of the user for the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and performing access control on the access request according to the service authority of the user for the service type.
7. The apparatus of claim 6,
the behavior filtering rule configured for each user group comprises at least one of the following: a login mode set for the user group, a user information list known to belong to the user group, and a user information list designated to belong to the user group;
the recording unit determines the user group to which the user belongs according to the behavior filtering rule, and the method comprises the following steps:
for each of the user groups, the user group is,
when the behavior filtering rule configured for the user group comprises a login mode set for the user group, determining the login mode of the user, and if the login mode of the user is the same as the login mode set for the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list known to belong to the user group, if the user information is located in the user information list known to belong to the user group, determining that the user belongs to the user group;
when the behavior filtering rule configured for the user group comprises a user information list appointed to belong to the user group, if the user information is located in the user information list appointed to belong to the user group, determining that the user belongs to the user group.
8. The apparatus of claim 6,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording unit records the user group to which the user belongs, and comprises: adding the user group identification to which the user belongs to the user information;
the processing unit determines the service authority of the user to the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and comprises the following steps:
searching the service authority information configured for the service type for the user group identification in the user information;
and determining the access authority in the searched service authority information as the service authority of the user to the service type.
9. The apparatus of claim 6,
the service authority information which is configured for each service type and corresponds to each user group comprises user group identification and access authority; the access right comprises permission access and prohibition access;
the recording unit records the user group to which the user belongs, and comprises: adding the user information into a user information list of a user group to which the user belongs;
the processing unit determines the service authority of the user to the service type according to the service authority information configured for the service type and the record of the user group to which the user belongs, and comprises the following steps:
if the access rights in the service right information configured for the service type are all allowed to be accessed, determining that the service right of the user to the service type is allowed to be accessed;
if the access rights in the service right information configured for the service type are all access forbidding, determining that the service right of the user to the service type is access forbidding;
if the service type does not belong to the two conditions, determining that the access right in the service right information configured for the service type is the service right information allowing access, searching the user information in a user information list of a user group corresponding to the service right information allowing access, if the user information is searched, determining that the service right of the user to the service type is allowed access, otherwise, determining that the service right of the user to the service type is forbidden access.
10. The apparatus according to claim 8 or 9,
the processing unit, which performs access control on the access request according to the service authority of the user to the service type, includes:
if the user's service authority to the service type is allowed to access, then the service is processed according to the access request, and a service processing result is returned;
and if the service authority of the user to the service type is access prohibition, returning an access response carrying the information indicating that the access is prohibited.
11. An electronic device, comprising: the system comprises at least one processor and a memory connected with the at least one processor through a bus; the memory stores one or more computer programs executable by the at least one processor; characterized in that the at least one processor, when executing the one or more computer programs, implements the steps in the method of any of claims 1-5.
12. A computer-readable storage medium, characterized in that the computer-readable storage medium stores one or more computer programs which, when executed by a processor, implement the steps in the method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110123099.4A CN113806726A (en) | 2021-01-29 | 2021-01-29 | Access control method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110123099.4A CN113806726A (en) | 2021-01-29 | 2021-01-29 | Access control method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113806726A true CN113806726A (en) | 2021-12-17 |
Family
ID=78892821
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110123099.4A Pending CN113806726A (en) | 2021-01-29 | 2021-01-29 | Access control method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113806726A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114822743A (en) * | 2022-05-07 | 2022-07-29 | 北京京东拓先科技有限公司 | Authority control method and device |
| CN115766296A (en) * | 2023-01-09 | 2023-03-07 | 广东中思拓大数据研究院有限公司 | User account authority control method, device, server and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120278093A1 (en) * | 2011-04-26 | 2012-11-01 | Amundson Russell Henry | System and method for conveying and processing personal health information |
| CN103078859A (en) * | 2012-12-31 | 2013-05-01 | 普天新能源有限责任公司 | Service system authority management method, equipment and system |
| CN111753287A (en) * | 2020-06-28 | 2020-10-09 | 中国银行股份有限公司 | Authority control method and device |
| CN111865885A (en) * | 2019-04-30 | 2020-10-30 | 中移(苏州)软件技术有限公司 | An access control method, apparatus, device and storage medium |
| CN112182619A (en) * | 2020-09-30 | 2021-01-05 | 澳优乳业（中国）有限公司 | Service processing method and system based on user permission, electronic device and medium |
-
2021
- 2021-01-29 CN CN202110123099.4A patent/CN113806726A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120278093A1 (en) * | 2011-04-26 | 2012-11-01 | Amundson Russell Henry | System and method for conveying and processing personal health information |
| CN103078859A (en) * | 2012-12-31 | 2013-05-01 | 普天新能源有限责任公司 | Service system authority management method, equipment and system |
| CN111865885A (en) * | 2019-04-30 | 2020-10-30 | 中移(苏州)软件技术有限公司 | An access control method, apparatus, device and storage medium |
| CN111753287A (en) * | 2020-06-28 | 2020-10-09 | 中国银行股份有限公司 | Authority control method and device |
| CN112182619A (en) * | 2020-09-30 | 2021-01-05 | 澳优乳业（中国）有限公司 | Service processing method and system based on user permission, electronic device and medium |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114822743A (en) * | 2022-05-07 | 2022-07-29 | 北京京东拓先科技有限公司 | Authority control method and device |
| CN115766296A (en) * | 2023-01-09 | 2023-03-07 | 广东中思拓大数据研究院有限公司 | User account authority control method, device, server and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110192198B (en) | Security for accessing stored resources | |
| CN108140031B (en) | Peer-to-peer synchronizable storage system | |
| Freni et al. | Preserving location and absence privacy in geo-social networks | |
| CN110858833B (en) | Access control policy configuration method, device and system and storage medium | |
| EP2634721B1 (en) | Service providing method, recording medium, and information processing apparatus | |
| US20030055991A1 (en) | Access control for an e-commerce application | |
| CN113806726A (en) | Access control method and device, electronic equipment and storage medium | |
| JP5991386B2 (en) | Network system | |
| CN111652685A (en) | Information processing method, apparatus, computer equipment, and computer-readable storage medium | |
| US20220398331A1 (en) | Property-level visibilities for knowledge-graph objects | |
| US8191115B2 (en) | Method and apparatus for extensible security authorization grouping | |
| Shastri et al. | Remodeling: improved privacy preserving data mining (PPDM) | |
| US20230128367A1 (en) | Environment and location-based data access management systems and methods | |
| US20230308302A1 (en) | Data transfer system and data transfer method | |
| CN113778991B (en) | Method for realizing resource access control of big data | |
| JPH06214863A (en) | Information resource managing device | |
| CN109145621A (en) | Document management method and device | |
| CN111324799B (en) | Method and device for processing search request | |
| JP2007510985A (en) | Different permissions for control points in media provider entities | |
| US20060156020A1 (en) | Method and apparatus for centralized security authorization mechanism | |
| US20060156021A1 (en) | Method and apparatus for providing permission information in a security authorization mechanism | |
| CN115550010B (en) | Key environment access control method based on block chain | |
| CN117914535A (en) | User authority management method, device, storage medium and electronic device | |
| JP7225554B2 (en) | Information processing device, information processing system and information processing program | |
| Li et al. | Noise-added selection method for location-based service using differential privacy in Internet of Things |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |