CN116451210A

CN116451210A - Rights recovery method, device, equipment and storage medium

Info

Publication number: CN116451210A
Application number: CN202310262443.7A
Authority: CN
Inventors: 李晓伟; 顾雪峰
Original assignee: Agricultural Bank of China
Current assignee: Agricultural Bank of China
Priority date: 2023-03-14
Filing date: 2023-03-14
Publication date: 2023-07-18

Abstract

The invention discloses a method, a device, equipment and a storage medium for recovering rights, wherein the method comprises the following steps: acquiring at least one target user identifier; acquiring a user permission group based on the target user identification; wherein the user permission group comprises the target user identifier; the user permission group comprises a first user permission group under a set operation system and/or a second user permission group under a set service system; the configuration of the setting business system and the setting operation system; deleting the target user identifier from the user permission groups, and setting the number of the user permission groups associated with the target user identifier to 0. The method can replace manual operation, particularly when the required rights recovery amount is large, the time and labor cost can be reduced, and meanwhile, the problem that rights are not thoroughly cleaned due to omission of manual operation is solved.

Description

Rights recovery method, device, equipment and storage medium

Technical Field

The embodiment of the invention relates to the technical field of rights data management, in particular to a rights recovery method, a device, equipment and a storage medium.

Background

Under the background of financial science and technology, commercial banks continuously participate in various system informatization construction by means of internal and external human resources, various scenes (such as abnormal movement, off-site and the like) for developing and testing personnel to leave the project exist objectively in the construction process, and the personnel to leave need to recover source code read-write permission, which is a necessary operation based on code management security requirements.

Disclosure of Invention

The embodiment of the invention provides a permission recovery method, a permission recovery device, permission recovery equipment and a storage medium, which can correlate abnormal information with request message information, provide comprehensive problem analysis data for subsequent application and improve problem response and solution efficiency.

In a first aspect, an embodiment of the present invention provides a rights recovery method, where the method includes:

acquiring at least one target user identifier;

acquiring a user permission group based on the target user identification; wherein the user permission group comprises the target user identifier; the user permission group comprises a first user permission group under a set operation system and/or a second user permission group under a set service system; the configuration of the setting business system and the setting operation system;

deleting the target user identifier from the user permission groups, and setting the number of the user permission groups associated with the target user identifier to 0.

In a second aspect, an embodiment of the present invention further provides an apparatus for recovering rights, where the apparatus includes:

the user identification acquisition module is used for acquiring at least one target user identification;

the user permission group acquisition module is used for acquiring a user permission group based on the target user identification; wherein the user permission group comprises the target user identifier; the user permission group comprises a first user permission group under a set operation system and/or a second user permission group under a set service system; the configuration of the setting business system and the setting operation system;

and the permission group deleting module is used for deleting the target user identification from the user permission groups and setting the number of the user permission groups associated with the target user identification to be 0.

In a third aspect, embodiments of the present disclosure further provide an electronic device, including:

one or more processors;

storage means for storing one or more programs,

the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the rights reclamation method provided by the embodiments of the present disclosure.

In a fourth aspect, the disclosed embodiments also provide a storage medium containing computer-executable instructions for performing, when executed by a computer processor, a rights reclamation method provided by implementing the disclosed embodiments.

Drawings

The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.

FIG. 1 is a flowchart of a rights recovery method provided by an embodiment of the present disclosure;

fig. 2 is a diagram showing an example of the number of rights groups in a rights recovery method according to an embodiment of the present disclosure;

fig. 3 is a schematic structural diagram of a rights recovery apparatus according to an embodiment of the present disclosure;

fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.

The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments. Related definitions of other terms will be given in the description below.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

It will be appreciated that, prior to use of the technical solutions disclosed in the embodiments of the present disclosure, the user should be informed and authorized of the type of personal information, the scope of use, the use scenario, etc. to which the present disclosure relates in an appropriate manner in accordance with the relevant legal regulations.

For example, in response to receiving an active request from a user, a prompt is sent to the user to explicitly prompt the user that the operation it is requesting to perform will require personal information to be obtained and used with the user. Thus, the user can autonomously select whether to provide personal information to software or hardware such as an electronic device, an application program, a server or a storage medium for executing the operation of the technical scheme of the present disclosure according to the prompt information.

As an alternative but non-limiting implementation, in response to receiving an active request from a user, the manner in which the prompt information is sent to the user may be, for example, a popup, in which the prompt information may be presented in a text manner. In addition, a selection control for the user to select to provide personal information to the electronic device in a 'consent' or 'disagreement' manner can be carried in the popup window.

It will be appreciated that the above-described notification and user authorization process is merely illustrative and not limiting of the implementations of the present disclosure, and that other ways of satisfying relevant legal regulations may be applied to the implementations of the present disclosure.

It will be appreciated that the data (including but not limited to the data itself, the acquisition or use of the data) involved in the present technical solution should comply with the corresponding legal regulations and the requirements of the relevant regulations.

Example 1

Fig. 1 is a flowchart of rights recovery provided by an embodiment of the present disclosure, where the embodiment of the present disclosure is applicable to a situation of rights recovery, the method may be performed by a rights recovery device, where the device may be implemented in a form of software and/or hardware, and optionally, implemented by an electronic device, where the electronic device may be a mobile terminal, a PC side, a server, or the like.

As shown in fig. 1, the rights recovery method provided in the embodiment of the present disclosure may specifically include the following steps:

s110, at least one target user identification is obtained.

In this embodiment, the target user identification may be an identification for identifying the user identity.

Specifically, one or more target user identifications are obtained.

S120, acquiring a user permission group based on the target user identification.

The user authority group comprises a target user identifier; the user authority group comprises a first user authority group under a set operation system and/or a second user authority group under a set service system; the configuration of the business system is set and the operation system is set.

In this embodiment, the user permission set may include a first user permission set under the set operating system and a second user permission set under the set service system. The set operating system may be a Window operating system, an Active Directory (AD) domain controller under the Window operating system, where all accounts, computers, etc. security principals may be registered in a central database located on one or more central computer clusters referred to as the domain controller. The first user permission set may be a shared permission set created in computer user permissions of the AD domain server, and sharing of different user permissions of the same set is achieved by adding users to the first user permission set. The set business system can be a business system used by a business bank, and the set business system is configured and arranged in an operating system. Among other things, azure Dev Ops Server (ADOS) may be a management tool for enterprise software development, quality management, and implementation of operations and dimensions. The second user authority group can be a catalog which is created in the ADOS management tool and used for configuring personalized authorities, the user is added into the second user authority group to realize the sharing of the same group of different user authorities, and the first user authority group can also be added into the second user authority group to realize the sharing of the authority of the same group of different users and groups.

Specifically, according to the input target user identification, searching the associated user permission group in the set operation system or the set service system, then storing the user permission group into the set queue, and counting the number of the user permission groups. The corresponding user permission group comprises a target user identifier. The user authority group can comprise a first user authority group under a set operation system or a second user authority group under a set business system.

Optionally, the manner of acquiring the user permission set based on the target user identifier may be: searching an associated user permission group in a set operating system and/or a set business system according to the input target user identification; storing the user permission groups into a set queue, and counting the number of the user permission groups; and displaying the number of the user permission groups.

Specifically, searching a user permission group with the input target user identification in a set operation system or a set service system according to the input target user identification, storing the user permission group into a set queue, counting the number of the user permission groups, and displaying the number of the user permission groups.

Fig. 2 is a diagram showing an example of the number of rights groups in a rights recycling method according to an embodiment of the present disclosure. As shown in fig. 2, the target user identifier may be stored in a standard setting format file, the target user identifier is identified according to the input standard setting format file, then the associated user permission group is searched, the user permission group is stored in a setting queue, the number of the user permission groups is counted and displayed in a page, the number of the AD security groups is the number of the first user permission groups, and the number of the ADOS security groups is the number of the second user permission groups. Wherein, the setting format can be CSV format.

S130, deleting the target user identification from the user permission groups, and setting the number of the user permission groups associated with the target user identification to be 0.

Specifically, the target user identifier is deleted from the associated user permission groups, and meanwhile, the number of the first user permission groups associated with the target user identifier is set to 0.

Optionally, the manner of deleting the target user identifier from the user permission group and setting the number of user permission groups associated with the target user identifier to 0 may be: deleting the target user identification from the first user authority group, and setting the number of the first user authority groups associated with the target user identification to be 0; and deleting the target user identification from the second user authority group, and setting the number of the second user authority groups associated with the target user identification to 0.

Specifically, the target user identifier is deleted from the first user authority group, and the number of the first user authority groups associated with the target user identifier is set to 0. And deleting the target user identification from the second user permission groups, and setting the number of the second user permission groups associated with the target user identification to 0.

Optionally, after deleting the target user identifier from the user permission group, the method further includes: and rejecting the access operation corresponding to the target user identifier when the target user identifier is detected to access the set operating system.

Specifically, after the target user identifier is deleted from the user authority group, the target user identifier is disabled in the AD domain, that is, when the user with the target user identifier is detected to access the set operating system, the access operation corresponding to the target user identifier is refused.

Specifically, an embodiment of the present disclosure provides a rights recovery method, which includes: acquiring at least one target user identifier; acquiring a user permission group based on the target user identification; the user authority group comprises a target user identifier; the user authority group comprises a first user authority group under a set operation system and/or a second user authority group under a set service system; setting service system configuration and setting operation system; and deleting the target user identification from the user authority groups, and setting the number of the user authority groups associated with the target user identification to 0. The method can replace manual operation, particularly when the required rights recovery amount is large, the time and labor cost can be reduced, and meanwhile, the problem that rights are not thoroughly cleaned due to omission of manual operation is solved.

Example two

Fig. 3 is a schematic structural diagram of a rights recovery device according to an embodiment of the present invention, where, as shown in fig. 3, the device includes: a user identification acquisition module 210, a user rights group acquisition module 220, and a rights group deletion module 230.

A user identifier obtaining module 210, configured to obtain at least one target user identifier;

a user permission set acquisition module 220, configured to acquire a user permission set based on the target user identifier; wherein the user permission group comprises the target user identifier; the user permission group comprises a first user permission group under a set operation system and/or a second user permission group under a set service system; the configuration of the setting business system and the setting operation system;

and the permission group deleting module 230 is configured to delete the target user identifier from the user permission groups, and set the number of user permission groups associated with the target user identifier to 0.

According to the technical scheme provided by the embodiment of the disclosure, the method can replace manual operation, particularly when the authority recovery requirement is large, the time and labor cost can be reduced, and meanwhile, the problem that the authority is not thoroughly cleaned due to omission of manual operation is solved.

Further, after deleting the target user identifier from the user permission set, the apparatus further includes:

and rejecting the access operation corresponding to the target user identifier when the target user identifier is detected to access the set operating system.

Further, the user permission set acquisition module 220 may be configured to:

searching an associated user permission group in the set operation system and/or the set service system according to the input target user identification;

storing the user permission groups into a set queue, and counting the number of the user permission groups;

and displaying the number of the user permission groups.

Further, the rights group deletion module 230 may also be configured to:

deleting the target user identifier from the first user permission group, and setting the number of first user permission groups associated with the target user identifier to be 0;

deleting the target user identifier from the second user permission group, and setting the number of the second user permission groups associated with the target user identifier to 0.

The device can execute the method provided by all the embodiments of the invention, and has the corresponding functional modules and beneficial effects of executing the method. Technical details not described in detail in this embodiment can be found in the methods provided in all the foregoing embodiments of the invention.

Example III

Fig. 4 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 4, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, wherein the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various suitable actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the respective methods and processes described above, such as the rights recovery method.

In some embodiments, the rights reclamation method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into RAM13 and executed by processor 11, one or more steps of the rights recovery method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the rights recovery method in any other suitable way (e.g. by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.

The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.

The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims

1. A rights recovery method, comprising:

acquiring at least one target user identifier;

2. The method of claim 1, wherein after deleting the target user identification from the set of user permissions, further comprising:

3. The method of claim 1, wherein obtaining the set of user permissions based on the target user identification comprises:

and displaying the number of the user permission groups.

4. The method of claim 1, wherein deleting the target user identification from the set of user permissions and setting the number of sets of user permissions associated with the target user identification to 0 comprises:

5. A rights recovery device, characterized by comprising:

6. A rights recovery device, characterized by comprising:

and the access operation rejecting module is used for rejecting the access operation corresponding to the target user identifier when the target user identifier is detected to access the set operating system.

7. A rights recovery device, characterized by comprising:

the searching module is used for searching the associated user permission group in the set operation system and/or the set service system according to the input target user identification;

the storage module is used for storing the user permission groups into a set queue and counting the number of the user permission groups;

and the display module is used for displaying the number of the user permission groups.

8. A rights recovery device, characterized by comprising:

the first authority group deleting module is used for deleting the target user identifier from the first user authority groups and setting the number of the first user authority groups associated with the target user identifier to be 0;

and the second authority group deleting module is used for deleting the target user identifier from the second user authority groups and setting the number of the second user authority groups associated with the target user identifier to be 0.

9. An electronic device, the electronic device comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the rights reclamation method of any of claims 1-4.

10. A computer readable storage medium storing computer instructions for causing a processor to perform the rights reclamation method of any of claims 1-4.