TWI789193B - Method and device for automatically checking authority of computer folder - Google Patents

Abstract

A method for automatically checking folder permissions includes periodically updating a preset permission list, after updating the preset permission list, sending the preset permission list to a number of checked devices so as to update a number of actual permission lists of a number of shared folders of the checked devices, periodically obtaining the actual permission lists, and when any one of the actual permission lists does not conform to the preset permission list, outputting an abnormal notification. There is a one-to-one relationship between the checked devices, the shared folders and the actual permission lists.

Description

Automatic check method and device for file folder permissions

The present invention relates to an automatic checking method and device, in particular to an automatic checking method and device for managing file folder permissions.

With the development of network technology, the network has become an indispensable and important factor in daily life and work environment. How to identify, assign and manage different network users in the local area network and the corresponding internal use rights in the working environment has become an extremely important issue for managers.

In the local area network existing in the enterprise working environment, users often cooperate with each other by sharing folders. However, the usage permissions of shared folders are often only divided according to departments or manually set by personnel. Therefore, how to speed up the automatic inspection and operation efficiency of enterprises etc. through the permission setting of shared folders is still facing certain operational difficulties.

In view of the above-mentioned shortcomings of the prior art, the present invention provides an automatic verification method and device for file folder permissions.

An automatic checking method according to an embodiment of the present invention includes using a checking device to periodically update a default permission list, and after updating the default permission list, sending the default permission list to a plurality of checked devices, so as to updating multiple actual permission lists of multiple shared folders of the checked devices, periodically obtaining the actual permission lists, and when any one of the actual permission lists does not match the default permission list, Outputting an exception notification, wherein there is a one-to-one relationship among the checked devices, the shared folders and the actual permission lists.

An automatic inspection device according to an embodiment of the present invention is suitable for inspecting a plurality of inspected devices, and includes a storage module, a communication module and a processing module. The save module saves a list of default permissions. The processing module is connected to the storage module and the communication module, and is used to execute: periodically update a default permission list, and after updating the default permission list, send the default permission list to the These checked devices to update the multiple actual permission lists of the multiple shared folders of the checked devices, periodically obtain the actual permission lists through the communication module, and when any of the actual permission lists When one of them does not conform to the default permission list, an exception notification is output. Wherein, there is a one-to-one relationship among the inspected devices, the shared folders and the actual permission lists.

To sum up, according to the method and device for automatic checking of folder permissions disclosed in the present invention, the use permissions of each shared folder can be automatically checked based on the personnel access authorization list provided by each unit, and at the same time, it can also be judged The above-mentioned authorization list will be automatically checked and updated if there is an abnormality in the data, which can effectively speed up the operational efficiency of the enterprise.

The above description of the disclosure and the following description of the implementation are used to demonstrate and explain the spirit and principle of the present invention, and provide a further explanation of the patent application scope of the present invention.

The detailed features and advantages of the present invention are described in detail below in the implementation mode, and its content is enough to make any person familiar with the related art understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of the patent application and the drawings , anyone skilled in the art can easily understand the purpose and advantages of the present invention. The following examples are to further describe the concept of the present invention in detail, but not to limit the scope of the present invention in any way.

Please refer to FIG. 1 . FIG. 1 is a functional block diagram of an automatic checking device and a tested device according to an embodiment of the present invention. As shown in FIG. 1 , the automated checking device 10 can be adapted to automatically assign and/or check the login records and/or data usage rights of the respective shared folders of multiple checked devices 2 . The checking device 10 may include a storage module 12, a communication module 14, and a processing module 16, and each checked device 2 may include an actual permission list corresponding to a login record and/or data usage permission record of a shared folder twenty two. The checking device 10 may be an electronic device or a rights management system at the manager's side, and the checked device 2 may be an electronic device at the managed side. The above-mentioned electronic device can be a single device, multiple devices under the same local area network, or a distributed computer cluster. In practice, the above-mentioned electronic device may be a desktop computer, a notebook computer, a smart phone, etc. or any combination of the above-mentioned devices, but the present invention is not limited thereto.

The actual permission list 22 of the shared folder included in the tested device 2 is further described. The actual permission list 22 can be stored in the memory of the tested device 2, and is used to store the use permissions of multiple user terminals (such as other tested devices 2 or other computers) for shared folders, and can only store the files with use permissions. The user end only stores the user end without the use authority, or stores both the user end with the use authority and the user end without the use authority, which is not limited by the present invention. The access rights may be view, read-only, read, edit, execute, download, delete, share, hide, encrypt/decrypt, compress/decompress, access location management and/or special access rights for shared folders settings, etc., but the present invention is not limited thereto. The actual authority list 22 can store one or more identification information corresponding to the user terminal to represent the user terminal, such as device number, network address and/or any kind of identification information, etc., wherein the device number is, for example, an IP address or MAC address. The actual authority list 22 may include any kind of identification information corresponding to the level, department and/or authority attribute corresponding to the login record or use authority record of the user terminal in one or more enterprises, etc., for providing Identify the type of shared folder.

To further illustrate each module of the verification device 10, the storage module 12 can be any type of fixed or removable random access memory (random access memory, RAM), read-only memory (read- only memory, ROM), flash memory (flash memory), hard disk (hard disk drive, HDD), solid state disk (solid state drive, SSD) or similar components or a combination of the above components, but the present invention does not limit. The storage module 12 can store a default permission list 122 and historical permission data 124 .

The default authority list 122 can store the use authority of the shared folder of each tested device 2 . The historical permission data 124 is selectively stored data, which may include multiple historical permission lists. In particular, the default permission list 122 stores the current ideal usage permissions of the shared folders of each tested device 2 , and the historical permission list stored in the historical permission data 124 is the ideal usage permissions at past time points.

The communication module 14 can communicate with each tested device 2 to transmit data to or receive data from the tested device 2 . In some embodiments, the communication module 14 may be a component that communicates through a wired network, a local area network, a wireless network, etc., but the present invention is not limited thereto. Furthermore, the communication module 14 can be connected to the storage module 12 by wire or wirelessly, and is controlled to obtain data (such as the default permission list 122 ) from the storage module 12 and send it to each checked device 2 .

The processing module 16 can be connected to the storage module 12 and the communication module 14 in a wired or wireless manner. In some embodiments, the processing module 44 may be a central processing unit (Central Processing Unit, CPU), or other programmable general purpose or special purpose microprocessor (Microprocessor), digital signal processor (Digital Signal Processor, DSP), programmable controller, application specific integrated circuit (Application Specific Integrated Circuit, ASIC) or other similar components or a combination of any of the above components, the present invention is not limited thereto.

The processing module 16 can periodically update the default authority list stored in the storage module 12, and transmit the updated default authority list to each inspected device 2 through the communication module 14 to update each inspected device 2 The actual authority list 22 of the shared folder is periodically obtained from each tested device 2 through the communication module 14, and when an actual authority list 22 does not match the current default authority list, an abnormal notification is output. The implementation content of the above operation will be described later.

Please refer to FIG. 1 and FIG. 2 together, wherein FIG. 2 is a flowchart of an automatic checking method according to an embodiment of the present invention. As shown in FIG. 2, the automatic checking method may include steps S1-S9. The automatic verification method shown in FIG. 2 is suitable for the verification device 10 shown in FIG. 1 , and can be executed by the processing module 16 of the verification device 10 , but is not limited thereto. The steps of the automatic checking method shown in FIG. 2 will be described below using the checking device 10 and the tested device 2 shown in FIG. 1 as examples.

In step S1 , the processing module 16 periodically updates the default permission list stored in the storage module 12 . The update is, for example, adding or removing one or more user-end usage permissions. Further, the processing module 16 can periodically adjust the usage authority according to the state of the user terminal in the preset authority list. For example, when the user corresponding to the client terminal has left the company, the processing module 16 can remove the client terminal from the default permission list accordingly. In addition, the processing module 16 can also adjust the default permission list according to the administrator's input command.

In step S2, the processing module 16 sends the default permission list to a plurality of checked devices 2 after each update of the default permission list, so as to update the multiple real list of permissions. Wherein, there is a one-to-one relationship among the checked devices 2 , the shared folders and the actual permission lists 22 .

In step S3 , the processing module 16 periodically obtains the actual authority lists of the inspected devices 2 . In particular, the cycle lengths of steps S1 and S3 can be preset to be the same or different, which is not limited by the present invention.

In step S4, the processing module 16 judges whether the acquired actual permission lists are in accordance with the default permission lists. As mentioned above, the default permission list 122 stores the current ideal usage permission of the shared folder of each tested device 2 . The processing module 16 can determine whether the difference ratio between the usage rights contained in the actual permission list of each checked device 2 and the ideal usage permission corresponding to the checked device 2 in the preset permission list is less than a preset threshold; If it is less than, it means that the actual permission list conforms to the default permission list; if it is not less than, it means that the actual permission list does not match the default permission list. The preset threshold is, for example, 0%˜5%.

When the judgment result of step S4 is negative, that is, if any actual authority list does not conform to the default authority list, the processing module 16 executes step S5: outputting an abnormality notification. Wherein, the abnormal notification can be output through output components such as a display, a horn, a warning light, and the like. Furthermore, between step S2 and step S3, non-administrators may tamper with the actual permission list of the shared folder of the tested device 2, and through the judgment of step S4, the checking device 10 can confirm whether It may have been tampered with by non-administrators.

When the judgment result of step S4 is yes, the processing module 16 executes step S6: judging whether each of the actual permission lists conforms to the historical permission data. Further, please refer to FIG. 3 , which is a partial flowchart of an automatic checking method according to an embodiment of the present invention. As shown in Figure 3, step S6 may include performing three judging sub-steps for each actual authority list, including sub-step S61: judging whether the difference ratio between the actual authority list and the first historical authority list is less than the first error ratio; Sub-step S62: judging whether the difference ratio between the actual authority list and the second historical authority list is less than the second error ratio; and sub-step S63: judging whether the difference ratio between the actual authority list and the third historical authority list is less than the third error ratio. When the judgment results of sub-steps S61-S63 are all yes, the judgment result of step S6 is yes. And when any judgment result in sub-steps S61-S63 is negative, the judgment result of step S6 is negative. That is to say, when the determination result of any determination sub-step of a target authority list in all actual authority lists is negative, the target authority list does not conform to the historical authority data.

As mentioned above, the historical permission data may include multiple historical permission lists. FIG. 3 takes the first historical permission list, the second historical permission list and the third historical permission list as examples. Wherein, the first to third historical permission lists may be permission lists from newest to old in generation time sequence. Specifically, the first historical permission list may be the default permission list before the latest update, the second historical permission list may be the default permission list before the last update, and the third historical permission list and so on. The first error ratio is less than or equal to the second error ratio, and the second error ratio is less than or equal to the third error ratio. Further, the first error rate may be between 0% and 5%, the second error rate may be between 0% and 10%, and the third error rate may be between 0% and 15%.

Please refer to FIG. 1 and FIG. 2 again, when the judgment result of step S6 is negative, the processing module 16 executes step S7: outputting another abnormal notification and generating a completion signal. The other abnormality notification may be presented in a manner different from the abnormality notification in step S5 (for example, different display screens, different output voices, different lights, etc.). When the judgment result of step S6 is yes, the processing module 16 executes step S8: generating a completion signal. In step S9, the processing module 16 is triggered by the completion signal generated in step S7 or step S8 to update the historical permission data according to the default permission list. The updating is, for example, storing the current default permission list as the latest historical permission list in the historical permission data.

In particular, the manager side can be divided into classes, including the primary manager side and the advanced manager side, wherein the primary manager side only has the authority to operate the checking device 10 to adjust the default authority list, and the advanced manager side In addition to adjusting the default authority list, the administrator can also set rules for adjusting the default authority list, such as the aforementioned first to third error ratios. Based on the judgment in step S6, the checking device 10 can confirm whether there is an abuse of power in which the primary administrator fails to modify the usage authority according to the rules.

It should be particularly noted here that the above steps S6-S9 may constitute a management quality judgment program, which is a program that is selectively executed. In one embodiment, the automatic checking method may include steps S1-S5 but not steps S6-S9. In this embodiment, when the determination result of step S4 is yes, the processing module 16 does not act, or outputs a normal notification through the output element.

In addition, before the processing module 16 judges that the actual permission list does not match the preset permission list and outputs an abnormal notification (step S5), the processing module 16 may further perform another judgment step to confirm whether the tampering is malicious or non-malicious. Please refer to FIGS. 1 , 2 and 4 together, wherein FIG. 4 is a partial flowchart of an automatic checking method according to another embodiment of the present invention. As shown in FIG. 4 , before performing step S5 , the processing module 16 may perform step S10 : determine whether the actual authority list that does not conform to the default authority list has no data. When the judgment result is yes, the processing module 16 transmits the predetermined permission list to the inspected device corresponding to the actual permission list that does not conform to the default permission list, so as to update the actual permission list, and then executes step S5 to output an abnormal notification. When the determination result is negative, the processing module 16 executes step S5 to output an abnormality notification. Wherein, the warning level indicated by the abnormality notification corresponding to the judgment result of step S5 can be preset to be lower than the warning level indicated by the abnormality notification corresponding to the judgment result of No. Furthermore, if the judgment result of step S5 is yes (that is, there is no data in the actual permission list that does not conform to the default permission list), it may be caused by a non-malicious deletion action on the user side, so the corresponding exception notification indicated The alert level can be set to be low.

In view of the above, the automatic check method and device for file folder authority of the present invention can automatically check the use authority of each shared file folder according to the personnel access authorization list provided by each unit, and at the same time determine whether the authorization list has occurred. Data abnormalities are automatically checked and updated, effectively accelerating the operational efficiency of enterprises.

Although the present invention is disclosed by the aforementioned embodiments, they are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, all changes and modifications are within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the appended scope of patent application.

10: Checking device

12: Storage module

122: Default permission list

124: Historical authority data

14: Communication module

16: Processing module

2: The tested device

22: List of actual permissions

S1~S11: Steps

S61~S63: sub-steps

FIG. 1 is a functional block diagram of an automatic checking device and a tested device according to an embodiment of the present invention. FIG. 2 is a flowchart of an automatic checking method according to an embodiment of the present invention. FIG. 3 is a partial flowchart of an automatic checking method according to an embodiment of the present invention. FIG. 4 is a partial flowchart of an automatic checking method according to another embodiment of the present invention.

S1~S9: steps

Claims (6)

An automatic checking method, including executing with a checking device: periodically updating a default permission list; after updating the default permission list, sending the default permission list to a plurality of checked devices to update the checked devices Multiple actual permission lists of multiple shared folders of the inspected device, wherein there is a one-to-one relationship between the checked devices, the shared folders, and the actual permission lists; periodically obtain the actual permissions list; and when any one of the actual authority lists does not conform to the default authority list, output an exception notification; when each of the actual authority lists conforms to the default authority list, execute a management quality judgment procedure, The management quality judgment procedure includes: judging whether each of the actual authority lists conforms to a historical authority data; when any one of the actual authority lists does not conform to the historical authority data, output another abnormal notification and generate a completion signal ; and when each of the actual permission lists matches the historical permission data, generate the completion signal; and be triggered by the completion signal to update the historical permission data according to the default permission list, wherein the historical permission data includes a first history A permission list, a second historical permission list and a third historical permission list, and judging whether each of these actual permission lists conforms to the historical permission data includes: For each of the actual authority lists, execute three judging sub-steps, wherein the three judging sub-steps include: judging whether the difference ratio between the actual authority list and the first historical authority list is less than a first error ratio; judging whether the difference ratio between the actual permission list and the second historical permission list is smaller than a second error ratio; and judging whether the difference ratio between the actual permission list and the third historical permission list is smaller than a third error ratio ; and wherein when the judgment result of any of the judging sub-steps for a target permission list in the actual permission lists is no, the target permission list does not conform to the historical permission data. The automatic checking method as described in claim 1, wherein the first to third historical permission lists correspond to the default permission list before the latest one to three updates of the historical permission data respectively, and the first error ratio is less than or equal to the a second error ratio, and the second error ratio is less than or equal to the third error ratio. The automatic checking method as described in claim 1 further includes: before outputting the abnormal notification, using the checking device to execute: judging whether a target permission list that does not conform to the default permission list in the actual permission lists has no information; and when there is no information in the target authorization list, sending the default authorization list to the detected device corresponding to the target authorization list among the inspected devices, so as to update the target authorization list. An automatic checking device, suitable for checking a plurality of checked devices, the automatic checking device includes: a storage module, storing a preset authority list; a communication module; and a processing module, connected to the storage module and the communication module, the processing module is used to execute: periodically update a default permission list; after updating the default permission list, send the default permission list to the recipients through the communication module Checked devices to update multiple actual permission lists of multiple shared folders of the checked devices, wherein there is a one-to-one relationship between the checked devices, the shared folders, and the actual permission lists; Obtain the actual authority lists periodically through the communication module; and when any of the actual authority lists does not match the default authority list, output an exception notification When setting the authority list, execute a management quality judgment procedure, the management quality judgment procedure includes: judging whether each of the actual authority lists conforms to a historical authority data; when any one of the actual authority lists does not conform to the historical authority data when , outputting another exception notification and generating a completion signal; and generating the completion signal when each of the actual authority lists matches the historical authority data; and Triggered by the completion signal to update the historical authority data according to the default authority list, wherein the historical authority data includes a first historical authority list, a second historical authority list and a third historical authority list, the processing module The execution of judging whether the actual authority lists are consistent with the historical authority data includes: judging whether the difference ratio between the actual authority list and the first historical authority list is less than a first error ratio; judging whether the actual authority list and the first historical authority list Whether the difference ratio between the two historical permission lists is less than a second error ratio; and judging whether the difference ratio between the actual permission list and the third historical permission list is smaller than a third error ratio; When the judgment result of any of the judging sub-steps of a target permission list in the permission list is negative, the target permission list does not conform to the historical permission data. The verification device as described in claim 4, wherein the first to third historical permission lists correspond to the default permission list before the last one to three updates of the historical permission data respectively, and the first error ratio is less than or equal to the first error ratio Two error ratios, and the second error ratio is less than or equal to the third error ratio. The verification device as described in claim 4, wherein the processing module is further configured to: before outputting the abnormal notification, execute: judging whether a target authority list that does not conform to the default authority list in the actual authority lists has no data ;as well as When the target permission list has no information, the default permission list is sent to the checked device corresponding to the target permission list among the checked devices, so as to update the target authorization list.

Images