WO2009024037A1

WO2009024037A1 - Method for generating and adjusting authority limit relation data and managing system thereof

Info

Publication number: WO2009024037A1
Application number: PCT/CN2008/071263
Authority: WO
Inventors: Wei Zhang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-08-23
Filing date: 2008-06-11
Publication date: 2009-02-26
Also published as: CN100563176C; CN101141297A

Abstract

A method for generating and adjusting authority limit relation data and a managing system thereof are disclosed. Some sub-levels are defined on each fixed-level. The command set with the higher main-level includes all commands in the command set with the main-level which is lower than the higher main-level. The command set with the higher sub-level includes all commands in the command set with the sub-level which is lower than the higher sub-level. Further, the group can be added under the sub-level. The commands between the command sets of group depending on the same sub-level are not overlapping. Further authority limit inheriting relationreduction table can be set.

Description

Method and management system for generating and adjusting authority relationship data

The present invention relates to the field of communications, and more particularly to a method and a management system for generating and adjusting privilege relationship data. Background technique

User authority is one of the important data of the computer system. The management of user rights mainly completes the control of the user accessing the device. Specifically: the device command is given the privilege attribute, and the user is given a certain privilege when logging in. The user can only execute the command that matches the privilege, so that the user's operation on the device is limited to a certain range.

In the prior art, there are various solutions for managing user rights, for example:

Some schemes have a total of 16 levels, and the device commands can be dynamically assigned to one of 16 levels, or the user's level. The relationship between 0 and 15 levels is from small to large. A high level command cannot be executed. In practical applications, commands are generally distributed by default to three levels of 16 levels, 0, 1, and 15.

Some schemes are implemented as commands that can belong to multiple types. Types can include multiple commands. Each user is given a type attribute when logging in. All commands in the type can be executed, and commands other than those cannot be executed.

Other schemes are implemented to distribute commands to four levels. The device's commands can be passively assigned to one of four levels, and the user's level can be specified. Relationships between levels 1 and 4, but commands that are higher than their own level cannot be executed.

The basic group permissions model implemented in Microsoft defines the basic administrator (admi nist ra tor ) , backup Opera tor s (backup operator), guest ( Gue sts ) and other basic command sets, the newly created group can contain one or more of these command sets, the user belongs to a certain Group, to achieve the user's authority authorization, the command set can not be flexibly subdivided, which has little to do with the PC command itself, and does not require more subdivision. Inter-group permissions are inclusive and side-by-side. Microsoft local also implements permission control based on a certain resource, mainly determined by its PC application scenario (persons monopolize certain resources on the device to complete some work, generally have nothing to do with other people's exclusive resources; at the same time have authorization for others The function, but the default is that other unrelated people have no permission); and the network devices generally work together in cooperation with each other, so the authorization is generally based on the command operation capability, and the control of resource access can be included through the filter pair. The execution of commands for certain resource names is restricted.

In the process of implementing the present invention, the inventors have found that the prior art has at least the following problems:

1. The subdivision permission is not flexible. In the case where the number of levels is determined, for example, the level is divided into 15 levels, of which level 15 is the highest level, and all the command sets are included, and at this time, a permission level is required, and the authority basically contains commands of 14 levels. More than 1 level 5, for this case, only some of the 15 levels of commands can be added to level 14, and this operation changes the original level 14 content, very inconvenient, and in the original 14 In the case where the level of content is not allowed to be adjusted, there is no room for permission to adjust and subdivide permissions. If the number of levels is allowed to increase or decrease, you can increase the number of levels to 16 levels. At this time, adjust the contents of the original 15 levels to level 16. Re-set the level 15 command set as needed, but this way, the command The amount of adjustment is large, especially when subdividing at a low level.

2. The authority relationship model is simple and complicated to maintain. For the command-level permission model, only the permission inclusion relationship between the levels is maintained, which makes it impossible to superimpose the user rights of the two levels. Because the permission model based on type definition has no inheritance relationship, the executable command sets between different users are difficult to support each other. Because the authorization of adding one command needs to change the type definition of two users, it is necessary to manually maintain the type 2 Permissions contain relationships. And Microsoft's basic group permission model can't flexibly subdivide permissions, only a few basic permissions contain combinations, and You cannot remove some of the useless permissions from the included group permissions. Summary of the invention

An object of the embodiments of the present invention is to provide a method and a management system for generating and adjusting privilege relationship data, so as to implement a more flexible privilege subdivision.

To achieve the above objective, an embodiment of the present invention provides a method for generating rights relation data, including the following steps:

Set the primary level, the sub-level, and the priority relationship between the levels, where the sub-level belongs to the main level;

Setting a command set, each main level and sub-level respectively corresponding to a command set; all commands are divided into command sets of each main level, wherein the command set with a high main level includes all commands in a command set lower than its main level ;

The commands in the command set of the main level are divided into sub-levels included in the main level, wherein the command set with a high sub-level includes all the commands in the command set lower than its sub-level.

The embodiment of the present invention further provides a method for adjusting the privilege relationship data, including: when the privilege subdivision adjustment is needed, determining a command set corresponding to the lowest main level among all the levels involved in the privilege subdivision adjustment, Adjust the command set corresponding to the sub-level and sub-level included in the main level.

The embodiment of the present invention further provides a privilege relationship data management system, including: a main level recording module, configured to record a priority relationship of a main level, and record a correspondence relationship between command sets of each main level and a main level;

a main level command set storage module, connected to the main level record module, for storing command sets of each main level;

The sub-level recording module is connected to the main level recording module, and is used to record the priority relationship of each sub-level corresponding to each main level, and record the correspondence between each sub-level and the main level and the command sets of each sub-level and sub-level relationship; A sub-level command collection storage module that stores a set of commands for each sub-level.

It can be seen from the above technical solutions that the embodiment of the present invention makes the permission subdivision more flexible by further dividing the sub-levels at the main level.

The technical solution of the present invention will be further described in detail below through the accompanying drawings and embodiments. DRAWINGS

1 is a flowchart of generating permission relationship data according to Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of a management system for authority relationship data according to Embodiment 3 of the present invention. detailed description

Embodiments of the present invention increase the flexibility of privilege subdivision by adding several sub-levels on a per fixed level basis. The command set with a high main level includes all commands in the command set lower than its main level; when the main level is the same, the command set with a high sub-level includes all commands in the command set lower than its sub-level. Further, groups can be added under the sub-level, and commands between command sets belonging to groups belonging to the same sub-level do not overlap.

The rights management model can be defined as follows:

The level identifier is defined as: Primary level identifier. Sub-level identifier; This level identifier uniquely identifies a sub-level.

In the case of further grouping, it can be defined as follows:

The level identifier is defined as: primary level identifier. sublevel identifier. group identifier; the level identifier is unique.

In order to better divide the command set, a permission inheritance relationship reduction table may be added, where the rights inheritance relationship reduction table includes a first relationship item and a second relationship item, where the first relationship item and the second relationship item are included. Write a group (specifically, the group can be uniquely determined by writing a level identifier), the sub-level or the main level of the group in the first relationship item is higher than the group in the second relationship item, and each first relationship item The group in the group corresponds to a group of one or more second relationship items, the first relationship item A group in a group cannot execute a command in a command set of a group of one or more second relationship items corresponding thereto.

The following is a specific example to further illustrate the privilege relationship model of the embodiment of the present invention. To simplify the description, only three main levels are taken as an example, and each sub-level is divided into two sub-levels and another sub-level is further divided. 2 groups, where the level of high-low relationship (priority relationship) is arranged by number, the order involved is 12 (a - 1), as shown in the following table:

In the above table, the content in parentheses is the command contained in the command set corresponding to the main level, sub-level, or group.

In practical applications, the level representation should include the complete master level, sublevels, and groups.

When the corresponding position of the group is 0, it means the command set containing the entire sub-level, for example: 3. 2. 0 The corresponding command set is ( a - 1).

The command set corresponding to the main level or the sub-level of the high level contains the command set corresponding to the main level or the sub-level of the lower level, for example: Group 3. The command set corresponding to the group contains the group 2. 2. 0, group 2. 1 . 0 corresponds to the set of commands. Command sets between groups belonging to the same sub-level do not overlap, for example: 3. 1. 2 and 3. 1. The command set between 1. 1 does not overlap. Further, the permission inheritance relationship reduction table can be set, as shown in the following table:

The information contained in Table 2 is: The command in the command set corresponding to the group 1.1.2 is removed from the command set corresponding to the group 3.1.2, in the command set corresponding to the group 3.1.1. Remove the commands in the command set corresponding to group 1. 1. 1.

When a user is assigned a level of 3.1.2, the set of commands that can be executed is (a - f), and because there is a permission inheritance relationship reduction table, the set of commands that can be executed is (cf), By setting the permission inheritance relationship reduction table, you can assign permissions more flexibly.

For a networked device, the privilege level of each device in the network is generally assigned by the primary server in the network or obtained from the primary server (for example: verifying the privilege level downloaded by the server), but for a specific device In this case, you cannot flexibly assign permissions based on actual needs. For the above situation, you can establish a mapping relationship between the external privilege level and the internal privilege level in each network device, and uniformly assign the privilege level (that is, external privilege) to the primary server in the network. Level) Map to the permission level (that is, the internal permission level) set by each network device according to its needs.

For example, the primary server in the network can only be assigned a privilege level of 1 - 15 and a network device is assigned a level of 4 . By establishing a mapping relationship in the device, the external level 4 is mapped to the internal level 3. 1. 1. When the usage requirements of the device change, modify the mapping relationship and re-establish the mapping with the internal level.

Embodiment 1

The following describes the process of generating the privilege relationship data. As shown in Figure 1, the following steps are included: Step 1. Set the primary level, sub-level, and priority relationship between the levels, where the sub-level belongs to the main level;

Step 2: Setting a command set, each main level and sub-level respectively corresponding to a command set; Step 3, dividing all commands into command sets of each main level, where the main level The high command set includes all the commands in the command set lower than its main level; Step 4, the commands in the command set of the main level are divided into sub-levels included in the main level, where the sub-level high command set Includes all commands in the command set that are lower than their child level.

Step 5: Set a command set corresponding to the group and the group, and divide the command in the command set of the sub-level into a command set of the group, where the group belongs to the sub-level and belongs to a group of the same sub-level The commands between the command collections do not overlap.

Step 6: Set a rights inheritance relationship reduction table, where the rights inheritance relationship reduction table includes a first relationship item and a second relationship item, and write the group in the first relationship item and the second relationship item, where the first The sub-level or main level of the group in the relationship item is higher than the group in the second relationship item, and the group in each first relationship item corresponds to one of the one or more second relationship items, the first relationship A group in an item cannot execute a command in a command set of a group of one or more second relationship items corresponding thereto.

Steps 5 and 6 above are based on actual needs, that is, you can set only the primary level and the child level, or you can set only the primary level, sub-level, and group, or set the primary level, sub-level, group, and permission inheritance relationship reduction table.

In addition, if the application rights relational data device is a networking device, the mapping relationship between the external permission level and the internal permission level may be further set, that is, the mapping relationship between the external permission level of the device and the primary level or sub-level or group is established.

Embodiment 2

After the permission data is created, the data can be adjusted according to the actual needs. The following describes the process of adjusting the permission relationship data, including the following steps:

When the permission subdivision adjustment is required, the command set corresponding to the lowest level of the main level including all the commands involved in the permission subdivision adjustment is determined, and the command set corresponding to the sub level and the sub level included in the main level is adjusted.

The adjusting the command set corresponding to the sub-level and the sub-level included in the main level may be Specifically, the command included in the command set of the original sub-levels is kept unchanged, and a command set including all the commands involved in the permission subdivision adjustment is added, and each sub-level is reset according to the inclusion relationship between the command sets. The order of the high and low.

The foregoing adjustment process may further include: an operation of adjusting a group included in the sub-level and a command in a command set corresponding to each group. The operation may be specifically: adding or subtracting a group, re-dividing the corresponding command set of each group; or maintaining the number of groups unchanged, and re-dividing the corresponding command set of each group.

The foregoing adjustment process may further include: modifying an operation of the rights inheritance relationship reduction table, where the rights inheritance relationship reduction table includes a first relationship item and a second relationship item, where the first relationship item and the second relationship item are included Write a group, the sub-level or the main level of the group in the first relationship item is higher than the group in the second relationship item, and the group in each first relationship item corresponds to one or more second relationship items The group of the first relationship item cannot execute a command in the command set of the group of the one or more second relationship items corresponding thereto.

For a networked device, the method further includes: modifying an operation of mapping the external authority of the device to the primary level or sub-level or group.

Embodiment 3

As shown in FIG. 2, it is a schematic diagram of a rights relationship data management system according to Embodiment 3 of the present invention, which includes:

The primary level recording module 1 is configured to record the priority relationship of the primary level, and record the correspondence between the command sets of the main level and the main level;

The main level command set storage module 2 is connected to the main level record module, and is configured to store a command set of each main level;

The sub-level recording module 3 is connected to the main level recording module, and is used for recording the priority relationship of each sub-level corresponding to each main level, and recording the corresponding relationship between the sub-level and the sub-level command set;

The sub-level command set storage module 4 is configured to store a command set of each sub-level. The system can further include:

a group recording module 5, connected to the sub-level recording module, for recording a corresponding group of each sub-level;

The group command collection storage module 6 is connected to the group record module and is used to store a set of commands of each group.

The system can further include:

The permission inheritance relationship reduction module 7 is connected to the main level record module and/or the child level record module and/or the group record module, and is configured to store a rights inheritance relationship cut table, where the rights inheritance relationship cut table includes the first relationship And a second relationship item, the group is written in the first relationship item and the second relationship item, and a sub-level or a main level of the group in the first relationship item is higher than a group in the second relationship item And the group in each of the first relationship items corresponds to the group of the one or more second relationship items, and the group in the first relationship item cannot execute the command of the group of the one or more second relationship items corresponding thereto The commands in the collection.

The system can further include:

The mapping relationship module 8 is connected to the main level recording module and/or the sub-level recording module and/or the group recording module, and is used for recording a mapping relationship between the external authority of the device and the main level or sub-level or group.

The permission data model and the permission relationship data generation method and the adjustment relationship data management system provided by the embodiment of the invention make the authority adjustment more convenient, the authority subdivision more flexible, and the authority maintenance function more powerful:

By introducing sub-levels, the amount of command adjustments during privilege adjustment is reduced. When privilege adjustment is made, it is possible to adjust a few commands to be adjusted at the same level of sub-levels, without adjusting most commands to a lower level, or increasing The number of levels, and the entire level order and command set are adjusted, reducing the number of command adjustments.

By introducing a group to increase mutual exclusion rights management, it is possible to make two user rights without crossover. By introducing a permission relationship to inherit the cut table, mutual exclusion between high and low level rights is achieved. Flexible with other device rights management schemes by establishing a mapping relationship with external privilege levels. For example, when the license attribute definitions of various vendors are incompatible, the 15th level of some schemes is the highest level, and the others of the 3rd level are the highest level. When a server is used to authorize users in a common network, the existing technology is used. The above problem cannot be solved, so that the level definition cannot be correctly understood by the two systems at the same time, and the above-mentioned problem can be flexibly solved by using the mapping mechanism of the external privilege level and the internal privilege level in the embodiment of the present invention.

It should be noted that the above embodiments are only intended to illustrate the technical solutions of the present invention and are not to be construed as limiting the embodiments of the present invention. The technical solutions of the present invention may be modified or equivalently substituted, and the modified technical solutions may not deviate from the spirit and scope of the technical solutions of the present invention.

Claims

Claim

A method for generating a privilege relationship data, comprising:

Set the primary level, the child level, and the priority relationship between the levels, where the child level is subordinate to the primary level;

Setting a command set, each main level and sub level respectively corresponding to a command set;

All commands are divided into command sets of each main level, where the command set with a high main level includes all commands in the command set lower than its main level;

The commands in the command set of the main level are divided into sub-levels included in the main level, wherein the command set with a high sub-level includes all the commands in the command set lower than the sub-level.

2. The method according to claim 1, further comprising:

Setting a command set corresponding to the group and the group, and dividing the command in the command set of the sub-level into the command set of the group, the group being subordinate to the sub-level, and the command set belonging to the group belonging to the same sub-level The commands between the two do not overlap.

3. The method according to claim 2, further comprising:

Setting a rights inheritance relationship reduction table, where the rights inheritance relationship reduction table includes a first relationship item and a second relationship item, and writing a group in the first relationship item and the second relationship item, where the first relationship item is included The sub-level or main level of the group is higher than the group in the second relationship item, and the group in each first relationship item corresponds to one of the one or more second relationship items, in the first relationship item A group cannot execute a command in a command set of a group of one or more second relationship items corresponding thereto.

The method according to claim 1 or 2 or 3, further comprising: establishing a mapping relationship between the external authority level of the device and the primary level or sub-level or group.

A method for adjusting the authority relationship data, wherein when the permission subdivision adjustment is needed, determining a command set corresponding to the lowest main level among all the levels involved in the permission subdivision adjustment, and adjusting the main The set of commands corresponding to the sublevels and sublevels included in the level.

The method according to claim 5, wherein the adjusting the command set corresponding to the sub-level and the sub-level included in the main level comprises: The command set of the original sub-levels is kept unchanged, and a command set including all the commands involved in the permission subdivision adjustment is added, and the order of each sub-level is reset according to the inclusion relationship between the command sets.

The method according to claim 5 or 6, further comprising: adjusting a group included in the sub-level and a command set corresponding to each group.

The method according to claim 7, wherein the adjusting the commands in the group and the command set corresponding to each group in the sub-level includes:

Increase or decrease the group, and re-divide the corresponding command set of each group; or keep the number of groups unchanged, and re-divide the corresponding command set of each group.

The method according to claim 5 or 6, further comprising: modifying a rights inheritance relationship reduction table, where the rights inheritance relationship reduction table includes a first relationship item and a second relationship item, Writing a group in a relationship item and a second relationship item, wherein a sub-level or a main level of the group in the first relationship item is higher than a group in the second relationship item, and the group in each first relationship item corresponds to A group of one or more second relationship items, the group of the first relationship items being unable to execute a command in a command set of the group of the one or more second relationship items corresponding thereto.

10. The method according to claim 7, further comprising: modifying an operation of the rights inheritance relationship reduction table.

1 1. The method according to claim 5 or 6, further comprising: an operation of modifying a mapping relationship between the external authority of the device and the primary level or sub-level or group.

12. A rights relationship data management system, comprising:

The main level recording module is configured to record the priority relationship of the main level, and record the correspondence between the command sets of the main level and the main level;

a main level command set storage module, connected to the main level record module, for storing a command set of each main level;

a sub-level recording module is connected to the main-level recording module, and is configured to record a priority relationship of each sub-level corresponding to each main level, and record a correspondence between each sub-level and a sub-level command set; A sub-level command collection storage module that stores a set of commands for each sub-level.

The system according to claim 12, further comprising:

The group record module is connected to the sub-level record module for recording a corresponding group of each sub-level; the group command set storage module is connected to the group record module for storing a command set of each group.

14. The system according to claim 13, further comprising:

The permission inheritance relationship reduction module is connected to the main level record module and/or the child level record module and/or the group record module, and is configured to store a rights inheritance relationship cut table, where the rights inheritance relationship cut table includes the first relationship item And a second relationship item, the group is written in the first relationship item and the second relationship item, and a sub-level or a main level of the group in the first relationship item is higher than a group in the second relationship item, a group in each first relationship item corresponds to a group of one or more second relationship items, and a group in the first relationship item cannot execute a command of a group of one or more second relationship items corresponding thereto The commands in the collection.

The system according to claim 12, 13 or 14, further comprising: a mapping relationship module, connected to the main level recording module and/or the sub-level recording module and/or the group recording module, The mapping relationship between the external authority of the device and the primary level or sub-level or group.