WO2013063944A1 - 权限管理方法、系统及计算机存储介质 - Google Patents

权限管理方法、系统及计算机存储介质 Download PDF

Info

Publication number
WO2013063944A1
WO2013063944A1 PCT/CN2012/077634 CN2012077634W WO2013063944A1 WO 2013063944 A1 WO2013063944 A1 WO 2013063944A1 CN 2012077634 W CN2012077634 W CN 2012077634W WO 2013063944 A1 WO2013063944 A1 WO 2013063944A1
Authority
WO
WIPO (PCT)
Prior art keywords
group number
information
operation object
processing result
subject
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2012/077634
Other languages
English (en)
French (fr)
Inventor
王宇
王斌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Publication of WO2013063944A1 publication Critical patent/WO2013063944A1/zh
Priority to US14/078,985 priority Critical patent/US20140068760A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems

Definitions

  • the present invention relates to rights management, and in particular, to a rights management method, system, and computer storage medium.
  • the traditional active defense system is for the entire Windows Various resources (mainly system resources, registry, process, network four resources) to a certain degree of control, the main role is to create a dynamic simulation anti-virus system, automatically and accurately determine new viruses, program behavior monitoring and Reporting, automatic extraction of feature values for multiple protection, and visual display of monitoring information.
  • Various resources mainly system resources, registry, process, network four resources
  • a method for managing rights including the following steps:
  • a corresponding operation is performed according to the processing result.
  • a rights management system comprising:
  • a query module configured to query from the pre-created permission table according to the operation request, and return a corresponding processing result
  • An execution module is configured to perform a corresponding operation according to the processing result.
  • One or more computer storage media containing computer executable instructions for performing a rights management method, the method comprising the steps of:
  • a corresponding operation is performed according to the processing result.
  • the foregoing rights management method, system and computer storage medium query and obtain corresponding processing results from the pre-created permission table according to the operation request, perform corresponding operations according to the processing result, and do not need to classify and manage various resources and various operations.
  • the use of unified management reduces the complexity of rights management and improves the convenience of management.
  • 1 is a flow chart of a method for managing rights in an embodiment
  • FIG. 3 is a specific flowchart of the step of querying from the pre-created permission table according to the operation request in FIG. 1 and returning the corresponding processing result;
  • FIG. 4 is a schematic structural diagram of a rights management system in an embodiment
  • FIG. 5 is a schematic structural diagram of a rights management system in another embodiment
  • FIG. 6 is a schematic diagram showing the internal structure of a module created in an embodiment
  • FIG. 7 is a schematic diagram showing the internal structure of a query module in an embodiment.
  • the active defense system can be abstracted into a kind of management of rights.
  • file management the active defense system needs to pay attention to the modification or deletion of the system core file or the user-defined core file.
  • This operation can be abstracted as an operation performed by the operating body on the operating object. If a process performs a delete operation on a file, the operation subject is a process, the operation object is a file, and the operation mode is deletion.
  • the present invention is mainly used for rights management in an active defense system, but is not limited thereto.
  • a rights management method includes the following steps:
  • Step S110 obtaining an operation request.
  • a third-party software When a third-party software operates on a system file, a registry, a process, or the like in a computer, an operation request is issued to obtain the operation request.
  • the third-party software can be a normal functional software or a malicious program virus.
  • the active defense system intercepts the operation request of the third-party software and queries its operation authority to interfere with the operation.
  • Step S120 querying from the pre-created permission table according to the operation request, and returning a corresponding processing result.
  • the returned processing result can be to release, block, or ask the user.
  • Release means that the operation is allowed to be performed, and blocking means that the operation is prevented from being performed, and asking the user means that the user selects whether to perform the operation. For example, if the operation request is to delete the system core file, if the processing result is release, the system core file is deleted; if the processing result is blocked, the system core file is not deleted; if the processing result is a query user, the user is prompted, by the user Determine if the system core file is deleted.
  • Step S130 performing a corresponding operation according to the processing result.
  • the foregoing rights management method includes the steps of: creating a permission table in advance. As shown in Figure 2, the steps of creating a permission table in advance are as follows:
  • step S210 the operation subject is classified, and the operation subject group number is assigned.
  • the operating subjects are classified according to pre-standards. For example, the process is performed on a file or the registry is implemented.
  • the operation subject is a process
  • the operation object is a file or a registry
  • the operation mode is deletion or modification.
  • the process is classified according to the process path, and the operation subject group number is assigned.
  • step S220 the operation object is classified, and the operation object group number is assigned.
  • the operation object is a file
  • the files are classified according to the file path, and the operation object group number is assigned.
  • the operation object is a virus file, it can be classified according to the parent process of the virus, the size of the virus, or the file type, and then the operation object group number is assigned.
  • Step S230 the permission item is formed according to the operation body group number, the operation object group number, and the corresponding operation mode, and the corresponding processing result is obtained.
  • An operation subject group number, an operation object group number, and a corresponding operation mode constitute a permission item.
  • Each permission item corresponds to the corresponding processing result, that is, release, block or ask the user.
  • Step S240 creating a permission table, and storing the permission item and the corresponding processing result in the permission table.
  • the permission item and the corresponding processing result are stored as a record in the permission table.
  • the permission item includes the operation subject group number, the operation object group number, and the operation mode, and can be stored in the form of three-dimensional coordinates.
  • the grouping number of the main body can be operated as the X axis
  • the grouping number of the operation object is the Y axis
  • the operation mode is the Z axis.
  • the operation request includes operation subject information, operation object information, and operation mode information.
  • the operation subject information may include at least one of an operation subject name, an operation subject path, and the like.
  • the operation object information may include at least one of an operation object name, an operation object path, and the like.
  • the operation mode information may include at least one of deletion, modification, creation, and the like.
  • step S120 is specifically:
  • Step S310 calculating a group according to the operation subject information, and obtaining a corresponding operation subject group number.
  • the matching operation subject name is searched from the permission table, thereby obtaining the corresponding operation subject group number.
  • the hash value of the operation subject information may also be calculated, and the hash value of the operation subject information is matched with the hash value of the operation subject in the permission table to obtain the operation subject group number.
  • Step S320 calculating a group according to the operation object information, and obtaining a corresponding operation object group number.
  • the matching operation object name is searched from the permission table, thereby obtaining the corresponding operation object group number.
  • the hash value of the operation object information may also be calculated, and the hash value of the operation object information is matched with the hash value of the operation object in the permission table to obtain the operation subject group number.
  • Step S330 searching for the corresponding processing result according to the obtained operation subject group number, the operation object group number, and the operation mode information.
  • Obtaining the operation subject group number, the operation object group number, and the operation mode information can find the corresponding processing result from the three-dimensional coordinates of the permission table.
  • the permission table adopts a three-dimensional coordinate form.
  • the dimension of the permission item in the permission table may be two-dimensional, four-dimensional, or the like.
  • a process creates a new file, which is the operation subject.
  • the new file is the operation object.
  • the process can be determined according to two dimensions. No need to monitor when creating files.
  • the present invention also provides one or more computer storage media containing computer executable instructions for performing a rights management method, computer executable instructions in a computer storage medium executing a rights management method
  • the specific steps are as described in the above method, and are not described herein again.
  • a rights management system includes a request acquisition module 410, a query module 420, and an execution module 430. among them,
  • the request acquisition module 410 is configured to obtain an operation request.
  • the third-party software operates the system file, the registry, the process, and the like in the computer, an operation request is issued, and the request obtaining module 410 obtains the operation request.
  • the third-party software can be a normal functional software or a malicious program virus.
  • the active defense system intercepts the operation request of the third-party software and queries its operation authority to interfere with the operation.
  • the query module 420 is configured to query from the pre-created permission table according to the operation request, and return a corresponding processing result.
  • the returned processing result can be to release, block, or ask the user.
  • Release means that the operation is allowed to be performed, and blocking means that the operation is prevented from being performed, and asking the user means that the user selects whether to perform the operation. For example, if the operation request is to delete the system core file, if the processing result is release, the system core file is deleted; if the processing result is blocked, the system core file is not deleted; if the processing result is a query user, the user is prompted, by the user Determine if the system core file is deleted.
  • the execution module 430 is configured to perform a corresponding operation according to the processing result.
  • a rights management system includes a request acquisition module 410, a query module 420, and an execution module 430, and a creation module 440 for pre-creating a permission table.
  • the creation module 440 includes an operation body classifier 441, an operation object classifier 443, a construction unit 445, and a creation unit 447. among them,
  • the operation body classifier 441 is for classifying the operation body and assigning the operation body group number.
  • the operation subject classifier 441 classifies the operation subjects in accordance with a predetermined standard. For example, the process is performed on a file or the registry is implemented.
  • the operation subject is a process, the operation object is a file or a registry, and the operation mode is deletion or modification.
  • the process is classified according to the process path, and the operation subject group number is assigned.
  • the operation object classifier 443 is for classifying the operation object and assigning the operation object group number. If the operation object is a file, the operation object classifier 443 classifies the file according to the file path and assigns the operation object group number. If the operation object is a virus file, the operation object classifier 443 may classify according to the parent process of the virus, the size of the virus, or the file type, and then assign the operation object group number.
  • the construction unit 445 is configured to form a permission item according to the operation body group number, the operation object group number, and the corresponding operation mode, and obtain corresponding processing results.
  • An operation subject group number, an operation object group number, and a corresponding operation mode constitute a permission item.
  • Each permission item corresponds to the corresponding processing result, that is, release, block or ask the user.
  • the creating unit 447 is used to create a permission table, and stores the permission item and the corresponding processing result in the permission table.
  • the creating unit 447 stores the permission item and the corresponding processing result as a record in the permission table.
  • the permission item includes the operation subject group number, the operation object group number, and the operation mode, and can be stored in the form of three-dimensional coordinates.
  • the grouping number of the main body can be operated as the X axis
  • the grouping number of the operation object is the Y axis
  • the operation mode is the Z axis.
  • the operation request includes operation subject information, operation object information, and operation mode information.
  • the operation subject information may include at least one of an operation subject name, an operation subject path, and the like.
  • the operation object information may include at least one of an operation object name, an operation object path, and the like.
  • the operation mode information may include at least one of deletion, modification, creation, and the like.
  • the query module 420 includes an operation body grouping unit 421, an operation object grouping unit 423, and a query unit 425.
  • the operation body grouping unit 421 is configured to calculate a group according to the operation body information to obtain a corresponding operation body group number.
  • the operation body grouping unit 421 may search for the matching operation body name from the authority table according to the operation body name in the operation body information, thereby obtaining the corresponding operation body group number; and calculating the hash value of the operation body information, and operating the body
  • the hash value of the information is matched with the hash value of the operation body in the permission table, and the operation subject group number is obtained.
  • the operation object grouping unit 423 is configured to calculate a grouping thereof based on the operation object information, and obtain a corresponding operation object group number.
  • the operation object grouping unit 423 can search for the matching operation object name from the permission table according to the operation object name in the operation object information, thereby obtaining the corresponding operation object group number; and calculating the hash value of the operation object information, and operating the operation object information
  • the hash value of the object information is matched with the hash value of the operation object in the permission table, and the operation subject group number is obtained.
  • the query unit 425 is configured to find a corresponding processing result according to the obtained operation body group number, the operation object group number, and the operation mode information. Obtaining the operation subject group number, the operation object group number, and the operation mode information can find the corresponding processing result from the three-dimensional coordinates of the permission table.
  • the foregoing rights management method, system and computer storage medium query and obtain corresponding processing results from the pre-created permission table according to the operation request, perform corresponding operations according to the processing result, and do not need to classify and manage various resources and various operations.
  • the use of unified management reduces the complexity of rights management and improves the convenience of management.
  • the grouping number of the operating entity and the grouping number of the operation object are allocated to facilitate unified management; the hash value of the computing operation body information and the operation object information is used to determine the corresponding group number, which is accurate and simple.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Automation & Control Theory (AREA)
  • Storage Device Security (AREA)

Abstract

本发明涉及一种权限管理方法、系统及计算机存储介质。该权限管理方法包括以下步骤：获取操作请求；根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；根据所述处理结果执行相应的操作。上述权限管理方法、系统及计算机存储介质，根据操作请求从预先创建的权限表中查询得到相应的处理结果，根据该处理结果执行相应的操作，不需针对各种资源、各种操作进行分类管理，采用统一管理，降低了权限管理的复杂度，提高了管理的便捷性。

Description

权限管理方法、系统及计算机存储介质
本申请要求于 2011 年 10 月 31 日提交中国专利局、申请号为 2011103376249 、发明名称为 ' 权限管理方法及系统 ' 的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
【技术领域】
本发明涉及权限管理，特别涉及一种权限管理方法、系统及计算机存储介质。
【背景技术】
传统的主动防御系统是对整个 Windows 的各种资源（主要是系统的文件、注册表、进程、网络这四种资源）进行某种程度的控制，主要作用有创立动态仿真反病毒系统，自动准确判定新病毒，程序行为的监控并举报，自动提取特征值实现多重防护，以及可视化显示监控信息等。
然而，传统的主动防御系统在对整个系统的权限管理上存在分类过多，管理不统一等情况，导致权限管理复杂度高，管理不方便。
【发明内容】
基于此，有必要提供一种权限管理方法，能降低权限管理的复杂度，提高管理的便捷性。
一种权限管理方法，包括以下步骤：
获取操作请求；
根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
根据所述处理结果执行相应的操作。
此外，还有必要提供一种权限管理系统，能降低权限管理的复杂度，提高管理的便捷性。
一种权限管理系统，包括：
请求获取模块，用于获取操作请求；
查询模块，用于根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
执行模块，用于根据所述处理结果执行相应的操作。
此外，还有必要提供一种计算机存储介质。
一个或多个包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行一种权限管理方法，所述方法包括以下步骤：
获取操作请求；
根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
根据所述处理结果执行相应的操作。
上述权限管理方法、系统及计算机存储介质，根据操作请求从预先创建的权限表中查询得到相应的处理结果，根据该处理结果执行相应的操作，不需针对各种资源、各种操作进行分类管理，采用统一管理，降低了权限管理的复杂度，提高了管理的便捷性。
【附图说明】
图1为一个实施例中权限管理方法的流程图；
图2为一个实施例中预先创建权限表的具体流程图；
图3为图1中根据该操作请求从预先创建的权限表中查询，并返回相应的处理结果的步骤具体流程图；
图4为一个实施例中权限管理系统的结构示意图；
图5为另一个实施例中权限管理系统的结构示意图；
图6为一个实施例中创建模块的内部结构示意图；
图7为一个实施例中查询模块的内部结构示意图。
【具体实施方式】
下面结合具体的实施例及附图对权限管理方法及系统的技术方案进行详细的描述，以使其更加清楚。
首先说明，主动防御系统可抽象成一种对权限的管理。如文件管理，主动防御系统需关注系统核心文件或用户自定义的核心文件的修改、删除等操作。该操作可抽象为操作主体对操作对象实施的一种操作。如某进程对文件实施删除操作，操作主体为进程，操作对象为文件，操作方式为删除。本发明主要用于主动防御系统中的权限管理，但不限于此。
如图1所示，在一个实施例中，一种权限管理方法，包括以下步骤：
步骤S110，获取操作请求。
第三方软件对计算机中的系统文件、注册表、进程等进行操作时，会发出操作请求，获取到该操作请求。该第三方软件可为正常的功能软件，也可为恶意程序病毒等。主动防御系统对第三方软件的操作请求进行拦截，查询其操作权限，以便干涉操作。
步骤S120，根据该操作请求从预先创建的权限表中查询，并返回相应的处理结果。
返回的处理结果可为放行、阻止或询问用户。放行是指允许执行该操作，阻止是指阻止执行该操作，询问用户是指由用户选择是否执行该操作。例如，操作请求为删除系统核心文件，若处理结果为放行，则删除该系统核心文件；若处理结果为阻止，则不删除该系统核心文件；若处理结果为询问用户，则提示用户，由用户确定是否删除该系统核心文件。
步骤 S130 ，根据该处理结果执行相应的操作。
在一个实施例中，上述权限管理方法，包括步骤：预先创建权限表。如图2所示，预先创建权限表的步骤具体为：
步骤S210，对操作主体进行分类，并分配操作主体分组号。
将操作主体按照预先的标准进行分类。以进程对文件实施操作或对注册表实施操作为例，其中，操作主体为进程，操作对象为文件或注册表，操作方式为删除或修改等。按照进程路径对进程进行分类，并分配操作主体分组号。
步骤S220，对操作对象进行分类，并分配操作对象分组号。
若操作对象为文件，按照文件路径对文件进行分类，并分配操作对象分组号。若操作对象为病毒文件，可按照病毒的父进程、病毒的大小或文件类型进行分类，再分配操作对象分组号。
步骤S230，按操作主体分组号、操作对象分组号及相应的操作方式构成权限项，并得出相应的处理结果。
一个操作主体分组号、一个操作对象分组号及相应的操作方式构成一个权限项。每个权限项对应相应的处理结果，即放行、阻止或询问用户。
步骤S240，创建权限表，并将该权限项及相应的处理结果存储到该权限表中。
将权限项及相应的处理结果作为一条记录存储到该权限表中。权限项包括操作主体分组号、操作对象分组号及操作方式，可以三维坐标的形式存储。权限表中可以操作主体分组号为X轴、操作对象分组号为Y轴、操作方式为Z轴，三个坐标汇集的点得出相应的处理结果。
进一步的实施例中，操作请求中包括操作主体信息、操作对象信息及操作方式信息。操作主体信息可包括操作主体名称、操作主体路径等中至少一种。操作对象信息可包括操作对象名称、操作对象路径等中至少一种。操作方式信息可包括删除、修改、创建等中至少一种。
进一步的实施例中，参图3所示，步骤S120具体为：
步骤S310，根据操作主体信息计算其分组，得到相应的操作主体分组号。
可根据操作主体信息中的操作主体名称，从权限表中查找匹配的操作主体名称，从而得到相应的操作主体分组号。也可计算操作主体信息的哈希值，将操作主体信息的哈希值与权限表中操作主体的哈希值进行匹配，得到操作主体分组号。
步骤S320，根据操作对象信息计算其分组，得到相应的操作对象分组号。
可根据操作对象信息中的操作对象名称，从权限表中查找匹配的操作对象名称，从而得到相应的操作对象分组号。也可计算操作对象信息的哈希值，将操作对象信息的哈希值与权限表中操作对象的哈希值进行匹配，得到操作主体分组号。
步骤S330，根据得到的操作主体分组号、操作对象分组号及操作方式信息查找到相应的处理结果。
得到操作主体分组号、操作对象分组号及操作方式信息从权限表的三维坐标中可查找到对应的处理结果。
本实施例中权限表采用的是三维坐标形式，在其他实施例中，权限表中的权限项的维度可为二维、四维等。例如，在对文件生成监控的应用中，一个进程创建一个新文件，该进程为操作主体，作为第一个维度，该新文件为操作对象，作为第二个维度，根据两个维度可确定进程创建文件时，需不需进行监控。
此外，本发明还提供了一个或多个包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行一种权限管理方法，计算机存储介质中的计算机可执行指令执行权限管理方法的具体步骤如上述方法描述，在此不再赘述。
如图4所示，在一个实施例中，一种权限管理系统，包括请求获取模块410、查询模块420和执行模块430。其中，
请求获取模块410用于获取操作请求。第三方软件对计算机中的系统文件、注册表、进程等进行操作时，会发出操作请求，请求获取模块410获取到该操作请求。该第三方软件可为正常的功能软件，也可为恶意程序病毒等。主动防御系统对第三方软件的操作请求进行拦截，查询其操作权限，以便干涉操作。
查询模块420用于根据该操作请求从预先创建的权限表中查询，并返回相应的处理结果。返回的处理结果可为放行、阻止或询问用户。放行是指允许执行该操作，阻止是指阻止执行该操作，询问用户是指由用户选择是否执行该操作。例如，操作请求为删除系统核心文件，若处理结果为放行，则删除该系统核心文件；若处理结果为阻止，则不删除该系统核心文件；若处理结果为询问用户，则提示用户，由用户确定是否删除该系统核心文件。
执行模块430用于根据该处理结果执行相应的操作。
在一个实施例中，如图5所示，一种权限管理系统，包括请求获取模块410、查询模块420和执行模块430，还包括创建模块440，用于预先创建权限表。
进一步的实施例中，如图6所示，创建模块440包括操作主体分类器441、操作对象分类器443、构建单元445和创建单元447。其中，
操作主体分类器441用于对操作主体进行分类，并分配操作主体分组号。操作主体分类器441将操作主体按照预先的标准进行分类。以进程对文件实施操作或对注册表实施操作为例，其中，操作主体为进程，操作对象为文件或注册表，操作方式为删除或修改等。按照进程路径对进程进行分类，并分配操作主体分组号。
操作对象分类器443用于对操作对象进行分类，并分配操作对象分组号。若操作对象为文件，操作对象分类器443按照文件路径对文件进行分类，并分配操作对象分组号。若操作对象为病毒文件，操作对象分类器443可按照病毒的父进程、病毒的大小或文件类型进行分类，再分配操作对象分组号。
构建单元445用于按操作主体分组号、操作对象分组号及相应的操作方式构成权限项，，并得出相应的处理结果。一个操作主体分组号、一个操作对象分组号及相应的操作方式构成一个权限项。每个权限项对应相应的处理结果，即放行、阻止或询问用户。
创建单元447用于创建权限表，并将该权限项及相应的处理结果存储到权限表中。创建单元447将权限项及相应的处理结果作为一条记录存储到该权限表中。权限项包括操作主体分组号、操作对象分组号及操作方式，可以三维坐标的形式存储。权限表中可以操作主体分组号为X轴、操作对象分组号为Y轴、操作方式为Z轴，三个坐标汇集的点得出相应的处理结果。
进一步的实施例中，操作请求中包括操作主体信息、操作对象信息及操作方式信息。操作主体信息可包括操作主体名称、操作主体路径等中至少一种。操作对象信息可包括操作对象名称、操作对象路径等中至少一种。操作方式信息可包括删除、修改、创建等中至少一种。
进一步的实施例中，如图7所示，查询模块420包括操作主体分组单元421、操作对象分组单元423和查询单元425。
操作主体分组单元421用于根据操作主体信息计算其分组，得到相应的操作主体分组号。操作主体分组单元421可根据操作主体信息中的操作主体名称，从权限表中查找匹配的操作主体名称，从而得到相应的操作主体分组号；也可计算操作主体信息的哈希值，将操作主体信息的哈希值与权限表中操作主体的哈希值进行匹配，得到操作主体分组号。
操作对象分组单元423用于根据操作对象信息计算其分组，得到相应的操作对象分组号。操作对象分组单元423用可根据操作对象信息中的操作对象名称，从权限表中查找匹配的操作对象名称，从而得到相应的操作对象分组号；也可计算操作对象信息的哈希值，将操作对象信息的哈希值与权限表中操作对象的哈希值进行匹配，得到操作主体分组号。
查询单元425用于根据得到的操作主体分组号、操作对象分组号及操作方式信息查找到相应的处理结果。得到操作主体分组号、操作对象分组号及操作方式信息从权限表的三维坐标中可查找到对应的处理结果。
上述权限管理方法、系统及计算机存储介质，根据操作请求从预先创建的权限表中查询得到相应的处理结果，根据该处理结果执行相应的操作，不需针对各种资源、各种操作进行分类管理，采用统一管理，降低了权限管理的复杂度，提高了管理的便捷性。
另外，采用对操作主体分配分组号、操作对象分配分组号，方便进行统一管理；采用计算操作主体信息和操作对象信息的哈希值确定其相应的分组号，准确、简单。
以上所述实施例仅表达了本发明的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对本发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干变形和改进，这些都属于本发明的保护范围。因此，本发明专利的保护范围应以所附权利要求为准。

Claims (15)

  1. 一种权限管理方法，包括以下步骤：
    获取操作请求；
    根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
    根据所述处理结果执行相应的操作。
  2. 根据权利要求1所述的权限管理方法，其特征在于，还包括步骤：预先创建权限表；所述预先创建权限表的步骤具体为：
    对操作主体进行分类，并分配操作主体分组号；
    对操作对象进行分类，并分配操作对象分组号；
    按操作主体分组号、操作对象分组号及相应的操作方式构成权限项，并得出相应的处理结果；
    创建权限表，并将所述权限项及相应的处理结果存储到所述权限表中。
  3. 根据权利要求2所述的权限管理方法，其特征在于，所述操作请求中包括操作主体信息、操作对象信息及操作方式信息；
    根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果的步骤具体为：
    根据操作主体信息计算其分组，得到相应的操作主体分组号；
    根据操作对象信息计算其分组，得到相应的操作对象分组号；
    根据得到的操作主体分组号、操作对象分组号及操作方式信息查找到相应的处理结果。
  4. 根据权利要求3所述的权限管理方法，其特征在于，所述根据操作主体信息计算其分组，得到相应的操作主体分组号的步骤具体为：计算操作主体信息的哈希值，将操作主体信息的哈希值与权限表中操作主体的哈希值进行匹配，得到操作主体分组号；
    所述根据操作对象信息计算其分组，得到相应的操作对象分组号的步骤具体为：计算操作对象信息的哈希值，将操作对象信息的哈希值与权限表中操作对象的哈希值进行匹配，得到操作主体分组号。
  5. 根据权利要求1所述的权限管理方法，其特征在于，所述处理结果为放行、阻止或询问用户。
  6. 一种权限管理系统，其特征在于，包括：
    请求获取模块，用于获取操作请求；
    查询模块，用于根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
    执行模块，用于根据所述处理结果执行相应的操作。
  7. 根据权利要求6所述的权限管理系统，其特征在于，还包括创建模块，用于预先创建权限表；所述创建模块包括：
    操作主体分类器，用于对操作主体进行分类，并分配操作主体分组号；
    操作对象分类器，用于对操作对象进行分类，并分配操作对象分组号；
    构建单元，用于按操作主体分组号、操作对象分组号及相应的操作方式构成权限项，并得出相应的处理结果；
    创建单元，用于创建权限表，并将所述权限项及相应的处理结果存储到权限表中。
  8. 根据权利要求7所述的权限管理系统，其特征在于，所述操作请求中包括操作主体信息、操作对象信息及操作方式信息；
    所述查询模块包括：
    操作主体分组单元，用于根据操作主体信息计算其分组，得到相应的操作主体分组号；
    操作对象分组单元，用于根据操作对象信息计算其分组，得到相应的操作对象分组号；
    查询单元，用于根据得到的操作主体分组号、操作对象分组号及操作方式信息查找到相应的处理结果。
  9. 根据权利要求8所述的权限管理系统，其特征在于，所述操作主体分组单元还用于计算操作主体信息的哈希值，将操作主体信息的哈希值与权限表中操作主体的哈希值进行匹配，得到操作主体分组号；所述操作对象分组单元还用于计算操作对象信息的哈希值，将操作对象信息的哈希值与权限表中操作对象的哈希值进行匹配，得到操作主体分组号。
  10. 根据权利要求6所述的权限管理系统，其特征在于，所述处理结果为放行、阻止或询问用户。
  11. 一个或多个包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行一种权限管理方法，其特征在于，所述方法包括以下步骤：
    获取操作请求；
    根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果；
    根据所述处理结果执行相应的操作。
  12. 根据权利要求11所述的计算机存储介质，其特征在于，还包括步骤：预先创建权限表；所述预先创建权限表的步骤具体为：
    对操作主体进行分类，并分配操作主体分组号；
    对操作对象进行分类，并分配操作对象分组号；
    按操作主体分组号、操作对象分组号及相应的操作方式构成权限项，并得出相应的处理结果；
    创建权限表，并将所述权限项及相应的处理结果存储到所述权限表中。
  13. 根据权利要求12所述的计算机存储介质，其特征在于，所述操作请求中包括操作主体信息、操作对象信息及操作方式信息；
    根据所述操作请求从预先创建的权限表中查询，并返回相应的处理结果的步骤具体为：
    根据操作主体信息计算其分组，得到相应的操作主体分组号；
    根据操作对象信息计算其分组，得到相应的操作对象分组号；
    根据得到的操作主体分组号、操作对象分组号及操作方式信息查找到相应的处理结果。
  14. 根据权利要求13所述的计算机存储介质，其特征在于，所述根据操作主体信息计算其分组，得到相应的操作主体分组号的步骤具体为：计算操作主体信息的哈希值，将操作主体信息的哈希值与权限表中操作主体的哈希值进行匹配，得到操作主体分组号；
    所述根据操作对象信息计算其分组，得到相应的操作对象分组号的步骤具体为：计算操作对象信息的哈希值，将操作对象信息的哈希值与权限表中操作对象的哈希值进行匹配，得到操作主体分组号。
  15. 根据权利要求11所述的计算机存储介质，其特征在于，所述处理结果为放行、阻止或询问用户。
PCT/CN2012/077634 2011-10-31 2012-06-27 权限管理方法、系统及计算机存储介质 Ceased WO2013063944A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/078,985 US20140068760A1 (en) 2011-10-31 2013-11-13 Method, System and Computer Storage Medium for Rights Management

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110337624.9 2011-10-31
CN201110337624.9A CN103093140B (zh) 2011-10-31 2011-10-31 权限管理方法及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/078,985 Continuation US20140068760A1 (en) 2011-10-31 2013-11-13 Method, System and Computer Storage Medium for Rights Management

Publications (1)

Publication Number Publication Date
WO2013063944A1 true WO2013063944A1 (zh) 2013-05-10

Family

ID=48191270

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/077634 Ceased WO2013063944A1 (zh) 2011-10-31 2012-06-27 权限管理方法、系统及计算机存储介质

Country Status (3)

Country Link
US (1) US20140068760A1 (zh)
CN (1) CN103093140B (zh)
WO (1) WO2013063944A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104008142B (zh) * 2014-05-09 2017-06-06 北京航空航天大学 面向社交网络的数据保护方法及系统
CN111079126A (zh) * 2019-11-11 2020-04-28 重庆首厚智能科技研究院有限公司 一种基于hash算法的用户权限管理系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1485746A (zh) * 2002-09-27 2004-03-31 鸿富锦精密工业（深圳）有限公司 用户权限安全管理系统及方法
US7260831B1 (en) * 2002-04-25 2007-08-21 Sprint Communications Company L.P. Method and system for authorization and access to protected resources
CN101056175A (zh) * 2007-04-26 2007-10-17 华为技术有限公司 磁盘阵列及其访问权限控制方法与装置、服务器及服务器系统
CN101593260A (zh) * 2009-07-03 2009-12-02 杭州华三通信技术有限公司 一种管理系统权限的应用方法和装置
CN101847197A (zh) * 2009-03-24 2010-09-29 上海任登信息科技有限公司 一种文档访问权限的控制方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7331058B1 (en) * 1999-12-16 2008-02-12 International Business Machines Corporation Distributed data structures for authorization and access control for computing resources
US7613796B2 (en) * 2002-09-11 2009-11-03 Microsoft Corporation System and method for creating improved overlay network with an efficient distributed data structure
JP4368184B2 (ja) * 2003-11-19 2009-11-18 株式会社日立製作所 ブラックリストによる緊急アクセス遮断装置
JP4606052B2 (ja) * 2004-04-08 2011-01-05 株式会社リコー 情報処理装置、操作許否情報生成方法、操作許否情報生成プログラム及び記録媒体
CN101493872A (zh) * 2009-02-09 2009-07-29 汪金保 基于分类方法的细粒度权限管理方法
CN102164321A (zh) * 2011-05-30 2011-08-24 深圳市同洲电子股份有限公司 一种控制方法、设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7260831B1 (en) * 2002-04-25 2007-08-21 Sprint Communications Company L.P. Method and system for authorization and access to protected resources
CN1485746A (zh) * 2002-09-27 2004-03-31 鸿富锦精密工业（深圳）有限公司 用户权限安全管理系统及方法
CN101056175A (zh) * 2007-04-26 2007-10-17 华为技术有限公司 磁盘阵列及其访问权限控制方法与装置、服务器及服务器系统
CN101847197A (zh) * 2009-03-24 2010-09-29 上海任登信息科技有限公司 一种文档访问权限的控制方法
CN101593260A (zh) * 2009-07-03 2009-12-02 杭州华三通信技术有限公司 一种管理系统权限的应用方法和装置

Also Published As

Publication number Publication date
US20140068760A1 (en) 2014-03-06
CN103093140A (zh) 2013-05-08
CN103093140B (zh) 2015-11-25

Similar Documents

Publication Publication Date Title
WO2018058959A1 (zh) Sql审核方法、装置、服务器及存储设备
CN101569129B (zh) 网络安全系统和方法
JP6263675B1 (ja) 信頼できない装置におけるデータの保護
US20210011932A1 (en) Generating events in excess of licensed event count
US8495079B2 (en) Initializing a multi-tenant database
WO2018107811A1 (zh) 网络安全联合防御方法、装置、服务器和存储介质
US9703974B1 (en) Coordinated file system security via rules
WO2020224246A1 (zh) 基于区块链的数据管理方法、装置、设备和存储介质
US20160307173A1 (en) Display of data ingestion information based on counting generated events
WO2013174172A1 (zh) 一种文件信息预览方法及系统
US8364714B2 (en) Servicing query with access path security in relational database management system
WO2017054463A1 (zh) 事件信息推送方法、事件信息推送装置及存储介质
CN107004086A (zh) 安全信息和事件管理
US11699268B1 (en) Techniques for placement of extended reality objects relative to physical objects in an extended reality environment
WO2014044136A1 (zh) 基于分布式数据的并发处理方法、系统和计算机存储介质
CN1947110A (zh) 用于在计算机网络中生成聚集数据视图的系统和方法
WO2019090981A1 (zh) 保险应用系统的监控方法及装置
US11276236B1 (en) Techniques for placement of extended reality objects relative to other extended reality objects in an extended reality environment
WO2018036168A1 (zh) 数据处理任务执行方法、装置、执行服务器和存储介质
WO2014189190A1 (ko) 데이터 부재 태깅 기반의 정보 검색 시스템 및 방법
WO2013063944A1 (zh) 权限管理方法、系统及计算机存储介质
US11086994B2 (en) Priority scanning of files written by malicious users in a data storage system
CN107004036B (zh) 用以搜索包含大量条目的日志的方法和系统
CN110928885A (zh) Mysql数据库的数据更新到Es数据库的方法及装置
WO2018076802A1 (zh) 一种分布式调用服务器的方法及其系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12846298

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC OF 260914

122 Ep: pct application non-entry in european phase

Ref document number: 12846298

Country of ref document: EP

Kind code of ref document: A1