WO2015058579A1

WO2015058579A1 - Method and apparatus for controlling data access permissions

Info

Publication number: WO2015058579A1
Application number: PCT/CN2014/084493
Authority: WO
Inventors: 毕杰山; 郭益君; 徐礼锋; 李超
Original assignee: 华为技术有限公司
Priority date: 2013-10-21
Filing date: 2014-08-15
Publication date: 2015-04-30
Also published as: CN104573430A; CN104573430B

Abstract

Embodiments of the present invention disclose a method and an apparatus for controlling data access permissions, so as to solve the problem of multi-dimensional user permission control. The embodiment of the present invention comprises: receiving an access request of a user; determining permission groups corresponding to the use according to dimensional information of the user; determining a permission set of the user in each of the permission groups according to a dimension value of the user; and combining the permission sets of the user in each of the permission groups, so as to obtain permissions of the user.

Description

Data access authority control method and device

The present invention relates to the field of communications technologies, and in particular, to a data access authority control method and apparatus. Background technique

In a normal business application system, data access rights of users may be obtained according to different dimensions of users, and definitions of data rights of different dimensions may be different. How to solve the combination of these rights is often a complicated one. problem.

Generally, information of different dimensions can be considered as different user attributes, such as user's department information, level information, and the like. Currently, a multi-dimensional access control scheme for data tables: defines a permission access policy for each field (or attribute) of the data table in each dimension, such as a column representing a dimension of a data table, and a row representing a field of the data table Each field has an access policy set under each dimension; however, for a certain field, only users who have access rights under each dimension can access the field, so the multiple dimensions The permission coordination relationship between them is too singular; and, each field needs to be configured separately, and in the case where the number of columns (that is, the dimension) is too much, the operation is too cumbersome.

Summary of the invention

The embodiment of the invention provides a data access authority control method and device for solving the multi-dimensional user permission control problem.

A first aspect of the present invention provides a data access authority control method, which may include:

Receiving a user's access request;

Determining, according to the dimension information of the user, a permission group corresponding to the user;

Determining, according to the dimension value of the user, a permission set of the user in each permission group;

Combining the permission sets of the user in each of the permission groups to obtain the rights of the user. With reference to the first aspect, in a first possible implementation, the method further includes:

Configure a corresponding permission group for each dimension, and the permission group contains different permission sets corresponding to different dimension values.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation, the method further includes:

Configuring a corresponding permission domain for each user category, where the permission domain includes each permission group corresponding to each dimension; Determining, according to the dimension information of the user, the permission group corresponding to the user, including: determining, according to the category of the user, a permission domain corresponding to the user;

Determining, according to the dimension information of the user, a permission group corresponding to the user from a permission domain corresponding to the user.

With reference to the second possible implementation manner of the first aspect, in a third possible implementation, the determining, according to the dimension value of the user, the permission set of the user in each permission group includes:

Determining a category of the privilege group corresponding to the user, where the privilege group includes a mutually exclusive privilege group or a non-exclusive privilege group, wherein one of the mutually exclusive privilege groups configures a privilege set, and the non-mutual A user in the privilege group configures multiple permission sets;

Determining, according to the dimension value of the user, a permission set of the user in each permission group, where all the permission sets in the non-mutual permission group are combined and obtained, and obtaining the user in the non-distribution The set of permissions in the mutually exclusive permission group, or the unique permission set of the user in the mutually exclusive permission group.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a fourth possible implementation, the combining, by the user, the permission set in each permission group includes:

And merging the permission set of the user in each of the permission groups according to the preset first merge policy or the second merge policy, where the first merge policy is a permission group configured according to a service logic of the user The merge policy between the two merge policies is a merge policy configured for each user.

In conjunction with the fourth possible implementation of the first aspect, in a fifth possible implementation, the merging includes merging or merging.

The second aspect of the present invention further provides a data access authority control apparatus, which may include:

a receiving module, configured to receive an access request of the user;

a first determining module, configured to determine, according to the dimension information of the user, a permission group corresponding to the user; and a second determining module, configured to determine, according to the dimension value of the user, the user in each permission group Permission set

And a merging module, configured to merge the permission sets of the user in each of the permission groups to obtain the rights of the user.

With reference to the second aspect, in a first possible implementation, the device further includes:

A configuration module is configured to configure a corresponding permission group for each dimension, where the permission group includes different permission sets corresponding to different dimension values.

In conjunction with the second aspect or the first possible implementation of the second aspect, in a second possible implementation The configuration module is further configured to: configure a corresponding permission domain for each user category, where the permission domain includes each permission group corresponding to each dimension;

The first determining module is configured to: determine, according to the category of the user, a rights domain corresponding to the user; and determine, according to the dimension information of the user, the user corresponding to the domain corresponding to the user Rights Groups.

In conjunction with the second possible implementation of the second aspect, in a third possible implementation, the second determining module is configured to:

With reference to the second aspect or the first possible implementation manner of the second aspect, in a fourth possible implementation, the merging module is specifically used to:

And performing, according to the preset first merge policy or the second merge policy, the rights set of the user in each of the rights groups, and obtaining the rights of the user, where the first The merge policy is a merge policy between the rights groups configured according to the user's business logic, and the second merge policy is a merge policy configured for each user.

It can be seen from the above technical solution that the data access authority control method and apparatus provided by the embodiments of the present invention have the following advantages: The user's dimension information and dimension values are used to determine the user's corresponding permission group and the rights group. a permission set, and merging the permission sets to implement categorization of rights; further, defining a category of the privilege group according to the dimension value, and merging the privilege set according to the merging policy, so that the privilege classification is more targeted, better Solve the problem of multi-dimensional user permission control.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the following description of the embodiments will be briefly described. It is obvious that the drawings in the following description are only some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

1 is a schematic flowchart of a data access authority control method according to Embodiment 1 of the present invention;

2a is a schematic flowchart of a data access authority control method according to Embodiment 2 of the present invention; 2b is a schematic diagram of user rights analysis according to Embodiment 2 of the present invention;

FIG. 2 is a schematic diagram of another user rights analysis according to Embodiment 2 of the present invention;

FIG. 3 is a schematic structural diagram of a data access authority control apparatus according to an embodiment of the present invention; FIG. 4 is another schematic structural diagram of a data access authority control apparatus according to an embodiment of the present invention.

detailed description

In order to make the object, the features and the advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. The described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terms "first", "second,", "third", "fourth", etc. (if present) in the specification and claims of the present invention and the above figures are used to distinguish similar objects without using To describe a particular order or order, it is to be understood that the data so used may be interchanged as appropriate, such that the embodiments of the invention described herein can be implemented, for example, in a sequence other than those illustrated or described herein. , the terms "including" and "having," and any variants thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to the Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

In order to better understand the technical solution of the present invention, the following list introduces the concept related to user authority control. First, the user is a subject that can independently access data in the computer system or other resources represented by data; the authority is in the computer system. Permission to access data or other resources represented by data. It can be divided into object access control and data access control. Among them, object access control is represented by a dual group (control object, access type). The control object represents all resources in the system that need access control. The access type refers to The access control of the corresponding control object, such as: read, modify, delete, etc.; data access control is used to ensure the security of the system. If the data access is not controlled, the security of the system is not guaranteed, and the data is prone to occur. The leak event, so the data accessible to the object must be protected in the permissions.

The detailed description will be respectively made below through specific embodiments.

Embodiment 1 Referring to FIG. 1 , FIG. 1 is a schematic flowchart of a data access authority control method according to an embodiment of the present disclosure, where the rights control method includes:

Step 1 01: Receive a user's access request;

That is, the user's request for data access is received, and the rights of the user are detected, and the data rights that different types of users can access are different. For example: After a user logs in to the system, it is necessary to determine whether the user identity (or user category) is an internal user or an external user. The internal user and the external user use two sets of completely different permission definition information. Taking the banking service as an example, the internal user It refers to the internal staff of the bank, and the external users refer to the personnel outside the bank.

Step 1 02: Determine, according to the dimension information of the user, a permission group corresponding to the user;

It can be understood that information of different dimensions may be considered as different user attributes, for example, may include department information, level information, academic information, and the like of the user; the dimensions and the permission groups correspond to each other.

Step 1 03: Determine, according to the dimension value of the user, a permission set of the user in each permission group; it may be understood that different dimensions may include different dimension values, for example, the department information may include a hardware department, The software department, the administrative department, and the like, the hardware department, the software department, and the administrative department are dimension values of the dimension; the dimension value corresponds to the permission set in each permission group.

Step 1 04: Combine the permission sets of the user in each permission group to obtain the rights of the user.

It can be seen from the above that the data access authority control method provided by the embodiment of the present invention determines the permission group corresponding to the user and the permission set in the permission group by using the dimension information and the dimension value of the user, and merges the permission set. Thereby realizing the classification of rights, solving the problem of multi-dimensional user permission control, and improving the user experience.

Embodiment 2

Referring to FIG. 2a, FIG. 2a is a schematic flowchart of a data access authority control method according to Embodiment 2 of the present invention, where the rights control method may include:

Step 201: Configure a corresponding permission domain for each user category, where the permission domain includes each permission group corresponding to each dimension;

That is, the user category corresponds to the rights domain--in the embodiment of the present invention, the user category may include an internal user and an external user, and one user can only belong to one authority domain Doma in;

Referring to FIG. 2b, FIG. 2b is a schematic diagram of user rights analysis according to Embodiment 2 of the present invention. For example, an external user corresponds to a permission domain Doma inl and an internal user corresponds to a permission domain Doma in2.

Step 202: Configure a corresponding permission group for each dimension, where the permission group includes different dimension value pairs. Different sets of permissions should be;

The permission domain includes a thousand permission group PermGroup, and each dimension corresponds to one permission group; each of the permission groups includes a thousand permission set PermSe t , and each dimension value corresponds to one permission set, for example, in the permission Within the domain Doma i nl, PermGroupl is a permission group, and PermSe tlll is a permission set in PermGroup l.

Step 203: Receive an access request of the user.

Step 204: Determine, according to the category of the user, a permission domain corresponding to the user;

That is, after the permission domain, the permission group, and the permission set corresponding to the user are configured, when the user requests for data access are received, the category of the user is detected, thereby determining a permission domain accessible by the user;

Step 205: Determine, according to the dimension information of the user, a permission group corresponding to the user from a permission domain corresponding to the user;

Preferably, the category of the privilege group corresponding to the user may be determined according to the dimension information of the user. In this embodiment, the privilege group may include a mutually exclusive privilege group or a non-exclusive privilege group. A user in the mutually exclusive permission group configures a permission set. For example, each user can belong to only one department, and the permission group corresponding to department information is a mutually exclusive permission group, and one user configuration in the non-exclusive permission group. Multiple permission sets. For example, a user can have more than two roles, so the permission group corresponding to the user role is a non-mutual permission group.

Step 206: Determine, according to the dimension value of the user, a permission set of the user in each permission group, where the user collects all the permission sets in the non-mutual permission group, and obtains the The set of permissions of the user in the non-exclusive permission group, or the unique permission set of the user in the mutually exclusive permission group.

Step 207: Combine the permission sets of the user in each permission group to obtain the rights of the user.

Preferably, the rights set of the user in each of the rights groups may be merged according to a preset first merge policy or a second merge policy, and the rights of the user are obtained; wherein, the first merge The policy is a merge policy between the rights groups configured according to the user's business logic, and the second merge policy is a merge policy configured for each user.

It will be appreciated that the merging includes, but is not limited to, a union or intersection. A plurality of first merge policies may be configured in the same permission domain, and the first merge policy is a cross-group merge policy; for example, if the permission group PermGroup1 and the permission group PermGroup2 are non-exclusive rights groups, The privilege group PermGroup 3 is a mutually exclusive privilege group, and the first merging policy can be: The privilege group PermGroupl and the privilege group PermGroup2 are merged, and then intersect with the privilege group PermGroup 3, and the single label is marked as PermGroupl and PermGroup2 PermGroup 3.

It can be seen from the above that the data access authority control method provided by the embodiment of the present invention determines the permission group corresponding to the user and the permission set in the permission group by using the dimension information and the dimension value of the user, and merges the permission set. Therefore, the classification of the rights is implemented; further, the categories of the permission groups are defined according to the dimension values, and the permission sets are merged according to the merge policy, so that the rights classification is more targeted, and the multi-dimensional user rights control problem is better solved. .

The following describes the data access authority control method provided by the implementation 2 in combination with the actual application scenario:

First, in the actual application scenario, if the login user is an external user, it is determined according to some user basic information of the external user, which can be determined by reference to FIG. 2c, FIG. 2c is provided in the second embodiment of the present invention. Another schematic diagram of user rights analysis;

In this embodiment, it is assumed that for the attribute 1, the user has the permission set 1 (ie, the attribute 1 corresponds to the permission set 1); for the attribute 2, the user has the permission set 2; for the attribute 3, the user can be known Has permission set 3; for attribute 4, it can be known that the user has permission set 4; for attribute 5, it can be known that the user has permission set 5. That is, according to the attributes of the user, the permission set corresponding to the user may be determined, where each attribute represents information of each dimension, such as attribute 1, attribute 2, and attribute 3 may represent different user roles, and the same user may have One or more attributes;

Attribute 4 and Attribute 5 each have multiple different attribute values. Different attribute values may correspond to different permission sets, but each user can only have one attribute value. For example: Attribute 4 is used to indicate the user level, a user can only have one level of information, attribute 5 is used to represent the user department, and a user can only have one type of department information. Between the permission sets corresponding to different attributes, the final permission set can be obtained by merging:

{ {Permission Set 1} and {Permission Set 2} and {Permission Set 3} }Account {Permission Set 4}Receive {Permission Set 5}.

Then, with reference to FIG. 2a and FIG. 2b, for the practical application, the data access authority control method provided by the present invention is used for the permission control analysis:

First, according to the description content of the foregoing step 201, respectively create a permission domain for the internal user and the external user respectively, such as the external user corresponding permission domain Doma i nl , the internal user corresponding permission domain Doma in2; the external user as an example, according to the foregoing For each dimension, configure a corresponding permission group for each dimension. The permission group contains different permission sets corresponding to different dimension values. In the permission domain Doma inl, create three permission groups, respectively PermGroupl and PermGroup2. And PermGroup 3. Then, define the permission set information it contains for each permission group, where PermGroup l is a non-exclusive permission group, and the configuration permission group PermGroupl contains different Different permission sets corresponding to the user role, that is, three permission sets are configured according to attribute 1, attribute 2, and attribute 3; PermGroup2 and PermGroup 3 are mutually exclusive permission groups, and the configuration permission group PermGroup2 includes permission sets corresponding to different levels, and configuration rights are configured. Group PermGroup 3 contains permission sets corresponding to different departments;

The user sets the permission set of the non-exclusive permission group PermGroup1 to obtain the permission set of the user in the non-exclusive permission group. For the exclusive permission group, the user can obtain the mutual exclusion permission. The unique permission set in the group. Finally, the user is merged in the permission set in each of the rights groups according to the preset first merge policy or the second merge policy, where the first merge policy is configured according to the user's service logic. A merge policy between the rights groups, the second merge policy is a merge policy configured for each user, and the merge includes a union or intersection. In this embodiment of the present invention, in combination with the actual application scenario, if the permission set of the user in each permission group is merged according to the preset first merge policy, the first merge policy may be: PermGroup1 intersects PermGroup2 The PermGroup 3 is not specifically limited in this embodiment.

It can be understood that, in the embodiment of the present invention, performing the merging operation includes, but is not limited to, merging or taking the privilege set of the user in each privilege group; it is also conceivable that the logged-in user is an internal user. The privilege control operation can be implemented by referring to the above operation process. In the second embodiment, the privilege merging method is described by taking only the logged-in user as an external user as an example, and does not constitute a limitation of the present invention.

Embodiment 3

In order to better understand the technical solution of the present invention, the following is a description of the data access authority control method by using the permission access requirement of a certain business data of a bank as an actual application requirement, and taking the login user as an internal user as an example:

First, in this embodiment, it is assumed that the service data table includes a total of 100 fields of cl, c2, c3, c4, ..., cl 00, and the field represents data information requested by the user; The set of columns accessed consists of one or more fields.

In the banking system, different roles for users are defined, as follows:

Ro l el : the accessible column set is {cl , c2 , c 3} Role2: The accessible set of columns is {c3, c4, c5, c6}

Role3: The accessible column set is {c7, c8, c9, clO} Each user belongs to a department, and the column set accessible by each department is defined as follows:

Deptl: The accessible set of columns is {cl, c2, c3, c4}

Dept2: The accessible set of columns is { c3, c4, c5, c6, c7, c8} Each user belongs to a certain user level, and the set of columns accessible at each user level is defined as follows:

Levell: The accessible column set is {cl, c2, c3, c4, c5, c6}

Level2: The accessible set of columns is { cl, c2, c3, c4, c5, c6, c7, c8} Then, if a role has the role of Rolel, Role2, belongs to the department Deptl and the user level is Level2, it can The set of columns accessed is:

( {cl, c2, c3} and {c3, c4, c5, c6}) pay {cl, c2, c3, c4}

{cl, c2, c3, c4, c5, c6, c7, c8};

Next, for the actual application (permission access of a certain business data of the bank), the data access authority control method provided by the present invention is used to perform the permission control analysis:

First, configure a permission domain for internal users according to the description of step 201 above.

Interna IDoma in;

Secondly, according to the foregoing information of each dimension and the description content of the foregoing step 202, in the authority domain InternalDomain, a corresponding permission group is configured for each dimension, and the permission group contains different permission sets corresponding to different dimension values. As a result, a corresponding privilege group is configured for the system user role, the name is SysRoleGroup, and the privilege group SysRoleGroup is a non-exclusive privilege group. The privilege group is configured with the following permission set:

Rolel: {cl, c2, c3}

Role2: {c3, c4, c5, c6}

Role3: {c7, c8, c9, clO} configures a corresponding permission group DeptGroup for department information, which is a mutually exclusive permission group, where The following permission sets are configured in this permission group:

Deptl: {cl, c2, c3, c4}

Dept2: { c3, c4, c5, c6, c7, c8} Configure a corresponding permission group UserLevelGroup for the user level information. The permission group is a mutually exclusive permission group. The permission group is configured with the following permission set:

Level 1: {cl, c2, c3, c4, c5, c6}

Level2: { cl, c2, c3, c4, c5, c6, c7, c8} combined with the above permission access control requirements (has the role of Rolel, Role2, the set of columns that users belonging to department Deptl and whose user level is Level2), according to The access request of the user, in the configured permission group and the permission set, determining the permission group corresponding to the user from the permission domain corresponding to the user according to the dimension information of the user; determining according to the dimension value of the user The permission set of the user in each permission group, and finally, combining the permission sets of the user in each permission group according to a preset first merge policy or a second merge policy, to obtain the The user's rights, wherein the first merge policy is a merge policy between the rights groups configured according to the user's business logic, the second merge policy is a merge policy configured for each user, and the merge includes a merge set Or seek intersection. In this embodiment of the present invention, in combination with the actual application scenario, if the permission set of the user in each permission group is merged according to the preset first merge policy, the first merge policy may be: SysRoleGroup 3 DeptGroup 3 UserLevelGroup, the second merge policy is not specifically limited in this embodiment.

It can be understood that, in the embodiment of the present invention, performing the merging operation includes, but is not limited to, merging or taking the privilege set of the user in each privilege group; it is also conceivable that the logged-in user is an internal user. The privilege control operation can be implemented by referring to the above operation process. In the third embodiment, the privilege merging method is described only by taking the login user as an internal user of the bank as an example, and does not constitute a limitation of the present invention.

In order to facilitate the implementation of the data access authority control method provided by the embodiment of the present invention, the embodiment of the present invention further An apparatus based on the above data access authority control method is provided. The meaning of the noun is the same as that in the above method. For specific implementation details, refer to the description in the method embodiment.

Referring to FIG. 3, FIG. 3 is a schematic structural diagram of a data access authority control apparatus 300 according to an embodiment of the present invention, where the rights control apparatus 300 may include:

The receiving module 301 is configured to receive an access request of the user.

That is, the receiving module 301 receives the user's request for data access, detects the rights of the user, and different types of users can access different data rights. For example: After a user logs in to the system, it is necessary to determine whether the user identity (or user category) is an internal user or an external user. The internal user and the external user use two sets of completely different permission definition information. Taking the banking service as an example, the internal user It refers to the internal staff of the bank, and the external users refer to the personnel outside the bank.

The first determining module 302 is configured to determine, according to the dimension information of the user, a permission group corresponding to the user; it may be understood that information of different dimensions may be considered as different user attributes, for example, may include department information of the user. Level information, academic information, and the like; the dimensions correspond to the permission groups.

a second determining module 303, configured to determine, according to the dimension value of the user, a permission set of the user in each permission group;

It can be understood that the different dimensions may include different dimension values. For example, the department information may include a hardware department, a software department, an administrative department, and the like, and the hardware department, the software department, and the administrative department are dimension values of the dimension; The dimension value corresponds to the permission set in each permission group.

The merging module 304 is configured to combine the permission sets of the user in each of the permission groups to obtain the rights of the user.

Further, the data access right control apparatus 300 may further include a configuration module, configured to configure a corresponding permission group for each dimension, where the permission group includes different permission sets corresponding to different dimension values. And the configuration module is further configured to: configure a corresponding permission domain for each user category, where the permission domain includes each permission group corresponding to each dimension;

The first determining module 302 is configured to: determine, according to the category of the user, a rights domain corresponding to the user; and determine, according to the dimension information of the user, the user corresponding to the user domain corresponding to the user Permission group. That is, the user category corresponds to the rights domain - the user class in the embodiment of the present invention may include an internal user and an external user, and one user can only belong to one rights domain; wherein, the rights domain Containing thousands of permission groups, each dimension corresponds to one permission group; each of the permission groups contains thousands of permission sets, and each dimension value corresponds to one permission set, for example, 3⁄4 port, 3⁄4 port, as shown in Figure 2b, in the permission i Or in Doma inl, PermGroupl is a permission group, and PermSe tlll is a permission set in PermGroupl.

Further, the second determining module 303 can be used to:

That is, the category of the privilege group corresponding to the user may be determined according to the dimension information of the user. In this embodiment, the category of the privilege group may include a mutually exclusive privilege group or a non-exclusive privilege group. A user in a mutually exclusive privilege group is configured with a privilege set. For example, each user can belong to only one department, and the privilege group corresponding to the department information is a mutually exclusive privilege group. A permission set, for example, a user can have more than two roles, so the permission group corresponding to the user role is a non-mutual permission group.

In this embodiment, the permission set of the user in each permission group is determined according to the dimension value of the user, where all the permission sets in the non-mutual permission group are collected and combined. Obtaining the permission set of the user in the non-exclusive permission group, or obtaining the unique permission set of the user in the mutually exclusive permission group.

Preferably, the merging module 303 can be specifically configured to:

It can be understood that, in the embodiment of the present invention, the combining includes but is not limited to a union or intersection. In the same privilege domain, a plurality of first merging policies can be configured, and the first merging policy is a cross-group merging policy; for example, as shown in FIG. 2b, if the privilege group PermGroup1 and the privilege group PermGroup2 are non-interactive The privilege group and the privilege group PermGroup 3 are mutually exclusive privilege groups. The first merging policy may be: the privilege group PermGroupl and the privilege group PermGroup2 are merged, and then intersect with the privilege group PermGroup 3.

Those skilled in the art can clearly understand that for the convenience and cleanness of the description, the specific working process of the data access authority control device 300 and its unit module described above, and the practical application requirements, the data of the present invention is used for the data. For the process of performing the access control, refer to the corresponding process in the foregoing method embodiment. The specific implementation is not repeated here.

It can be seen from the above that a data access authority control apparatus 300 according to an embodiment of the present invention determines the permission group corresponding to the user and the permission set in the permission group by using the dimension information and the dimension value of the user, and merges the permission set. Therefore, the classification of the rights is implemented; further, the categories of the permission groups are defined according to the dimension values, and the permission sets are merged according to the merge policy, so that the rights classification is more targeted, and the multi-dimensional user rights control is better solved. problem.

Referring to FIG. 4, FIG. 4 is another schematic structural diagram of a data access authority control apparatus according to an embodiment of the present invention, which may include at least one processor 401 (eg, CPU, Cent ra l Proces s Un Un ), at least one network. An interface or other communication interface, memory 402, and at least one communication bus are used to effect connection communication between the devices. The processor 401 is configured to execute executable modules, such as computer programs, stored in a memory. The memory 402 may include high speed random access memory and may also include non-volatile memory, such as at least one disk storage. The communication connection between the system gateway and at least one other network element may be implemented through at least one network interface (which may be wired or wireless), and may use an Internet, a wide area network, a local area network, a metropolitan area network, or the like.

As shown in FIG. 4, in some embodiments, program instructions are stored in the memory 402, and the program instructions may be executed by the processor 401. The processor 401 specifically performs the following steps:

Receiving an access request of the user; determining, according to the dimension information of the user, a permission group corresponding to the user; determining, according to the dimension value of the user, a permission set of the user in each permission group; The permission sets in each permission group are merged to obtain the rights of the user.

Preferably, the processor 401 further performs the following steps: configuring a corresponding permission group for each dimension, where the permission group includes different permission sets corresponding to different dimension values; configuring a corresponding permission for each user category a domain, the permission domain includes each permission group corresponding to each of the dimensions; determining a permission domain corresponding to the user according to the category of the user; and obtaining rights corresponding to the user according to the dimension information of the user The domain determines the permission group corresponding to the user.

The processor 401 is configured to determine, according to the dimension value of the user, the permission set of the user in each permission group, including: determining a category of the permission group corresponding to the user, where the category of the permission group includes A privilege group or a non-exclusive privilege group, wherein one user in the mutually exclusive privilege group configures a privilege set, and one user in the non-exclusive privilege group configures multiple privilege sets; according to the dimension value of the user Determining, by the user, a permission set in each permission group, where all the permission sets of the user in the non-exclusive permission group are combined, and the user is obtained in the non-exclusive permission group. Set, or, obtain the unique right of the user in the mutually exclusive permission group Limit set.

The processor 401 is configured to merge the permission set of the user in each permission group, including: according to the preset first merge policy or the second merge policy, the user is in each of the The privilege set in the privilege group performs the merging or merging, wherein the first merging policy is a merging policy between the privilege groups configured according to the user's business logic, and the second merging policy is configured for each user. Merge strategy.

In the above embodiments, the descriptions of the various embodiments are different, and the parts that are not detailed in an embodiment can be referred to the related descriptions of other embodiments.

It can be seen from the above that the data access authority control apparatus 400 provided by the embodiment of the present invention determines the permission group corresponding to the user and the permission set in the permission group by using the dimension information and the dimension value of the user, and merges the permission set. Therefore, the classification of the rights is implemented; further, the categories of the permission groups are defined according to the dimension values, and the permission sets are merged according to the merge policy, so that the rights classification is more targeted, and the multi-dimensional user rights control is better solved. problem.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e., may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention or the part contributing to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. Shield, including thousands of instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the present invention All or part of the steps of the method described in the examples. The foregoing storage medium shield includes: u disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, random access memory), disk or optical disk, and the like, which can store program codes. Shield.

The data access authority control method and apparatus provided by the present invention are described in detail above. For those skilled in the art, according to the idea of the embodiment of the present invention, there are some changes in the specific implementation manner and application scope. In conclusion, the contents of this specification are not to be construed as limiting the invention.

Claims

claims

1. A data access permission control method, characterized by including:

Receive user access requests;

Determine the permission group corresponding to the user according to the user's dimension information;

According to the dimension value of the user, the permission set of the user in each permission group is determined; and the permission sets of the user in each permission group are combined to obtain the permissions of the user.

2. The method according to claim 1, further comprising:

A corresponding permission group is configured for each dimension, and the permission group contains different permission sets corresponding to different dimension values.

3. The method according to claim 1 or 2, further comprising: configuring a corresponding authority domain for each user category, the authority domain including each authority group corresponding to each dimension;

Then, determining the authority group corresponding to the user according to the user's dimension information includes: determining the authority domain corresponding to the user according to the category of the user;

According to the dimension information of the user, the authority group corresponding to the user is determined from the authority domain corresponding to the user.

4. The method of claim 3, wherein determining the user's permission set in each permission group based on the user's dimension value includes:

Determine the category of the permission group corresponding to the user. The category of the permission group includes a mutually exclusive permission group or a non-mutually exclusive permission group, wherein one user in the mutually exclusive permission group is configured with a permission set, and the non-mutually exclusive permission group Configure multiple permission sets for a user in a permission group;

According to the dimension value of the user, the permission set of the user in each permission group is determined, wherein all the permission sets of the user in non-mutually exclusive permission groups are combined to obtain the permission set of the user in non-mutually exclusive permission groups. A set of permissions in a mutually exclusive permission group, or, obtaining the user's unique set of permissions in a mutually exclusive permission group.

5. The method according to claim 1 or 2, characterized in that merging the user's permission sets in each permission group includes:

Merge the user's permission sets in each permission group according to the preset first merging strategy or the second merging strategy, wherein the first merging strategy is based on the user's business A merging policy between logically configured permission groups, and the second merging policy is a merging policy configured for each user.

6. The method according to claim 5, characterized in that the merging includes seeking a union or an intersection.

7. A data access authority control device, characterized by including:

Receiving module, used to receive user access requests;

The first determination module is used to determine the permission group corresponding to the user according to the user's dimension information;

The second determination module is used to determine the permission set of the user in each permission group according to the dimension value of the user;

A merging module, configured to merge the user's permission sets in each permission group to obtain the user's permissions.

8. The device according to claim 7, further comprising:

The configuration module is used to configure a corresponding permission group for each dimension. The permission group includes different permission sets corresponding to different dimension values.

9. The device according to claim 7 or 8, characterized in that the configuration module is further configured to: configure a corresponding authority domain for each user category, and the authority domain includes the authority domain corresponding to each dimension. per permission group;

Then, the first determination module is configured to: determine the authority domain corresponding to the user according to the category of the user; determine the authority domain corresponding to the user from the authority domain corresponding to the user according to the dimension information of the user. Rights Groups.

10. The device according to claim 9, characterized in that the second determination module is used to:

According to the dimension value of the user, the permission set of the user in each permission group is determined, where all the permission sets of the user in the non-mutually exclusive permission group are combined to obtain the permission set of the user in the non-mutually exclusive permission group. A set of permissions in a mutually exclusive permission group, or, obtaining the user's unique set of permissions in a mutually exclusive permission group.

11. The device according to claim 7 or 8, characterized in that the merging module is specifically used for:

According to the preset first merging strategy or the second merging strategy, the user's permission sets in each permission group are combined or intersected to obtain the user's permissions, wherein, the first The merging policy is a merging policy between permission groups configured according to the user's business logic, and the second merging policy is a merging policy configured for each user.