WO2021147652A1 - 一种权限管理的方法及装置 - Google Patents

一种权限管理的方法及装置 Download PDF

Info

Publication number
WO2021147652A1
WO2021147652A1 PCT/CN2020/142544 CN2020142544W WO2021147652A1 WO 2021147652 A1 WO2021147652 A1 WO 2021147652A1 CN 2020142544 W CN2020142544 W CN 2020142544W WO 2021147652 A1 WO2021147652 A1 WO 2021147652A1
Authority
WO
WIPO (PCT)
Prior art keywords
atomic object
message
user
authority
maintenance system
Prior art date
Application number
PCT/CN2020/142544
Other languages
English (en)
French (fr)
Inventor
杨娇
刘军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021147652A1 publication Critical patent/WO2021147652A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for rights management.
  • the network configuration protocol is a network management protocol based on extensible markup language (XML).
  • YANG (Yet Another Next Generation) data modeling language (data modeling language) has been adopted by the Internet Engineering Task Force (IETF) as the standard NETCONF data modeling language. It can not only establish a model configuration data, but also a model of various operations and notifications, with good readability and scalability.
  • IETF Internet Engineering Task Force
  • the YANG language can perform data modeling on the content layer, operation layer and message layer of the NETCONF protocol.
  • the embodiments of the present application provide a method and device for rights management to realize standardized object rights control and ensure the safety of operation behaviors.
  • a method of rights management is provided, and the rights information of atomic objects can be stored in the operation and maintenance system or a third party.
  • the operation and maintenance system may determine whether the first user has the permission to perform the first operation on the first atomic object according to the permission information of the first atomic object. If the operation and maintenance system determines that the first user has the permission to perform the first operation on the first atomic object, it may send a first message to the first device, where the first message is used to request to perform the first operation on the first atomic object. An atomic object performs the first operation.
  • the operation and maintenance system can determine whether a user has the authority to perform a certain operation on an atomic object, and only when the user has the authority, will it send a message to the device to request an operation on the atomic object. When you do not have permission, no message is sent to the device. In this way, the security of the operation behavior can be guaranteed to a certain extent, thereby ensuring network security.
  • the first operation includes but is not limited to any one of an add operation, a delete operation, a modification operation, and a query operation.
  • the operation and maintenance system may receive permission information of the first atomic object from the first device.
  • the authority information of the first atomic object includes the type of a user who has operation authority on the first atomic object, and the operation that the user of the type has authority on the first atomic object .
  • the user type may be, for example, a visitor type, an administrator type, and so on.
  • the operation and maintenance system is determining whether the first user logging in the operation and maintenance system has the permission to perform the first operation on the first atomic object according to the permission information of the first atomic object.
  • permission it may be first determined whether the first type of the first user has the operation permission for the first atomic object according to the type of the user who has the operation permission for the first atomic object. If the first type does not have the operation authority on the first atomic object, the first user does not have the authority to perform the first operation on the first atomic object. If the first type has operation authority on the first atomic object, it can be determined that the user of the first type has operation authority on the first atomic object according to the operation that the user of the first type has authority on the first atomic object. Whether the object has the authority of the first operation, and if it has the authority of the first operation, it is determined that the first user has the authority to perform the first operation on the first atomic object.
  • the corresponding operation authority For each user type, the corresponding operation authority is set, and then the user type can be used to accurately, concisely, and quickly determine whether the first user has the authority to perform the first operation on the first atomic object.
  • the user may log in to the operation and maintenance system through account information, and the operation and maintenance system may determine the first type of the first user according to the account information of the first user.
  • the operation and maintenance system may further send a fifth message to the first device, and the fifth message may include the first type of authority information of the first user, and the fifth The message can be used to authenticate the first type of authority information.
  • a response message from the first device may also be received, and the response message may be used to indicate that the authorization information of the first type is authenticated or not authenticated.
  • the operation and maintenance system authenticates the authority information of a certain user type to the first device, so that the operation and maintenance system and the first device can store the same authority information for the user type, so as to further ensure network security.
  • the fifth message sent by the operation and maintenance system to the first device may be a Netconf message.
  • the response message of the fifth message received by the operation and maintenance system may also be a Netconf message.
  • the operation and maintenance system wants to manage the atomic objects in the first device, it can first perform authentication access to the first device.
  • the operation and maintenance system authenticates access to the first device through Netconf messages.
  • the operation and maintenance system is authenticated at the same time as the authority information. Performing authentication can reduce signaling overhead.
  • the permission information of the first atomic object is indicated by the label of the yang model.
  • the tags of the yang model include a user type tag and an operation tag.
  • the user type tag is used to identify the type of a user who has operation authority on the first atomic object
  • the operation tag is used to identify the first atomic object.
  • a user of the type of user whose atomic object has operation authority has authority to operate on the first atomic object.
  • the authority information is expressed through the standard yang model, so that the authority information of atomic objects can be modeled, standardized and automated. It is more convenient to manage data models and facilitate the understanding and connection of external systems/tools.
  • a method for rights management is provided.
  • the first device can send the rights information of the first atomic object to the operation and maintenance system, and the rights information of the first atomic object is used to determine the user who logs in to the operation and maintenance system. Whether it has the permission to perform the first operation on the first atomic object.
  • the first device may receive a first message from the operation and maintenance system, and the first message may be used to request a first operation to be performed on the first atomic object. Then, the first device may perform the first operation on the first atomic object.
  • the operation and maintenance system can determine whether the user has the authority to perform a certain operation on an atomic object, and only when the user has the authority, will it send a message to the first device to request an operation on the atomic object. Without permission, no message is sent to the first device. This can ensure network security to a certain extent.
  • the first operation includes but is not limited to any one of an addition operation, a deletion operation, a modification operation, and a query operation.
  • the authority information of the first atomic object includes the type of a user who has operation authority on the first atomic object, and the operation that the user of the type has authority on the first atomic object .
  • the user type may be, for example, a visitor type, an administrator type, and so on.
  • the first device may also receive a fifth message from the operation and maintenance system, the fifth message may include the first type of authority information, and the fifth message may be used to The first type of authority information is authenticated; the first device authenticates according to the authority information stored for the operation and maintenance system whether a user of the first type who logs in to the operation and maintenance system has the information included in the fifth message And the first device sends a response message of the fifth message to the operation and maintenance system, and the response message of the fifth message is used to indicate that the first type of permission information is authenticated or not authenticated pass.
  • the authentication result is that the user of the first type has the authority information included in the fifth message, the authentication passes; otherwise, the authentication fails.
  • the operation and maintenance system authenticates the authority information of a certain user type to the first device, so that the operation and maintenance system and the first device can store the same authority information for the user type, so as to further ensure network security.
  • the fifth message sent by the operation and maintenance system to the first device may be a Netconf message.
  • the response message of the fifth message received by the operation and maintenance system may also be a Netconf message.
  • the operation and maintenance system wants to manage the atomic objects in the first device, it can first perform authentication access to the first device.
  • the operation and maintenance system authenticates access to the first device through Netconf messages.
  • the operation and maintenance system is authenticated at the same time as the authority information. Performing authentication can reduce signaling overhead.
  • the permission information of the first atomic object is indicated by the label of the yang model.
  • the tags of the yang model include a user type tag and an operation tag.
  • the user type tag is used to identify the type of a user who has operation authority on the first atomic object
  • the operation tag is used to identify the first atomic object.
  • a user of the type of user whose atomic object has operation authority has authority to operate on the first atomic object.
  • the authority information is expressed through the standard yang model, so that the authority information of atomic objects can be modeled, standardized and automated. It is more convenient to manage data models and facilitate the understanding and connection of external systems/tools.
  • a method for rights management the operation and maintenance system can receive a second message from a second device, and the second message carries the updated rights information of the second atomic object. Then, the operation and maintenance system may update the authority information of the second atomic object according to the second message.
  • the equipment and operation and maintenance system can update the permission information of atomic objects to further improve network security.
  • the operation and maintenance system may also determine whether the condition for updating the second atomic object is satisfied, and when it is determined that the permission information of the second atomic object needs to be updated, send a third message to the second device, The third message is used to indicate the permission information of the second atomic object that is requested to be updated. Furthermore, the operation and maintenance system may receive a second message from the second device, the second message carrying the updated authority information of the second atomic object.
  • the operation and maintenance system can request the second device whether it can be updated when it is determined that the permission information of the atomic object needs to be updated, so as to further improve network security.
  • the operation and maintenance system when the operation and maintenance system determines that the second user logging in to the operation and maintenance system requests to allow or prohibit the second user from performing the second operation on the second atomic object, it may determine that the The authority information of the second atomic object, generally, the second operation exceeds the authority scope corresponding to the authority information of the second atomic object.
  • the second operation exceeds the limit.
  • the permission range corresponding to the permission information of the second atomic object can be determined as the need to update the permission information of the second atomic object.
  • the operation and maintenance system may determine whether the fourth user logging in to the operation and maintenance system has the fourth operation on the second atomic object according to the updated authority information of the second atomic object permission.
  • the operation and maintenance system may send a fourth message to the second device, and the fourth message may be used to request the The second atomic object performs the fourth operation. If the fourth user does not have the authority to perform the fourth operation on the second atomic object, the request for performing the operation may not be sent to the second device.
  • the authority information of the second atomic object includes the type of a user who has operation authority on the second atomic object, and the operation that the user of the type has authority on the second atomic object .
  • the user type may be, for example, a visitor type, an administrator type, and so on.
  • the permission information of the second atomic object is indicated by the label of the yang model.
  • the label of the yang model includes a user type label and an operation label.
  • the user type label is used to identify the type of user who has operation authority on the second atomic object
  • the operation label is used to identify the user A user of the type of a user whose atomic object has operation authority has authority to operate on the second atomic object.
  • the second message is a Netconf message.
  • the third message is a Netconf message.
  • a method for rights management is provided.
  • the second device can determine whether the rights information of the second atomic object needs to be updated; when it is determined that the rights information of the second atomic object needs to be updated, it can send the second device to the operation and maintenance system. Message, the second message carries the updated authority information of the second atomic object.
  • the equipment and operation and maintenance system can update the permission information of atomic objects to further improve network security.
  • the second device when the second device receives a third message from the operation and maintenance system, where the third message is used to indicate the permission information of the second atomic object that requests an update, it may It is determined that the permission information of the second atomic object needs to be updated.
  • the second device may determine that it needs to be updated
  • the authority information of the second atomic object generally, the third operation exceeds the authority range corresponding to the authority information of the second atomic object.
  • the second device may receive a fourth message from the operation and maintenance system, and the fourth message may be used to request a fourth operation to be performed on the second atomic object. Then, the second device may perform a fourth operation on the second atomic object.
  • the authority information of the second atomic object includes the type of a user who has operation authority on the second atomic object, and the operation that the user of the type has authority on the second atomic object .
  • the user type may be, for example, a visitor type, an administrator type, and so on.
  • the permission information of the second atomic object is indicated by the label of the yang model.
  • the label of the yang model includes a user type label and an operation label.
  • the user type label is used to identify the type of user who has operation authority on the second atomic object
  • the operation label is used to identify the user A user of the type of a user whose atomic object has operation authority has authority to operate on the second atomic object.
  • the second message is a Netconf message.
  • the third message is a Netconf message.
  • a device for rights management has the function of realizing any one of the foregoing first aspect and the first aspect, or any one of the foregoing third aspect and the third aspect.
  • the hardware or software includes one or more functional modules corresponding to the above-mentioned functions.
  • an apparatus for rights management has the function of realizing any of the foregoing second aspect and the possible implementation of the second aspect, or realizing any of the foregoing fourth aspect and the fourth aspect.
  • Functions in implementation. These functions can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more functional modules corresponding to the above-mentioned functions.
  • an apparatus for rights management may be the equipment for deploying the operation and maintenance system in the foregoing method embodiment, or a chip set in the equipment for deploying the operation and maintenance system.
  • the device includes a transceiver, a processor, and optionally, a memory. Wherein, the memory is used to store computer programs or instructions, and the processor is respectively coupled with the memory and the transceiver. When the processor executes the computer programs or instructions, the device executes the first aspect and the first aspect through the transceiver.
  • an apparatus for rights management may be the first device/second device in the foregoing method embodiment, or a chip set in the first device/second device.
  • the device includes a transceiver, a processor, and optionally, a memory.
  • the memory is used to store computer programs or instructions
  • the processor is respectively coupled with the memory and the transceiver.
  • the processor executes the computer programs or instructions
  • the device executes the second aspect and the second aspect through the transceiver.
  • a method executed by the first device in any possible implementation, or a method executed by the second device in any possible implementation of the fourth aspect and the fourth aspect.
  • a computer program product comprising: computer program code, when the computer program code runs on a computer, the computer executes the first aspect and any one of the possible aspects of the first aspect The method executed by the operation and maintenance system in the implementation, or the method executed by the operation and maintenance system in the third aspect and any possible implementation of the third aspect.
  • a computer program product includes: computer program code, which when the computer program code runs on a computer, causes the computer to perform any of the above-mentioned second aspect and any of the possible aspects of the second aspect A method executed by the first device in an implementation, or a method executed by the first device in any possible implementation of the fourth aspect and the fourth aspect.
  • the present application provides a chip system that includes a processor and a memory, and the processor and the memory are electrically coupled; the memory is used to store computer program instructions; the processing The device is used to execute part or all of the computer program instructions in the memory. When the part or all of the computer program instructions are executed, they are used to implement the first aspect and any possible implementation method of the first aspect.
  • the chip system may further include a transceiver, and the transceiver is configured to send a signal processed by the processor or receive a signal input to the processor.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides a chip system that includes a processor and a memory, and the processor and the memory are electrically coupled; the memory is used to store computer program instructions; the processing The device is used to execute part or all of the computer program instructions in the memory, and when the part or all of the computer program instructions are executed, it is used to implement the second aspect and any possible implementation method of the second aspect.
  • the chip system may further include a transceiver, and the transceiver is configured to send a signal processed by the processor or receive a signal input to the processor.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • a computer-readable storage medium stores a computer program.
  • the computer program When the computer program is run, the first aspect and any possible implementation of the first aspect or the first
  • the method executed by the operation and maintenance system in any possible implementation of the third aspect and the third aspect is executed.
  • a computer-readable storage medium stores a computer program.
  • the computer program When the computer program is run, the first aspect and any possible implementation of the first aspect or the first
  • the method executed by the first device/second device in any possible implementation of the fourth aspect and the fourth aspect is executed.
  • a system for rights management includes: an operation and maintenance system that executes any of the foregoing first aspect and any possible implementation method of the first aspect, and executes the foregoing second aspect and second aspect The first device of the method in any possible implementation of the aspect.
  • a rights management system includes: an operation and maintenance system that executes the third aspect and any possible implementation method of the third aspect, and executes the fourth aspect and the fourth aspect.
  • the second device of the method in any possible implementation of the aspect.
  • FIG. 1 is a structural diagram of a rights management system provided in an embodiment of this application.
  • FIG. 2, FIG. 3, FIG. 4, and FIG. 5 are schematic diagrams of a rights management process provided in an embodiment of this application;
  • Fig. 6, Fig. 7, Fig. 8, and Fig. 9 are respectively structural diagrams of a permission management device provided in an embodiment of the application.
  • the embodiments of the present application provide a method and device for rights management, wherein the method and device are based on the same technical idea. Because the principles of the method and device for solving problems are similar, the implementation of the device and the method can be referred to each other, and there is no repetition. Go into details again.
  • LTE long term evolution
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • NR new radio access technology
  • the device 12 stores atomic objects, which are generally network elements, such as UPF, SMF, etc.
  • the atomic objects are atomic data models used to define indivisible business management object units, such as address pools. , DNN Chinese and English. Operators, administrators, tourists and other users can log in to the operation and maintenance system 11, and perform management operations on the atomic objects in the equipment 12 through the operation and maintenance system. For example, add an address pool, query DNN, etc.
  • the permission information of the atomic object of the device can be used in the operation and maintenance system.
  • the operation and maintenance system only allows the user to perform management operations on the atomic object when it is determined that the user has the authority.
  • the following describes the embodiments of the present application in detail based on the application scenario shown in FIG. 1.
  • the "and/or” in this application describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone. This situation.
  • the character "/” generally indicates that the associated objects are in an "or” relationship.
  • the multiple involved in this application refers to two or more.
  • a schematic diagram of a flow of rights management provided by an embodiment of this application may include the following steps:
  • Step 201 Operation and maintenance determines whether the first user logging in the operation and maintenance system has the permission to perform the first operation on the first atomic object according to the permission information of the first atomic object, and if so, execute step 201.
  • the operation and maintenance system or a third party stores the permission information of one or more atomic objects.
  • One atomic object corresponds to one permission information, that is, the permission information corresponds to the atomic object one-to-one.
  • the atomic object can be, for example, an address pool or a DNN.
  • the permission information of the atomic object may be, for example, operations for each user who has permission on the atomic object.
  • the atomic object authority information may include, for example, the type of a user who has operation authority on the atomic object, and the operation that the user of the type has authority on the atomic object.
  • the types of users can be, for example, tourists, administrators, operators, and so on.
  • the permission information of the atomic object may be represented by tags of the yang model, for example. Taking the first atomic object as an example for illustration, the first atomic object can be any atomic object: the label of the yang model includes the user’s type label and the operation label, and the user’s type label is used to identify a reference to the first atomic object.
  • a type of a user with operation authority, and the operation tag is used to identify an operation for which the user of the type has authority on the first atomic object.
  • externsion acess-range ⁇ and externsion deny ⁇ these two are optional, the operation authority that is not allowed and the operation authority that can also be understood as forbidden, the operation authority constitutes the operation capability set.
  • Module means a module. There are multiple objects under this module. Externsion means extension, referred to as ext.
  • module A module A
  • module A module A
  • the Users can log in to the operation and maintenance system through account information, such as account numbers and passwords. After the first user logs in to the operation and maintenance system, the first user can request which atomic objects to perform which operations. For example, the first user requests to perform the first operation on the first atomic object.
  • the first operation can be an add (ADD) operation, or a delete (remove) operation, or a modify (modify) operation, or a query (query) operation, etc.
  • the first instruction may be issued to the operation and maintenance system through the user interface, and the first instruction may be used to indicate the first atomic object and the first operation.
  • a user interface may appear in the operation and maintenance system, and multiple atomic objects and multiple operations may be displayed on the user interface.
  • the first user can select the first atomic object on the user interface, or can select the first operation.
  • the user interface may also display a "confirmation function" button, and the user can click the confirmation function button to implement the first instruction to the operation and maintenance system, that is, request to perform the first operation on the first atomic object.
  • the operation and maintenance system may determine whether the first user logging in the operation and maintenance system has the permission to perform the first operation on the first atomic object according to the permission information of the first atomic object. Specifically, it may first determine whether the first type of the first user has the operation authority for the first atomic object according to the type of the user who has the operation authority for the first atomic object. If the first type does not have the operation authority on the first atomic object, the first user does not have the authority to perform the first operation on the first atomic object. If the first type has operation authority on the first atomic object, it can be determined that the user of the first type has operation authority on the first atomic object according to the operation that the user of the first type has authority on the first atomic object. Whether the object has the authority of the first operation, and if it has the authority of the first operation, it is determined that the first user has the authority to perform the first operation on the first atomic object.
  • the type of account information for each user can be stored in the operation and maintenance system.
  • the account information is a visitor type, an administrator type, and an operator type.
  • the operation and maintenance system can determine the first user's account information according to the account information of the first user.
  • the first type of a user can be stored in the operation and maintenance system.
  • Step 202 If the first user has the permission to perform the first operation on the first atomic object, the operation and maintenance system sends a first message to the first device, and the first message is used to request the The first atomic object performs the first operation.
  • the operation and maintenance system may not send a message to the first device, and the process stops. Or the operation and maintenance system may send a prompt message for prompting that the first user does not have the authority to perform the first operation on the first atomic object.
  • the permission information of one or more atomic objects stored in the operation and maintenance system or a third party can be manually set, and it is also possible to set which devices are stored with these atomic objects, and the permission information of the atomic objects can also be sent by the device to the operation and maintenance system of.
  • the first device sends the authority information of the first atomic object to the operation and maintenance system, and correspondingly, the operation and maintenance system receives the authority information of the first atomic object from the first device.
  • multiple devices may store the authority information of the same atomic object, for example, multiple UPFs all store the authority information of the address pool.
  • multiple devices may send permission information of the same atomic object to the operation and maintenance system.
  • the operation and maintenance system may send a first message to the first device that saves the permission information of the atomic object for requesting to perform the first operation on the first atomic object.
  • the first device here may be any device that stores the authority information of the first atomic object. The first device may also be selected by the first user.
  • the user interface also displays information about which devices save the first atomic object, and the first user may select a device as the first device.
  • the first device may also be selected by the operation and maintenance system according to information (for example, version, ID, and other information) of multiple devices that store the permission information of the first atomic object.
  • the operation and maintenance system can determine whether the user has the authority to perform a certain operation on an atomic object, and only when the user has the authority, will it send a message to the device to request to perform an operation on the atomic object. When you do not have permission, no message is sent to the device. In this way, the security of the operation behavior can be guaranteed to a certain extent, thereby ensuring network security.
  • the operation and maintenance system judges the operation request according to the permission information of the atomic object, and sends the operation request of the atomic object within the scope of the permission to the corresponding device.
  • the operation and maintenance system can perform access authentication to the device. This process belongs to the prior art and will not be described in detail here.
  • the operation and maintenance system can also authenticate the authority information to the device. For the specific process, refer to the authority management flowchart shown in FIG. 3, and the first device and the first user are still taken as examples for description.
  • Step 301 The first device determines the permission information of one or more atomic objects saved by itself.
  • the first device may be configured with permission information of multiple atomic objects. After the first device starts to work, it may first determine the permission information of one or more atomic objects and notify the operation and maintenance system.
  • Step 302 The first device sends the determined authority information of the atomic object to the operation and maintenance system, and correspondingly, the operation and maintenance system receives the authority information of the atomic object from the first device.
  • the permission information of the atomic object includes the type of the user who has the operation permission on the atomic object, and the operation that the user of the type has the permission on the atomic object.
  • the first device may send a yang model list to the operation and maintenance system, where the yang model list includes the permission information of the atomic object, that is, the yang model tag represents the permission information of the atomic object.
  • the permission information of the atomic object is identified by tags such as allow-group, access-range, allow, or deny described in step 201.
  • Step 303 When the operation and maintenance system recognizes that the first user logs into the operation and maintenance system and requests to perform the first operation on the first atomic object, it may extract the first user’s first operation from the stored permission information of the atomic object. Type of permission information.
  • the operation and maintenance system holds a lot of account information.
  • the first type of the first user can be identified according to the account information of the first user, and the The first type of authority information of a user is authenticated.
  • another type of user logs in another type of authority information can be authenticated.
  • the operation and maintenance system can authenticate the first type of authority information again, or there is no need to verify the first type of authority information. Permission information for authentication.
  • Step 304 The operation and maintenance system sends a fifth message to the first device, the fifth message includes the first type of authority information, and correspondingly, the first device receives the fifth message from the operation and maintenance system .
  • the fifth message may be a Netconf message.
  • the operation and maintenance system wants to manage the atomic objects in the first device, it can first perform authentication access to the first device. Generally, the operation and maintenance system authenticates and accesses the first device through Netconf messages. In step 304, the operation and maintenance system carries the authority information of the first type in the Netconf message, and at the same time authenticates the operation and maintenance system, it also authenticates the authority information, which can reduce the signaling overhead.
  • the maintenance system authenticates the authority information of a certain user type to the first device, so that the operation and maintenance system and the first device can store the same authority information for the user type, so as to further ensure network security.
  • Step 305 The first device authenticates whether the first type of user logging in the operation and maintenance system has the authority information included in the fifth message according to the authority information stored for the operation and maintenance system; when the authentication result is When the user of the first type has the authority information included in the fifth message, the authentication is passed; otherwise, the authentication fails.
  • the first device sends a response message of the fifth message to the operation and maintenance system, where the response message of the fifth message is used to indicate that the authorization information of the first type is authenticated or not authenticated.
  • the response message of the fifth message may also be a Netconf message.
  • Passed authentication may refer to pass the operation and maintenance system authentication and pass the authentication of the first type of authority information.
  • Step 306 The operation and maintenance system sends an operation request for an atomic object within the scope of authority to the first device.
  • the operation and maintenance system adopts step 201 and step 202 in FIG. 2 to determine to send a first message to the first device, and the first message is used to request to perform the first operation on the first atomic object.
  • the device may actively update the authority information of the atomic object.
  • the atomic object whose authority information is updated is defined as the second atomic object.
  • Step 401 The second device determines that the authority information of the second atomic object needs to be updated, and determines the updated authority information of the second atomic object. For example, it can be to update the yang model file.
  • the second device determines that a third user logging in the second device requests permission or prohibition of the third operation performed by the third user on the second atomic object.
  • the third operation exceeds the permission range corresponding to the permission information of the second atomic object, that is, the user type of the third user does not have the permission to perform the third operation on the second atomic object.
  • the third user can only perform modification operations on an atomic object before, and the update can only perform query operations.
  • the second device may determine the updated authority information of the second atomic object according to the request of the third user.
  • a user registered on the second device may log in to the second device, and indicate on the user interface that the third operation performed by the third user on the second atomic object is permitted or prohibited.
  • Step 402 The second device sends a second message to the operation and maintenance system, and correspondingly, the operation and maintenance system receives the second message from the second device.
  • the second message carries the updated authority information of the second atomic object.
  • the second message may be a Netconf message.
  • the second message may include an updated yang model file, specifically, it may be an updated yang model label used to indicate permission information.
  • Step 403 The operation and maintenance system updates the authority information of the second atomic object according to the second message.
  • the operation and maintenance system receives a user's operation request on the second atomic object, it can determine whether the user has access to the second atomic object according to the updated authority information of the second atomic object.
  • the operation authority, the operation and maintenance system sends the operation request of the atomic object within the authority to the device.
  • the operation and maintenance system determines whether the fourth user logging in the operation and maintenance system has the permission to perform the fourth operation on the second atomic object according to the updated permission information of the second atomic object; Four users have the authority to perform the fourth operation on the second atomic object, the operation and maintenance system sends a fourth message to the second device, and the fourth message is used to request to perform the fourth operation on the second atomic object. The fourth operation. If the fourth user does not have the authority to perform the fourth operation on the second atomic object, the operation and maintenance system may not send a message to the second device, and the process stops. Or the operation and maintenance system may send a prompt message for prompting that the fourth user does not have the authority to perform the fourth operation on the second atomic object.
  • the operation and maintenance system determines whether the fourth user logged in the operation and maintenance system has the permission to perform the fourth operation on the second atomic object according to the updated authority information of the second atomic object
  • the operation and maintenance system first determines whether the fourth user has the authority to perform the fourth operation on the second atomic object.
  • the updated user type having the operation authority on the second atomic object determines whether the type of the fourth user has the operation authority on the second atomic object.
  • the fourth user is determined according to the operation that the user of the type of the fourth user has authority on the second atomic object. Whether the user of the user type has the authority of the fourth operation on the second atomic object.
  • the operation and maintenance system may also actively update the authority information of the atomic object, and the specific process may be the authority management flowchart shown in FIG. 5.
  • Step 501 The operation and maintenance system determines that the authority information of the second atomic object needs to be updated, and determines the authority information of the second atomic object that is requested to be updated.
  • the operation and maintenance system determines that a second user logging in the operation and maintenance system requests permission or prohibition of the second user to perform a second operation on a second atomic object, wherein the second operation exceeds the second atomic object
  • the permission scope corresponding to the permission information For example, the second user can only perform an increase operation on an atomic object before, and the update is that in addition to performing an increase operation, a query operation can also be performed.
  • the second user instructs on the user interface of the operation and maintenance system to allow or prohibit the second user to perform the second operation on the second atomic object.
  • the operation and maintenance system determines that the number of times that a second user logging in the operation and maintenance system requests to perform a second operation on the second atomic object reaches a set threshold, where the second operation exceeds the second atomic object
  • the permission scope corresponding to the permission information For example, the operation and maintenance system determines that the number of times that a second user logging in the operation and maintenance system requests to perform a second operation on the second atomic object reaches a set threshold, where the second operation exceeds the second atomic object The permission scope corresponding to the permission information.
  • the second device may determine the updated permission information of the second atomic object according to the request of the second user.
  • Step 502 The operation and maintenance system sends a third message to the second device, and correspondingly, the second device receives the third message from the operation and maintenance system.
  • the third message is used to indicate the permission information of the second atomic object that is requested to be updated.
  • the second device may determine that the permission information of the second atomic object needs to be updated.
  • the third message may be a Netconf message, for example, a Netconf request message.
  • Step 503 The second device may update the permission information of the second atomic object when determining that it has the condition for updating the permission.
  • updating the authority information of the second atomic object is updating the yang model file of the second atomic object.
  • the second device may determine whether it has the condition for the update authority according to the current network resource situation. For example, if the current network resources are large, the address pool can be allowed to increase, and if the network resources are small, the address pool cannot be increased.
  • Step 504 When the second device determines that it has the condition for the update authority, the second device sends a second message to the operation and maintenance system, and correspondingly, the operation and maintenance system receives the second message from the second device.
  • the second message carries the updated authority information of the second atomic object.
  • the second message may be a Netconf message, for example, may be a Netconf response message.
  • the second device determines that the permission is allowed to be updated, it may also feed back response information that allows the permission to be updated to the operation and maintenance system.
  • step 503 and step 504 is not limited, that is, step 503 may be performed first, and then step 504 may be performed, or step 504 may be performed first and then step 503 may be performed, or step 503 and step 504 may be performed simultaneously.
  • the second device may also allow partial updates, but some cannot be updated.
  • Step 505 The operation and maintenance system updates the authority information of the second atomic object according to the second message.
  • the operation and maintenance system receives a user's operation request on the second atomic object, it can determine whether the user has access to the second atomic object according to the updated authority information of the second atomic object.
  • the operation authority, the operation and maintenance system sends the operation request of the atomic object within the authority to the device.
  • the specific process please refer to the description at step 403 in FIG.
  • a device 600 for rights management is provided.
  • the device 600 can execute the above-mentioned methods in FIGS. 2, 3, 4, and 5 by operation and maintenance.
  • the apparatus 600 may be an operation and maintenance system, or may be a chip applied in the operation and maintenance system.
  • the apparatus 600 may include: a transceiver module 620, a processing module 610, and optionally, a storage module 630; the processing module 610 may be connected to the storage module 630 and the transceiver module 620 respectively, and the storage module 630 may also be connected to the transceiver module 620 .
  • the transceiver module 620 may be used to transmit and receive data.
  • the storage module 630 may be used to store received data or data to be sent.
  • the processing module 610 is configured to determine whether the first user logging in the device has the permission to perform the first operation on the first atomic object according to the permission information of the first atomic object; A user who has the authority to perform the first operation on the first atomic object sends a first message to the first device through the transceiver module 620, and the first message is used to request to perform all operations on the first atomic object. The first operation.
  • the transceiver module 620 is further configured to receive permission information of the first atomic object from the first device.
  • the processing module 610 is configured to determine, according to the authority information of the first atomic object, that the first user logging in the device has the authority to perform the first operation on the first atomic object, it is specifically configured to: The type of the user with the operation authority of the first atomic object, and it is determined that the first type of the first user has the operation authority to the first atomic object; according to the user of the first type the user has the authority to the first atomic object To determine that the first user of the first type has the permission to perform the first operation on the first atomic object.
  • the processing module 610 is further configured to determine the first type of the first user according to the account information of the first user.
  • the transceiver module 620 is further configured to send a fifth message to the first device, where the fifth message includes the first type of authority information of the first user, and the fifth message is used to Performing authentication with one type of authority information; and receiving a response message of the fifth message from the first device, where the response message is used to indicate whether the authentication of the first type of authentication information is passed or not authenticated.
  • the transceiving module 620 is configured to receive a second message from the second device, the second message carrying the updated authority information of the second atomic object; the processing module 610 uses To update the authority information of the second atomic object.
  • the processing module 610 is further configured to determine that the permission information of the second atomic object needs to be updated; and send a third message to the second device through the transceiving module 620, and the third The message is used to indicate the permission information of the second atomic object that is requested to be updated.
  • the processing module 610 determines that the authority information of the second atomic object needs to be updated, it is specifically configured to: determine that the second user logging in the device requests to allow or prohibit the second user from The second atomic object performs the second operation; or, it is determined that the number of times that the second user logging in the device requests to perform the second operation on the second atomic object reaches a set threshold, wherein the second operation exceeds the second operation The permission scope corresponding to the permission information of the atomic object.
  • a permission management apparatus 700 is provided.
  • the apparatus 700 can execute the above-mentioned methods in FIGS. 2, 3, 4, and 5. Each step performed by the device/second device.
  • the apparatus 700 may be a device or a chip applied to the device.
  • the apparatus 700 may include: a transceiver module 720, a processing module 710, and optionally, a storage module 730; the processing module 710 may be connected to the storage module 730 and the transceiver module 720 respectively, and the storage module 730 may also be connected to the transceiver module 720 .
  • the transceiver module 720 can be used to transmit and receive data.
  • the storage module 730 may be used to store received data or data to be sent.
  • the transceiver module 720 is used for the operation and maintenance system to send the authority information of the first atomic object, and the authority information of the first atomic object is used to determine whether the user logging in the operation and maintenance system has access to the first atomic object.
  • An atomic object has the authority to perform the first operation, and receives a first message from the operation and maintenance system, the first message is used to request the first operation to be performed on the first atomic object; the processing module 710 is used to perform the first operation on the first atomic object; The atomic object executes the first operation; wherein, the first message is that the operation and maintenance system determines that the first user logging in to the operation and maintenance system has access to the first operation according to the authority information of the first atomic object An atomic object is sent to the device after the permission to perform the first operation.
  • the transceiving module 720 is further configured to receive a fifth message from the operation and maintenance system, where the fifth message includes permission information of the first type, and the fifth message is used to The first type of authority information is authenticated; the processing module 710 is further configured to authenticate whether a user of the first type who logs in to the operation and maintenance system has the authority information according to the authority information stored for the operation and maintenance system; The transceiver module 720 is further configured to send a response message of the fifth message to the operation and maintenance system, where the response message of the fifth message is used to indicate that the authorization information of the first type is authenticated or not authenticated. .
  • the processing module 710 is configured to determine that the permission information of the second atomic object needs to be updated; the transceiving module 720 is configured to send a second message to the operation and maintenance system, and the second message carries the updated The permission information of the second atomic object.
  • the processing module 710 determines that the authority information of the second atomic object needs to be updated, it is specifically configured to: determine to receive a third message from the operation and maintenance system through the transceiver module 720, the third message It is used to indicate the authority information of the second atomic object that is requested to be updated; or to determine that a third user logging in the device requests permission or prohibition of the third operation performed by the third user on the second atomic object.
  • FIG. 8 is a schematic block diagram of a permission management apparatus 800 according to an embodiment of the present application. It should be understood that the device 800 can execute each step performed by the operation and maintenance system in the methods of FIG. 2, FIG. 3, FIG. 4, and FIG. 5. In order to avoid redundancy, details are not described herein again.
  • the device 800 includes a processor 810 and a transceiver 820, and optionally, a memory 830. The processor 810 and the memory 830 are electrically coupled.
  • the memory 830 is configured to store a computer program; the processor 810 may be configured to call a computer program or instruction stored in the memory to execute the above-mentioned method of rights management through the transceiver 820.
  • the processing module 610 in FIG. 6 may be implemented by the processor 810, the transceiver module 620 may be implemented by the transceiver 820, and the storage module 630 may be implemented by the memory 830.
  • FIG. 9 is a schematic block diagram of a permission management apparatus 900 according to an embodiment of the present application. It should be understood that the apparatus 900 can execute the steps performed by the first device/the second device in the methods of FIG. 2, FIG. 3, FIG. 4, and FIG. 5. In order to avoid redundancy, details are not described herein again.
  • the device 900 includes a processor 910 and a transceiver 920, and optionally, a memory 930.
  • the processor 910 and the memory 930 are electrically coupled.
  • the memory 930 is configured to store a computer program; the processor 910 may be configured to call a computer program or instruction stored in the memory to execute the above-mentioned permission management method through the transceiver 920.
  • the processing module 710 in FIG. 7 may be implemented by the processor 910, the transceiver module 720 may be implemented by the transceiver 920, and the storage module 730 may be implemented by the memory 930.
  • the aforementioned processor may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor may further include a hardware chip or other general-purpose processors.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (generic array logic, GAL) and other programmable logic devices , Discrete gates or transistor logic devices, discrete hardware components, etc. or any combination thereof.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • DDR SDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM, ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • DR RAM Direct Rambus RAM
  • the embodiment of the present application also provides a computer storage medium that stores a computer program, and when the computer program is executed by a computer, the computer can be used to execute the above-mentioned rights management method.
  • the embodiment of the present application also provides a computer program product containing instructions, which when running on a computer, enables the computer to execute the permission management method provided above.
  • the embodiment of the present application also provides a rights management system, the system includes: an operation and maintenance system and equipment that execute the above rights management method.
  • this application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Abstract

本申请涉及通信技术领域，公开了一种权限管理的方法及装置，用以实现标准化的对象权限控制，保证操作行为的安全性。运维系统可以根据第一原子对象的权限信息，确定所述第一用户是否具有对所述第一原子对象执行第一操作的权限。如果运维系统确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则可以向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。运维系统可以确定用户是否具有对某个原子对象执行某种操作权限，只有在具有权限时，才会向设备发送消息请求对原子对象执行操作，在不具有权限时，不向设备发送消息，可以在一定程度上保证操作行为的安全性，保证网络安全。

Description

一种权限管理的方法及装置
相关申请的交叉引用
本申请要求在2020年01月21日提交中国专利局、申请号为202010070662.1、申请名称为“一种权限管理的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种权限管理的方法及装置。
背景技术
网络配置协议(network configuration protocol，NETCONF)是一种基于可扩展标记语言(extensible markup language，XML)的网络管理协议。近年来，YANG(Yet Another Next Generation)数据建模语言(data modeling language)被国际互联网工程任务组(the internet engineering task force，IETF)作为标准的NETCONF数据建模语言。它不仅可以建立配置数据的模型(model configuration data)，还可以建立各种操作和通知的模型，具有良好的可读性和可扩展性。目前，YANG语言可以对NETCONF协议的内容层、操作层和消息层进行数据建模。
然而，当前标准YANG不具备权限定义能力，无法保证操作行为的安全性。
发明内容
本申请实施例提供一种权限管理的方法及装置，实现标准化的对象权限控制，保证操作行为的安全性。
第一方面，提供了一种权限管理的方法，运维系统或者第三方中可以保存原子对象的权限信息。运维系统可以根据第一原子对象的权限信息，确定所述第一用户是否具有对所述第一原子对象执行第一操作的权限。如果运维系统确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则可以向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
运维系统可以确定用户是否具有对某个原子对象执行某种操作的权限，只有在具有权限时，才会向设备发送消息请求对原子对象执行操作。在不具有权限时，不向设备发送消息。这样，可以在一定程度上保证操作行为的安全性，从而保证网络安全。
在一种可能的实现中，所述第一操作包括但不限于增加操作，删除操作，修改操作，查询操作中的任一种。
在一种可能的实现中，所述运维系统可以接收来自所述第一设备的所述第一原子对象的权限信息。
在一种可能的实现中，所述第一原子对象的权限信息包括对所述第一原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第一原子对象具有权限的操作。用户类型例如可以是游客类型、管理员类型等。
在一种可能的实现中，所述运维系统在根据第一原子对象的权限信息，确定登录所述运维系统的第一用户是否具有对所述第一原子对象执行所述第一操作的权限时，可以是先根据对所述第一原子对象具有操作权限的用户的类型，确定所述第一用户的第一类型对所述第一原子对象是否具有操作权限。如果第一类型对所述第一原子对象不具有操作权限，则所述第一用户不具有对所述第一原子对象执行所述第一操作的权限。如果第一类型对所述第一原子对象具有操作权限，则可以再根据第一类型的用户对所述第一原子对象具有权限的操作，确定所述第一类型的用户对所述第一原子对象是否具有所述第一操作的权限，如果具有第一操作的权限，则确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限。
针对各个用户的类型，设置对应的操作权限，后续可以通过用户的类型，准确、简洁、快速地确定出第一用户是否具有对所述第一原子对象执行所述第一操作的权限。
在一种可能的实现中，用户可以通过账户信息登录运维系统，则运维系统可以根据所述第一用户的账户信息，确定所述第一用户的第一类型。
在一种可能的实现中，所述运维系统还可以向所述第一设备发送第五消息，所述第五消息可以包括所述第一用户的第一类型的权限信息，所述第五消息可以用于对所述第一类型的权限信息进行认证。可选的，还可以接收到来自第一设备的响应消息，所述响应消息可以用于指示所述第一类型的权限信息认证通过或未认证通过。
运维系统向第一设备认证某种用户的类型的权限信息，这样可以使运维系统和第一设备针对该用户的类型保存相同的权限信息，以进一步保证网络安全。
在一种可能的实现中，所述运维系统向所述第一设备发送的第五消息可以是Netconf消息。进一步地，运维系统接收到的第五消息的响应消息也可以是Netconf消息。
运维系统要想管理第一设备中的原子对象，可以先向第一设备进行认证接入。一般情况下，运维系统通过Netconf消息向第一设备进行认证接入，在此实施例中，通过在Netconf消息中携带第一类型的权限信息，在认证运维系统的同时，也对权限信息进行认证，可以减少信令开销。
在一种可能的实现中，通过yang模型的标签指示所述第一原子对象的权限信息。例如yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第一原子对象具有操作权限的用户的类型，所述操作标签用于标识对所述第一原子对象具有操作权限的用户的类型的用户对所述第一原子对象具有权限的操作。
通过标准的yang模型表达权限信息，使得原子对象的权限信息模型化、标准化和自动化。更方便管理数据模型以及方便外部系统/工具的理解与对接。
第二方面，提供了一种权限管理的方法，第一设备可以向运维系统发送第一原子对象的权限信息，所述第一原子对象的权限信息用于确定登录所述运维系统的用户是否具有对所述第一原子对象执行第一操作的权限。进而，第一设备可以接收来自所述运维系统的第一消息，所述第一消息可以用于请求对所述第一原子对象执行第一操作。然后，所述第一设备可以对所述第一原子对象执行所述第一操作。
运维系统可以确定用户是否具有对某个原子对象执行某种操作的权限，只有在具有权限时，才会向第一设备发送消息请求对原子对象执行操作。在不具有权限时，不向第一设备发送消息。这样可以在一定程度上保证网络安全。
在一种可能的实现中，所述第一操作包括但不限于增加操作，删除操作，修改操作， 查询操作中的任一种。
在一种可能的实现中，所述第一原子对象的权限信息包括对所述第一原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第一原子对象具有权限的操作。用户类型例如可以是游客类型、管理员类型等。
在一种可能的实现中，所述第一设备还可以接收来自所述运维系统的第五消息，所述第五消息可以包括第一类型的权限信息，所述第五消息可以用于对所述第一类型的权限信息进行认证；所述第一设备根据针对所述运维系统保存的权限信息，认证登录所述运维系统的第一类型的用户是否具有所述第五消息中包括的权限信息；并且所述第一设备向所述运维系统发送所述第五消息的响应消息，所述第五消息的响应消息用于指示所述第一类型的权限信息认证通过或未认证通过。当认证结果为第一类型的用户具有所述第五消息中包括的权限信息时，认证通过；否则，认证未通过。
运维系统向第一设备认证某种用户的类型的权限信息，这样可以使运维系统和第一设备针对该用户的类型保存相同的权限信息，以进一步保证网络安全。
在一种可能的实现中，所述运维系统向所述第一设备发送的第五消息可以是Netconf消息。进一步地，运维系统接收到的第五消息的响应消息也可以是Netconf消息。
运维系统要想管理第一设备中的原子对象，可以先向第一设备进行认证接入。一般情况下，运维系统通过Netconf消息向第一设备进行认证接入，在此实施例中，通过在Netconf消息中携带第一类型的权限信息，在认证运维系统的同时，也对权限信息进行认证，可以减少信令开销。
在一种可能的实现中，通过yang模型的标签指示所述第一原子对象的权限信息。例如yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第一原子对象具有操作权限的用户的类型，所述操作标签用于标识对所述第一原子对象具有操作权限的用户的类型的用户对所述第一原子对象具有权限的操作。
通过标准的yang模型表达权限信息，使得原子对象的权限信息模型化、标准化和自动化。更方便管理数据模型以及方便外部系统/工具的理解与对接。
第三方面，一种权限管理的方法，运维系统可以接收来自第二设备的第二消息，所述第二消息携带更新后的第二原子对象的权限信息。然后所述运维系统可以根据所述第二消息更新所述第二原子对象的权限信息。
设备和运维系统可以更新原子对象的权限信息，进一步提高网络安全。
在一种可能的实现中，运维系统还可以确定是否满足更新第二原子对象的条件，在确定需要更新所述第二原子对象的权限信息时，向所述第二设备发送第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息。进而，所述运维系统可以接收来自第二设备的第二消息，所述第二消息携带更新后的第二原子对象的权限信息。
运维系统可以在确定需要对原子对象的权限信息进行更新时，向第二设备请求能否更新，进一步提高网络安全。
在一种可能的实现中，运维系统在确定登录所述运维系统的第二用户请求允许或禁止所述第二用户对第二原子对象执行第二操作时，可以确定为需要更新所述第二原子对象的权限信息，一般，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。
在一种可能的实现中，运维系统在确定登录所述运维系统的第二用户请求对所述第二 原子对象执行第二操作的次数达到设定阈值时，所述第二操作超出所述第二原子对象的权限信息对应的权限范围，可以确定为需要更新所述第二原子对象的权限信息。
在一种可能的实现中，所述运维系统可以根据更新后的第二原子对象的权限信息，确定登录所述运维系统的第四用户是否具有对所述第二原子对象执行第四操作的权限。所述运维系统在确定所述第四用户具有对所述第二原子对象执行第四操作的权限，则可以向所述第二设备发送第四消息，所述第四消息可以用于请求对所述第二原子对象执行所述第四操作。如果所述第四用户不具有对所述第二原子对象执行第四操作的权限，则可以不向第二设备发送执行操作的请求。
在一种可能的实现中，所述第二原子对象的权限信息包括对所述第二原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第二原子对象具有权限的操作。用户类型例如可以是游客类型、管理员类型等。
在一种可能的实现中，通过yang模型的标签指示所述第二原子对象的权限信息。例如yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第二原子对象具有操作权限的用户的类型，所述操作标签用于标识对所述第二原子对象具有操作权限的用户的类型的用户对所述第二原子对象具有权限的操作。
在一种可能的实现中，所述第二消息为Netconf消息。
在一种可能的实现中，所述第三消息为Netconf消息。
第四方面，提供了一种权限管理的方法，第二设备可以确定是否需要更新第二原子对象的权限信息；在确定需要更新第二原子对象的权限信息时，可以向运维系统发送第二消息，所述第二消息携带更新后的第二原子对象的权限信息。
设备和运维系统可以更新原子对象的权限信息，进一步提高网络安全。
在一种可能的实现中，所述第二设备在接收到来自所述运维系统的第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息时，可以确定需要更新第二原子对象的权限信息。
在一种可能的实现中，所述第二设备在确定登录所述第二设备的第三用户请求允许或禁止所述第三用户对第二原子对象执行的第三操作时，可以确定需要更新第二原子对象的权限信息，一般，所述第三操作超出所述第二原子对象的权限信息对应的权限范围。
在一种可能的实现中，所述第二设备可以接收来自所述运维系统的第四消息，所述第四消息可以用于请求对第二原子对象执行第四操作。然后，所述第二设备可以对所述第二原子对象执行第四操作。
在一种可能的实现中，所述第二原子对象的权限信息包括对所述第二原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第二原子对象具有权限的操作。用户类型例如可以是游客类型、管理员类型等。
在一种可能的实现中，通过yang模型的标签指示所述第二原子对象的权限信息。例如yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第二原子对象具有操作权限的用户的类型，所述操作标签用于标识对所述第二原子对象具有操作权限的用户的类型的用户对所述第二原子对象具有权限的操作。
在一种可能的实现中，所述第二消息为Netconf消息。
在一种可能的实现中，所述第三消息为Netconf消息。
第五方面，提供了一种权限管理的装置，所述权限管理具有实现上述第一方面及第一方面任一可能的实现中的功能，或者实现上述第三方面及第三方面任一可能的实现中的功能。这些功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的功能模块。
第六方面，提供了一种权限管理的装置，所述权限管理具有实现上述第二方面及第二方面任一可能的实现中的功能，或者实现上述第四方面及第四方面任一可能的实现中的功能。这些功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的功能模块。
第七方面，提供了一种权限管理的装置，该装置可以为上述方法实施例中的部署运维系统的设备，或者为设置在部署运维系统的设备中的芯片。该装置包括收发器以及处理器，可选的，还包括存储器。其中，该存储器用于存储计算机程序或指令，处理器分别与存储器和收发器耦合，当处理器执行所述计算机程序或指令时，使装置通过所述收发器执行上述第一方面及第一方面任一可能的实现中由运维系统执行的方法，或者第三方面及第三方面任一可能的实现中由运维系统执行的方法。
第八方面，提供了一种权限管理的装置，该装置可以为上述方法实施例中的第一设备/第二设备，或者为设置在第一设备/第二设备中的芯片。该装置包括收发器以及处理器，可选的，还包括存储器。其中，该存储器用于存储计算机程序或指令，处理器分别与存储器和收发器耦合，当处理器执行所述计算机程序或指令时，使装置通过所述收发器执行上述第二方面及第二方面任一可能的实现中由第一设备执行的方法，或者第四方面及第四方面任一可能的实现中由第二设备执行的方法。
第九方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述第一方面及第一方面任一可能的实现中由运维系统执行的方法，或者第三方面及第三方面任一可能的实现中由运维系统执行的方法。
第十方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述第二方面及第二方面任一可能的实现中由第一设备执行的方法，或者第四方面及第四方面任一可能的实现中由第一设备执行的方法。
第十一方面，本申请提供了一种芯片系统，该芯片系统包括处理器和存储器，所述处理器、所述存储器之间电耦合；所述存储器，用于存储计算机程序指令；所述处理器，用于执行所述存储器中的部分或者全部计算机程序指令，当所述部分或者全部计算机程序指令被执行时，用于实现上述第一方面及第一方面任一可能的实现的方法中运维系统的功能，或者第三方面及第三方面任一可能的实现的方法中运维系统的功能。
在一种可能的设计中，所述芯片系统还可以包括收发器，所述收发器，用于发送所述处理器处理后的信号，或者接收输入给所述处理器的信号。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十二方面，本申请提供了一种芯片系统，该芯片系统包括处理器和存储器，所述处理器、所述存储器之间电耦合；所述存储器，用于存储计算机程序指令；所述处理器，用于执行所述存储器中的部分或者全部计算机程序指令，当所述部分或者全部计算机程序指 令被执行时，用于实现上述第二方面及第二方面任一可能的实现的方法中第一设备的功能，或者第四方面及第四方面任一可能的实现的方法中第二设备的功能。
在一种可能的设计中，所述芯片系统还可以包括收发器，所述收发器，用于发送所述处理器处理后的信号，或者接收输入给所述处理器的信号。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十三方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序被运行时，上述第一方面及第一方面任一可能的实现中或者第三方面及第三方面任一可能的实现中由运维系统执行的方法被执行。
第十四方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序被运行时，上述第一方面及第一方面任一可能的实现中或者第四方面及第四方面任一可能的实现中由第一设备/第二设备执行的方法被执行。
第十五方面，提供了一种权限管理的系统，所述系统包括：执行上述第一方面及第一方面任一可能的实现中的方法的运维系统，以及执行上述第二方面及第二方面任一可能的实现中的方法的第一设备。
第十六方面，提供了一种权限管理的系统，所述系统包括：执行上述第三方面及第三方面任一可能的实现中的方法的运维系统，以及执行上述第四方面及第四方面任一可能的实现中的方法的第二设备。
第五方面至第十六方面的技术效果可以参照第一方面至第四方面中的描述，重复之处不再赘述。
附图说明
图1为本申请实施例中提供的一种权限管理系统结构图；
图2、图3、图4、图5分别为本申请实施例中提供的一种权限管理流程示意图；
图6、图7、图8、图9分别为本申请实施例中提供的一种权限管理装置结构图。
具体实施方式
下面将结合附图，对本申请实施例进行详细描述。
本申请实施例提供一种权限管理的方法及装置，其中，方法、装置是基于同一技术构思的，由于方法、装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统，全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统，第五代(5th Generation，5G)系统，如新一代无线接入技术(new radio access technology，NR)，及未来的通信系统等。
为便于理解本申请实施例，接下来对本请的应用场景进行介绍，本申请实施例描述的业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图1所示，设备12中保存有原子对象，设备一般为网元，例如UPF、SMF等，原 子对象是原子数据模型，用于定义不可再分割的业务管理对象单元，例如可以是地址池，DNN中英文。操作员、管理员，游客等用户可以登录运维系统11，通过运维系统对设备12中原子对象进行管理操作。例如，添加一个地址池，查询DNN等。为了保证网络安全，可以在运维系统中设备原子对象的权限信息。运维系统只有在确定用户具有权限时，才会允许该用户对原子对象进行管理操作。
下面基于图1所示的应用场景，对本申请实施例进行详细描述。本申请中的“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的多个，是指两个或两个以上。
在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。另外，在本申请实施例中，“示例的”一词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或实现方案不应被解释为比其它实施例或实现方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
如图2所示，为本申请实施例提供的一种权限管理的流程示意图，可以包括以下步骤：
步骤201：运维根据第一原子对象的权限信息，确定登录所述运维系统的第一用户是否具有对所述第一原子对象执行第一操作的权限，如果是，则执行步骤201。
运维系统或者第三方中保存一个或多个原子对象的权限信息，一个原子对象对应一个权限信息，也就是权限信息与原子对象是一一对应的。原子对象例如可以是地址池，可以是DNN。
原子对象的权限信息例如可以是针对每个用户，该用户对所述原子对象具有权限的操作。进一步地，原子对象权限信息例如可以包括对所述原子对象具有操作权限的用户的类型，以及所述类型的用户对所述原子对象具有权限的操作。用户的类型例如可以是游客、管理员、操作员等。原子对象的权限信息例如可以是通过yang模型的标签来表示。以第一原子对象为例进行说明，第一原子对象可以是任一原子对象：yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第一原子对象具有操作权限的用户的类型，所述操作标签用于标识所述类型的用户对所述第一原子对象具有权限的操作。
例如具体可以是：
Figure PCTCN2020142544-appb-000001
其中，externsion acess-range{}和externsion deny{}，这两个为可选项，未被允许的操作权限与也可以理解为禁止的操作权限，操作权限构成操作能力集。
module表示模块，该模块下有多个对象，externsion表示扩展，简称ext。
以下以模块A(module A)为例进行说明：
Figure PCTCN2020142544-appb-000002
在yang模型标准中，“list”表示“原子”这个概念。
用户可以通过账户信息登录运维系统，账户信息例如账号和密码。当第一用户登录运维系统后，第一用户可以请求对哪些原子对象执行哪些操作。例如第一用户请求对第一原子对象执行第一操作。第一操作可以增加(ADD)操作，或删除(remove)操作，或修改(modify)操作，或查询(query)操作等。
第一用户在请求第一原子对象和第一操作时，可以是通过用户界面向运维系统下发第一指示，所述第一指示可以用于指示第一原子对象和第一操作。例如，第一用户在登录运维系统后，运维系统可以出现一个用户界面，用户界面上可以显示多个原子对象，以及多个操作。第一用户可以在用户界面上选择第一原子对象，也可以选择第一操作。用户界面上还可以显示有“具有确认功能”按钮，用户可以点击所述具有确认功能的按钮，以实现向运维系统下发第一指示，即请求对第一原子对象执行第一操作。
相应的，运维系统可以根据第一原子对象的权限信息，确定登录所述运维系统的第一用户是否具有对所述第一原子对象执行第一操作的权限。具体的，可以是先根据对所述第一原子对象具有操作权限的用户的类型，确定所述第一用户的第一类型对所述第一原子对象是否具有操作权限。如果第一类型对所述第一原子对象不具有操作权限，则所述第一用户不具有对所述第一原子对象执行所述第一操作的权限。如果第一类型对所述第一原子对象具有操作权限，则可以再根据第一类型的用户对所述第一原子对象具有权限的操作，确定所述第一类型的用户对所述第一原子对象是否具有所述第一操作的权限，如果具有第一操作的权限，则确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限。
所述运维系统中可以保存每个用户的账户信息的类型，例如账户信息是游客类型，是管理员类型，是操作员类型，运维系统可以根据第一用户的账户信息，确定所述第一用户的第一类型。
步骤202：若所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则所述运维系统向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
若所述第一用户不具有对所述第一原子对象执行所述第一操作的权限，则所述运维系统则可以不向第一设备发送消息，流程停止。或者所述运维系统可以发出提示信息，用于提示所述第一用户不具有对所述第一原子对象执行所述第一操作的权限。
运维系统或第三方中保存的一个或多个原子对象的权限信息可以是人为设置的，还可以设置哪些设备上保存有这些原子对象，原子对象的权限信息也可以是设备发送给运维系统的。例如，第一设备向所述运维系统发送所述第一原子对象的权限信息，相应的，所述运维系统接收来自所述第一设备的所述第一原子对象的权限信息。
当然在本申请中，多个设备上可能会保存同一原子对象的权限信息，例如多个UPF中均保存有地址池的权限信息。这样则会存在多个设备向运维系统发送同一原子对象的权限信息的情况。当第一用户请求对第一原子对象执行第一操作时，运维系统可以向保存原子对象的权限信息的第一设备发送第一消息，用于请求对所述第一原子对象执行所述第一操作。假设保存第一原子对象的权限信息的设备有多个，此处的第一设备可以是任一保存第一原子对象的权限信息的设备。第一设备也可以是第一用户选择出来的，例如用户界面上还显示有哪些设备保存第一原子对象的信息，第一用户可以选择一个设备作为第一设备。第一设备还可以是运维系统根据多个保存所述第一原子对象的权限信息的设备的信息(例如版本，ID等信息)选择出来的。
在上述实施例中，运维系统可以确定用户是否具有对某个原子对象执行某种操作的权限，只有在具有权限时，才会向设备发送消息请求对原子对象执行操作。在不具有权限时，不向设备发送消息。这样，可以在一定程度上保证操作行为的安全性，从而保证网络安全。
在另一个实施例中，运维系统根据原子对象的权限信息，对操作请求进行判断，将在权限范围内的原子对象的操作请求发送给对应的设备。在此之前，运维系统可以向设备进行接入认证，该过程属于现有技术，此处不再详细赘述。另外，运维系统还可以向设备进行权限信息的认证，具体过程可以参见图3所示的权限管理流程图，仍以第一设备、第一用户为例进行说明。
步骤301：第一设备确定自身保存的一个或多个原子对象的权限信息。
第一设备中可以被配置有多个原子对象的权限信息，第一设备在开始工作后，可以先确定出一个或多个原子对象的权限信息，并告知运维系统。
步骤302：第一设备将确定出的原子对象的权限信息发送给运维系统，相应的，所述运维系统接收来自所述第一设备的原子对象的权限信息。
示例的，原子对象的权限信息包括对所述原子对象具有操作权限的用户的类型，以及所述类型的用户对所述原子对象具有权限的操作。例如第一设备可以向运维系统发送yang模型列表，所述yang模型列表中包括原子对象的权限信息，即通过yang模型标签表示原子对象的权限信息。例如，通过上述步骤201中所描述的allow-group、acess-range、allow或deny等标签来标识原子对象的权限信息。
步骤303：运维系统在识别出第一用户登录运维系统，请求对第一原子对象执行第一操作时，可以在保存的原子对象的权限信息中，提取出所述第一用户的第一类型的权限信息。
运维系统持有很多账户信息，当识别出第一用户登录，且对第一原子对象执行第一操作时，可以根据第一用户的账户信息识别出第一用户的第一类型，进而对第一用户的第一类型的权限信息进行认证。当再有另一类型的用户登录时，可以再对另一类型的权限信息进行认证。
如果运维系统已经对第一类型的权限信息进行认证，当又有一个第一类型的用户再次 登录，运维系统可以再次对第一类型的权限信息进行认证，也可以无需再对第一类型的权限信息进行认证。
步骤304：运维系统向第一设备发送第五消息，所述第五消息中包括第一类型的权限信息，相应的，所述第一设备接收来自所述运维系统的所述第五消息。所述第五消息可以是Netconf消息。
运维系统要想管理第一设备中的原子对象，可以先向第一设备进行认证接入。一般情况下，运维系统通过Netconf消息向第一设备进行认证接入。在步骤304中，运维系统通过在Netconf消息中携带第一类型的权限信息，在认证运维系统的同时，也对权限信息进行认证，可以减少信令开销。
维系统向第一设备认证某种用户的类型的权限信息，这样可以使运维系统和第一设备针对该用户的类型保存相同的权限信息，以进一步保证网络安全。
步骤305：所述第一设备根据针对所述运维系统保存的权限信息，认证登录所述运维系统的第一类型的用户是否具有所述第五消息中包括的权限信息；当认证结果为第一类型的用户具有所述第五消息中包括的权限信息时，认证通过；否则，认证未通过。
所述第一设备向所述运维系统发送所述第五消息的响应消息，所述第五消息的响应消息用于指示所述第一类型的权限信息认证通过或未认证通过。所述第五消息的响应消息也可以是Netconf消息。认证通过可以是指运维系统认证通过，以及第一类型的权限信息认证通过。
步骤306：运维系统向第一设备发送在权限范围内的原子对象的操作请求。
例如运维系统采用图2中的步骤201、步骤202，确定向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
在本申请的另一示例中，设备可以是主动更新原子对象的权限信息，为了便于区分，将权限信息被更新的原子对象定义为第二原子对象。
如图4所示，提供了一种权限管理的流程示例图。
步骤401：第二设备确定需要更新第二原子对象的权限信息，并确定更新后的第二原子对象的权限信息。例如可以是更新yang模型文件。
示例的，所述第二设备确定登录所述第二设备的第三用户请求允许或禁止所述第三用户对第二原子对象执行的第三操作。一般，所述第三操作超出所述第二原子对象的权限信息对应的权限范围，即所述第三用户的用户类型不具有对所述第二原子对象执行第三操作的权限。例如，例如第三用户对一个原子对象由之前只能进行修改操作，更新为只能进行查询操作。第二设备可以根据第三用户的请求，确定更新后的第二原子对象的权限信息。
在第二设备上注册的用户可以登录第二设备，在用户界面上指示允许或禁止所述第三用户对第二原子对象执行的第三操作。
步骤402：第二设备向运维系统发送第二消息，相应的，所述运维系统接收来自所述第二设备的所述第二消息。所述第二消息携带更新后的第二原子对象的权限信息。
所述第二消息可以是Netconf消息。
所述第二消息可以包括更新后的yang模型文件，具体可以是更新用于表示权限信息的yang模型标签。
步骤403：所述运维系统根据所述第二消息更新所述第二原子对象的权限信息。
进一步地，如果所述运维系统接收到某个用户对第二原子对象的操作请求时，可以根据更新后的第二原子对象的权限信息判断所述用户是否具有对所述第二原子对象的操作的权限，运维系统向设备发送在权限范围内的原子对象的操作请求。
例如，所述运维系统根据更新后的第二原子对象的权限信息，确定登录所述运维系统的第四用户是否具有对所述第二原子对象执行第四操作的权限；若所述第四用户具有对所述第二原子对象执行所述第四操作的权限，则所述运维系统向第二设备发送第四消息，所述第四消息用于请求对所述第二原子对象执行所述第四操作。若所述第四用户不具有对所述第二原子对象执行所述第四操作的权限，则所述运维系统则可以不向第二设备发送消息，流程停止。或者所述运维系统可以发出提示信息，用于提示所述第四用户不具有对所述第二原子对象执行所述第四操作的权限。
运维系统在根据更新后的第二原子对象的权限信息，确定登录所述运维系统的第四用户是否具有对所述第二原子对象执行第四操作的权限时，运维系统先根据对更新后的对所述第二原子对象具有操作权限的用户类型，确定所述第四用户的类型对所述第二原子对象是否具有操作权限。在所述第四用户的类型对所述第二原子对象具有操作权限的基础上，再根据所述第四用户的类型的用户对所述第二原子对象具有权限的操作，确定所述第四用户的类型的用户对所述第二原子对象是否具有所述第四操作的权限。
通过对原子对象的权限信息进行更新，可以更加符合网络需求，进一步提高网络安全。
在本申请的又一实施例中，运维系统也可以主动更新原子对象的权限信息，具体过程可以如图5所示的权限管理流程图。
步骤501：所述运维系统确定需要更新所述第二原子对象的权限信息，并确定请求更新的所述第二原子对象的权限信息。
示例的，运维系统确定登录所述运维系统的第二用户请求允许或禁止所述第二用户对第二原子对象执行第二操作，其中，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。例如第二用户对一个原子对象由之前只能进行增加操作，更新为除了进行增加操作外，也可以进行查询操作。
第二用户在运维系统的用户界面上指示允许或禁止所述第二用户对第二原子对象执行第二操作。
示例的，运维系统确定登录所述运维系统的第二用户请求对所述第二原子对象执行第二操作的次数达到设定阈值，其中，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。
第二设备可以根据第二用户的请求，确定更新后的第二原子对象的权限信息。
步骤502：所述运维系统向所述第二设备发送第三消息，相应的，所述第二设备接收来自所述运维系统的第三消息。所述第三消息用于指示请求更新的所述第二原子对象的权限信息。
所述第二设备接收到来自所述运维系统的第三消息时，第二设备可以确定需要更新第二原子对象的权限信息。所述第三消息可以是Netconf消息，例如为Netconf请求消息。
步骤503：第二设备在确定具备更新权限的条件时，可以更新所述第二原子对象的权限信息。
具体的，更新第二原子对象的权限信息是更新第二原子对象的yang模型文件。
第二设备可以根据当前的网络资源情况，确定是否具有更新权限的条件。例如，如果当前的网络资源较多，可以允许增加地址池，如果网络资源较小，则不能增加地址池。
步骤504：第二设备在确定具有更新权限的条件时，第二设备向运维系统发送第二消息，相应的，所述运维系统接收来自所述第二设备的所述第二消息。所述第二消息携带更新后的第二原子对象的权限信息。所述第二消息可以是Netconf消息，例如可以为Netconf响应消息。该第二设备在确定允许更新权限时，也可以是向运维系统反馈允许权限更新的响应信息。
上述步骤503和步骤504的先后顺序不进行限制，即可以先执行步骤503，后执行步骤504，也可以先执行步骤504再执行步骤503，或者步骤503和步骤504同步执行。
此外，第二设备也可以允许部分更新，部分不能更新。
步骤505：所述运维系统根据所述第二消息更新所述第二原子对象的权限信息。
进一步地，如果所述运维系统接收到某个用户对第二原子对象的操作请求时，可以根据更新后的第二原子对象的权限信息判断所述用户是否具有对所述第二原子对象的操作的权限，运维系统向设备发送在权限范围内的原子对象的操作请求。具体过程可以参见图4的步骤403处的描述，重复之处不再赘述。
通过对原子对象的权限信息进行更新，可以更加符合网络需求，进一步提高网络安全。
基于与上述权限管理的方法的同一技术构思，如图6所示，提供了一种权限管理的装置600，装置600能够执行上述图2、图3、图4、图5的方法中由运维系统执行的各个步骤。装置600可以为运维系统，也可以为应用于运维系统中的芯片。装置600可以包括：收发模块620，处理模块610，可选的，还包括存储模块630；处理模块610可以分别与存储模块630和收发模块620相连，所述存储模块630也可以与收发模块620相连。
收发模块620，可以用于收发数据。所述存储模块630，可以用于存储接收到的数据或待发送的数据。在一种示例中，处理模块610，用于根据第一原子对象的权限信息，确定登录所述装置的第一用户是否具有对所述第一原子对象执行第一操作的权限；若所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则通过收发模块620向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
在一种示例中，所述收发模块620，还用于接收来自所述第一设备的所述第一原子对象的权限信息。所述处理模块610在用于根据第一原子对象的权限信息，确定登录所述装置的第一用户具有对所述第一原子对象执行所述第一操作的权限时，具体用于：根据对所述第一原子对象具有操作权限的用户的类型，确定所述第一用户的第一类型对所述第一原子对象具有操作权限；根据第一类型的用户对所述第一原子对象具有权限的操作，确定所述第一类型的第一用户具有对所述第一原子对象执行所述第一操作的权限。
在一种示例中，所述处理模块610，还用于根据所述第一用户的账户信息，确定所述第一用户的第一类型。所述收发模块620，还用于向所述第一设备发送第五消息，所述第五消息包括所述第一用户的第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；以及接收来自所述第一设备的所述第五消息的响应消息，所述响应消息用于指示所述第一类型的认证信息认证通过或未认证通过。
在一种示例中，所述收发模块620，用于接收来自所述第二设备的第二消息，所述第二消息携带更新后的第二原子对象的权限信息；所述处理模块610，用于更新所述第二原 子对象的权限信息。
在一种示例中，所述处理模块610，还用于确定需要更新所述第二原子对象的权限信息；并通过所述收发模块620向所述第二设备发送第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息。
在一种示例中，所述处理模块610在确定需要更新所述第二原子对象的权限信息时，具体用于：确定登录所述装置的第二用户请求允许或禁止所述第二用户对第二原子对象执行第二操作；或者，确定登录所述装置的第二用户请求对所述第二原子对象执行第二操作的次数达到设定阈值，其中，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。
基于与上述权限管理的方法的同一技术构思，如图7所示，提供了一种权限管理的装置700，装置700能够执行上述图2、图3、图4、图5的方法中由第一设备/第二设备执行的各个步骤。装置700可以为设备，也可以为应用于设备中的芯片。装置700可以包括：收发模块720，处理模块710，可选的，还包括存储模块730；处理模块710可以分别与存储模块730和收发模块720相连，所述存储模块730也可以与收发模块720相连。
收发模块720，可以用于收发数据。所述存储模块730，可以用于存储接收到的数据或待发送的数据。
在一种示例中，收发模块720，用于运维系统发送第一原子对象的权限信息，所述第一原子对象的权限信息用于确定登录所述运维系统的用户是否具有对所述第一原子对象执行第一操作的权限，以及接收来自运维系统的第一消息，所述第一消息用于请求对第一原子对象执行第一操作；处理模块710，用于对所述第一原子对象执行所述第一操作；其中，所述第一消息为所述运维系统在根据所述第一原子对象的权限信息，确定登录所述运维系统的第一用户具有对所述第一原子对象执行第一操作的权限后发送给所述装置的。
在一种示例中，所述收发模块720，还用于接收来自所述运维系统的第五消息，所述第五消息包括第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；所述处理模块710，还用于根据针对所述运维系统保存的权限信息，认证登录所述运维系统的第一类型的用户是否具有所述权限信息；所述收发模块720，还用于向所述运维系统发送所述第五消息的响应消息，所述第五消息的响应消息用于指示所述第一类型的权限信息认证通过或未认证通过。
在一种示例中，所述处理模块710，用于确定需要更新第二原子对象的权限信息；所述收发模块720，用于向运维系统发送第二消息，所述第二消息携带更新后的第二原子对象的权限信息。
在一种示例中，所述处理模块710在确定需要更新第二原子对象的权限信息时，具体用于：确定通过收发模块720接收来自所述运维系统的第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息；或者确定登录所述装置的第三用户请求允许或禁止所述第三用户对第二原子对象执行的第三操作。
图8是本申请实施例的权限管理的装置800的示意性框图。应理解，所述装置800能够执行上述图2、图3、图4、图5的方法中由运维系统执行的各个步骤，为了避免冗余，此处不再详述。装置800包括：处理器810和收发器820，可选的，还包括存储器830。 所述处理器810和所述存储器830之间电耦合。
示例的，存储器830，用于存储计算机程序；所述处理器810，可以用于调用所述存储器中存储的计算机程序或指令，以通过所述收发器820执行上述的权限管理的方法。
图6中的处理模块610可以通过处理器810来实现，收发模块620可以通过收发器820来实现，存储模块630可以通过存储器830来实现。
图9是本申请实施例的权限管理的装置900的示意性框图。应理解，所述装置900能够执行上述图2、图3、图4、图5的方法中由第一设备/第二设备执行的各个步骤，为了避免冗余，此处不再详述。装置900包括：处理器910和收发器920，可选的，还包括存储器930。所述处理器910和所述存储器930之间电耦合。
示例的，存储器930，用于存储计算机程序；所述处理器910，可以用于调用所述存储器中存储的计算机程序或指令，以通过所述收发器920执行上述的权限管理的方法。
图7中的处理模块710可以通过处理器910来实现，收发模块720可以通过收发器920来实现，存储模块730可以通过存储器930来实现。
上述的处理器可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片或其他通用处理器。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)及其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等或其任意组合。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本申请描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机存储介质，存储有计算机程序，该计算机程序被计算机执行时，可以使得所述计算机用于执行上述权限管理的方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述提供的权限管理的方法。
本申请实施例还提供了一种权限管理的系统，所述系统包括：执行上述权限管理的方法的运维系统和设备。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包括有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (34)

  1. 一种权限管理的方法，其特征在于，所述方法包括：
    运维系统根据第一原子对象的权限信息，确定登录所述运维系统的第一用户是否具有对所述第一原子对象执行第一操作的权限；
    若所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则所述运维系统向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
  2. 如权利要求1所述的方法，其特征在于，还包括：
    所述运维系统接收来自所述第一设备的所述第一原子对象的权限信息。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一原子对象的权限信息包括对所述第一原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第一原子对象具有权限的操作。
  4. 如权利要求3所述的方法，其特征在于，所述运维系统根据第一原子对象的权限信息，确定登录所述运维系统的第一用户具有对所述第一原子对象执行所述第一操作的权限，包括：
    所述运维系统根据对所述第一原子对象具有操作权限的用户的类型，确定所述第一用户的第一类型对所述第一原子对象具有操作权限；
    所述运维系统根据第一类型的用户对所述第一原子对象具有权限的操作，确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限。
  5. 如权利要求4所述的方法，其特征在于，还包括：
    所述运维系统向所述第一设备发送第五消息，所述第五消息包括所述第一用户的第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；
    所述运维系统接收来自所述第一设备的所述第五消息的响应消息，所述响应消息用于指示所述第一类型的认证信息认证通过或未认证通过。
  6. 如权利要求1-5任一项所述的方法，其特征在于，通过yang模型的标签指示所述第一原子对象的权限信息。
  7. 如权利要求6所述的方法，其特征在于，yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第一原子对象具有操作权限的用户的类型，所述操作标签用于标识所述类型的用户对所述第一原子对象具有权限的操作。
  8. 一种权限管理的方法，其特征在于，所述方法包括：
    第一设备向运维系统发送第一原子对象的权限信息，所述第一原子对象的权限信息用于确定登录所述运维系统的用户是否具有对所述第一原子对象执行第一操作的权限；
    第一设备接收来自所述运维系统的第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作；
    所述第一设备对所述第一原子对象执行所述第一操作。
  9. 如权利要求8所述的方法，其特征在于，还包括：
    所述第一设备接收来自所述运维系统的第五消息，所述第五消息包括第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；
    所述第一设备根据针对所述运维系统保存的权限信息，认证登录所述运维系统的第一类型的用户是否具有所述权限信息；
    所述第一设备向所述运维系统发送所述第五消息的响应消息，所述第五消息的响应消息用于指示所述第一类型的权限信息认证通过或未认证通过。
  10. 一种权限管理的方法，其特征在于，所述方法包括：
    运维系统接收来自第二设备的第二消息，所述第二消息携带更新后的第二原子对象的权限信息；
    所述运维系统更新所述第二原子对象的权限信息。
  11. 如权利要求10所述的方法，其特征在于，还包括：
    所述运维系统确定需要更新所述第二原子对象的权限信息；
    所述运维系统向所述第二设备发送第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息。
  12. 如权利要求11所述的方法，其特征在于，所述运维系统确定需要更新所述第二原子对象的权限信息，包括：
    运维系统确定登录所述运维系统的第二用户请求允许或禁止所述第二用户对第二原子对象执行第二操作；或者，
    运维系统确定登录所述运维系统的第二用户请求对所述第二原子对象执行第二操作的次数达到设定阈值，其中，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。
  13. 一种权限管理的方法，其特征在于，所述方法包括：
    第二设备确定需要更新第二原子对象的权限信息；
    第二设备向运维系统发送第二消息，所述第二消息携带更新后的第二原子对象的权限信息。
  14. 如权利要求13所述的方法，其特征在于，第二设备确定需要更新第二原子对象的权限信息，包括：
    所述第二设备接收来自所述运维系统的第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息；或者
    所述第二设备确定登录所述第二设备的第三用户请求允许或禁止所述第三用户对第二原子对象执行的第三操作。
  15. 一种权限管理的装置，其特征在于，所述装置包括：
    处理模块，用于根据第一原子对象的权限信息，确定登录所述装置的第一用户是否具有对所述第一原子对象执行第一操作的权限；
    若所述第一用户具有对所述第一原子对象执行所述第一操作的权限，则通过收发模块向第一设备发送第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作。
  16. 如权利要求15所述的装置，其特征在于，所述收发模块，还用于接收来自所述第一设备的所述第一原子对象的权限信息。
  17. 如权利要求15或16所述的装置，其特征在于，所述第一原子对象的权限信息包括对所述第一原子对象具有操作权限的用户的类型，以及所述类型的用户对所述第一原子对象具有权限的操作。
  18. 如权利要求17所述的装置，其特征在于，所述处理模块在用于根据第一原子对象的权限信息，确定登录所述装置的第一用户具有对所述第一原子对象执行所述第一操作的权限时，具体用于：
    根据对所述第一原子对象具有操作权限的用户的类型，确定所述第一用户的第一类型对所述第一原子对象具有操作权限；根据第一类型的用户对所述第一原子对象具有权限的操作，确定所述第一用户具有对所述第一原子对象执行所述第一操作的权限。
  19. 如权利要求18所述的装置，其特征在于，所述收发模块，还用于向所述第一设备发送第五消息，所述第五消息包括所述第一用户的第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；以及接收来自所述第一设备的所述第五消息的响应消息，所述响应消息用于指示所述第一类型的认证信息认证通过或未认证通过。
  20. 如权利要求15-19任一项所述的装置，其特征在于，通过yang模型的标签指示所述第一原子对象的权限信息。
  21. 如权利要求20所述的装置，其特征在于，yang模型的标签包括用户的类型标签和操作标签，所述用户的类型标签用于标识对所述第一原子对象具有操作权限的用户的类型，所述操作标签用于标识所述类型的用户对所述第一原子对象具有权限的操作。
  22. 一种权限管理的装置，其特征在于，所述装置包括：
    收发模块，用于向运维系统发送第一原子对象的权限信息，所述第一原子对象的权限信息用于确定登录所述运维系统的用户是否具有对所述第一原子对象执行第一操作的权限；以及接收来自所述运维系统的第一消息，所述第一消息用于请求对所述第一原子对象执行所述第一操作；
    处理模块，用于对所述第一原子对象执行所述第一操作。
  23. 如权利要求22所述的装置，其特征在于，所述收发模块，还用于接收来自所述运维系统的第五消息，所述第五消息包括第一类型的权限信息，所述第五消息用于对所述第一类型的权限信息进行认证；
    所述处理模块，还用于根据针对所述运维系统保存的权限信息，认证登录所述运维系统的第一类型的用户是否具有所述权限信息；
    所述收发模块，还用于向所述运维系统发送所述第五消息的响应消息，所述第五消息的响应消息用于指示所述第一类型的权限信息认证通过或未认证通过。
  24. 一种权限管理的装置，其特征在于，所述装置包括：
    收发模块，用于接收来自第二设备的第二消息，所述第二消息携带更新后的第二原子对象的权限信息；
    处理模块，用于更新所述第二原子对象的权限信息。
  25. 如权利要求24所述的装置，其特征在于，所述处理模块，还用于确定需要更新所述第二原子对象的权限信息；并通过所述收发模块向所述第二设备发送第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息。
  26. 如权利要求25所述的装置，其特征在于，所述处理模块在确定需要更新所述第二原子对象的权限信息时，具体用于：
    确定登录所述装置的第二用户请求允许或禁止所述第二用户对第二原子对象执行第二操作；或者，
    确定登录所述装置的第二用户请求对所述第二原子对象执行第二操作的次数达到设定阈值，其中，所述第二操作超出所述第二原子对象的权限信息对应的权限范围。
  27. 一种权限管理的装置，其特征在于，所述装置包括：
    处理模块，用于确定需要更新第二原子对象的权限信息；
    收发模块，用于向运维系统发送第二消息，所述第二消息携带更新后的第二原子对象的权限信息。
  28. 如权利要求27所述的装置，其特征在于，所述处理模块在确定需要更新第二原子对象的权限信息时，具体用于：
    确定通过收发模块接收来自所述运维系统的第三消息，所述第三消息用于指示请求更新的所述第二原子对象的权限信息；或者
    确定登录所述装置的第三用户请求允许或禁止所述第三用户对第二原子对象执行的第三操作。
  29. 一种权限管理的系统，其特征在于，所述系统包括如权利要求15-21任一项所述的装置和如权利要求22-23任一项所述装置，或者包括如权利要求24-26任一项所述的装置和如权利要求27-28任一项所述的装置。
  30. 一种权限管理的装置，其特征在于，包括处理器和收发器；
    所述收发器，用于接收和/或发送信号；
    所述处理器，用于在执行存储器存储的计算机程序或指令时，使得所述装置执行如权利要求1-14任一项所述的方法。
  31. 一种权限管理的装置，其特征在于，用于执行如权利要求1至7中任一项所述的方法，或如权利要求8或9所述方法，或执行如权利要求10-12中任一项所述方法，或执行如权利要求13或14所述方法。
  32. 一种计算机可读存储介质，其特征在于，所述存储介质存储有计算机指令，当所述计算机指令被计算机执行时，使得所述计算机执行如权利要求1-14任一项所述的方法。
  33. 一种芯片系统，其特征在于，包括处理器和存储器，所述处理器和所述存储器电耦合；
    所述存储器，用于存储计算机程序指令；
    所述处理器，用于执行所述存储器中的部分或者全部计算机程序指令，当所述部分或者全部计算机程序指令被执行时，用于实现如权利要求1-14任一项所述的方法。
  34. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机指令，当所述计算机指令被计算机执行时，使得所述计算机执行如权利要求1-14任一项所述的方法。
PCT/CN2020/142544 2020-01-21 2020-12-31 一种权限管理的方法及装置 WO2021147652A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010070662.1 2020-01-21
CN202010070662.1A CN113225296B (zh) 2020-01-21 2020-01-21 一种权限管理的方法及装置

Publications (1)

Publication Number Publication Date
WO2021147652A1 true WO2021147652A1 (zh) 2021-07-29

Family

ID=76992055

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/142544 WO2021147652A1 (zh) 2020-01-21 2020-12-31 一种权限管理的方法及装置

Country Status (2)

Country Link
CN (1) CN113225296B (zh)
WO (1) WO2021147652A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039755B (zh) * 2021-10-29 2024-03-22 中国银联股份有限公司 一种权限控制方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101853358A (zh) * 2010-05-11 2010-10-06 南京赛孚科技有限公司 一种文件对象权限管理的实现方法
CN103646218A (zh) * 2013-12-12 2014-03-19 用友软件股份有限公司 数据访问权限和行为权限的定义装置和定义方法
US20170091236A1 (en) * 2015-09-30 2017-03-30 Pure Storage, Inc. Mechanism for a system where data and metadata are located closely together
CN107204964A (zh) * 2016-03-16 2017-09-26 腾讯科技（深圳）有限公司 一种权限管理的方法、装置和系统

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101340444B (zh) * 2008-08-26 2011-08-24 成都市华为赛门铁克科技有限公司 防火墙和服务器策略同步方法、系统和设备
CN104065612B (zh) * 2013-03-18 2017-11-14 中国移动通信集团公司 一种用户管理方法、装置和统一用户管理系统
WO2017120746A1 (zh) * 2016-01-11 2017-07-20 华为技术有限公司 一种网络访问权限管理方法及相关设备
CN107979571B (zh) * 2016-10-25 2021-10-26 中国移动通信有限公司研究院 一种文件使用处理方法、终端和服务器
CN108073823B (zh) * 2016-11-18 2021-04-20 阿里巴巴集团控股有限公司 数据处理方法、装置及系统
CN109903016A (zh) * 2019-02-26 2019-06-18 广东启动子信息科技有限公司 一种结合权限管理的流程引擎的实现方法及流程引擎系统
CN110619206B (zh) * 2019-08-15 2024-04-02 中国平安财产保险股份有限公司 运维风险控制方法、系统、设备及计算机可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101853358A (zh) * 2010-05-11 2010-10-06 南京赛孚科技有限公司 一种文件对象权限管理的实现方法
CN103646218A (zh) * 2013-12-12 2014-03-19 用友软件股份有限公司 数据访问权限和行为权限的定义装置和定义方法
US20170091236A1 (en) * 2015-09-30 2017-03-30 Pure Storage, Inc. Mechanism for a system where data and metadata are located closely together
CN107204964A (zh) * 2016-03-16 2017-09-26 腾讯科技（深圳）有限公司 一种权限管理的方法、装置和系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039755B (zh) * 2021-10-29 2024-03-22 中国银联股份有限公司 一种权限控制方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN113225296B (zh) 2022-11-11
CN113225296A (zh) 2021-08-06

Similar Documents

Publication Publication Date Title
US10645579B2 (en) Account login method, apparatus, and system
US11895096B2 (en) Systems and methods for transparent SaaS data encryption and tokenization
US10484385B2 (en) Accessing an application through application clients and web browsers
US8839354B2 (en) Mobile enterprise server and client device interaction
US10897466B2 (en) System and method for externally-delegated access control and authorization
US9805209B2 (en) Systems and methodologies for managing document access permissions
CN108701175B (zh) 将用户账户与企业工作空间相关联
CN113630377B (zh) 托管移动设备的单点登录
US10831915B2 (en) Method and system for isolating application data access
US11677696B2 (en) Architecture for performing action in a third-party service by an email client
US11106345B2 (en) Integrating related third-party services using dynamically generated user interfaces
US20200387821A1 (en) Authentication based on a change in a state of a qubit
US10762180B2 (en) Broker-based messaging through SQL
WO2022143174A1 (zh) 一种数据传输方法、装置、设备、存储介质及计算机程序产品
WO2021147652A1 (zh) 一种权限管理的方法及装置
CN113268450A (zh) 文件访问方法及装置、电子设备、存储介质
US10142344B2 (en) Credential management system
CN114866247B (zh) 一种通信方法、装置、系统、终端及服务器
US9479492B1 (en) Authored injections of context that are resolved at authentication time
US11831788B2 (en) Systems and methods for secure access with heartbeat monitoring to native cloud services to computers outside the cloud
US11431711B2 (en) Method, device and computer program product for service access
US10884766B2 (en) Integrating related third-party services for user interaction
CN110610069A (zh) 一种在web系统中调用REST接口的方法与装置
US11907394B1 (en) Isolation and authorization for segregated command and query database resource access
CN117640118A (zh) 环境感知方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20916017

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20916017

Country of ref document: EP

Kind code of ref document: A1