CN106529219A - User authority control method and device - Google Patents

User authority control method and device Download PDF

Info

Publication number
CN106529219A
CN106529219A CN201610980677.5A CN201610980677A CN106529219A CN 106529219 A CN106529219 A CN 106529219A CN 201610980677 A CN201610980677 A CN 201610980677A CN 106529219 A CN106529219 A CN 106529219A
Authority
CN
China
Prior art keywords
user
authority
role
corresponding relation
operation requests
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201610980677.5A
Other languages
Chinese (zh)
Other versions
CN106529219B (en
Inventor
付凯祥
岳海涛
江均勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Cloud Information Technology Co Ltd
Original Assignee
Shanghai Cloud Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Cloud Information Technology Co Ltd filed Critical Shanghai Cloud Information Technology Co Ltd
Priority to CN201610980677.5A priority Critical patent/CN106529219B/en
Publication of CN106529219A publication Critical patent/CN106529219A/en
Application granted granted Critical
Publication of CN106529219B publication Critical patent/CN106529219B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12Protecting executable software
    • G06F21/121Restricting unauthorised execution of programs

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a user authority control method and device. The method comprises the following steps of: establishing a corresponding relationship among a user, a role and an authority; receiving an operation request, given by a manager, for the corresponding relationship among the user, the role and the authority; and carrying out a corresponding operation on the corresponding relationship among the user, the role and the authority according to the operation request. When a certain authority of the user is increased or decreased, the corresponding relationship among the user, the role and the authority can be directly increased or decreased without increasing or decreasing a role corresponding to the authority for the user, so that the operation for the user authority can be specific to the role and the authority, but not only specific to the role, thereby improving the flexibility of user authority control.

Description

The control method and device of user right
Technical field
The present embodiments relate to rights management techniques, more particularly to a kind of control method and device of user right.
Background technology
In existing safe cloud platform or cloud platform, realize that the mode of user right control is by user being controlled to system In each API (Application Programming Interface, application programming interface) access rights realizing 's.User can be divided into administrator, domestic consumer, as shown in figure 1, user that one or more can be awarded is different Role (is created by administrator), and each role correspond to one or several different authorities and (access certain application program The authority of interface), can just allow different users that there are different access rights by this mechanism.
User when operation that some certification passes through is carried out, can go to find which according to the role possessed by user by system Corresponding authority, if user has the authority that this operates, allows user to perform the operation, conversely, the operation of refusal user.
In prior art, user right controlling mechanism be not very flexibly, as shown in figure 1, when some role is created, And this role is authorized after a certain user, the user can possess the corresponding all permissions of the role, if the user will be removed To should a certain item authority of role just must go to remove the corresponding role of the user, cause and eliminate the user to should angle Other authorities of color, therefore, user right operation is with limitation.
The content of the invention
In view of this, the embodiment of the present invention provides a kind of control method and device of user right, to improve user right The flexibility of control.
In a first aspect, embodiments providing a kind of control method of user right, methods described includes:
The corresponding relation set up between user, role and authority;
Receive the operation requests of keeper's user to user, corresponding relation between role and authority;
According to the operation requests, the user, the corresponding relation between role and authority are operated accordingly.
Second aspect, the embodiment of the present invention additionally provide a kind of control device of user right, and described device includes:
Corresponding relation building module, for the corresponding relation set up between user, role and authority;
Operation requests receiver module, the corresponding relation for receiving keeper's user to user, between role and authority Operation requests;
Limiting operation module, for according to the operation requests, to the user, the corresponding relation between role and authority Operated accordingly.
The technical scheme of the present embodiment, by the corresponding relation set up between user, role and authority, administrator can Directly operated to a corresponding relation between user, role and authority therein accordingly, increasing or removing During a certain item authority of user, can directly increase or remove the corresponding relation between the user, role and the authority, it is not necessary to Increase or remove the corresponding role of the authority again for user, so as to improve the flexibility of user right control.
Description of the drawings
Fig. 1 is the schematic diagram of the relation in prior art between user, role and authority;
Fig. 2 is a kind of flow chart of the control method of user right that the embodiment of the present invention one is provided;
Fig. 3 is user in the control method of user right provided in an embodiment of the present invention, right between role and authority The schematic diagram that should be related to;
Fig. 4 is a kind of flow chart of the control method of user right that the embodiment of the present invention two is provided;
Fig. 5 is the API reception pipes by limiting operation in the control method of user right provided in an embodiment of the present invention The schematic diagram of the operation requests of reason person user;
Fig. 6 is a kind of structural representation of the control device of user right that the embodiment of the present invention three is provided.
Specific embodiment
The present invention is described in further detail with reference to the accompanying drawings and examples.It is understood that this place is retouched The specific embodiment stated is used only for explaining the present invention, rather than limitation of the invention.It also should be noted that, in order to just Part related to the present invention rather than full content are illustrate only in description, accompanying drawing.
Embodiment one
Fig. 2 is a kind of flow chart of the control method of user right that the embodiment of the present invention one is provided, and the present embodiment can fit For the situation of flexibly control user right, the method can be performed by the control device of user right, and the device can be by Realizing, the device can be only fitted in computer the mode of software and/or hardware, and the method specifically includes following steps:
Step 210, the corresponding relation set up between user, role and authority.
In the corresponding relation set up between user, role and authority, the corresponding relation with role according to user is first had to Determine the role that user has, further according to role and the corresponding relation of authority, determine authority of the user under the role, build Vertical user, the one-to-one relationship between role and authority, i.e., relation as shown in Figure 3.Fig. 3 is provided in an embodiment of the present invention User in the control method of user right, the schematic diagram of the corresponding relation between role and authority, as shown in figure 3, user 1, Role 1 and authority 1 are the records of a corresponding relation, and user 1, role 1 and authority 2 are the record of a corresponding relation again, from And when an authority of a user is removed, can directly remove user therein and the corresponding user of the authority, angle Corresponding relation (the authority 2 as removed user 1, directly by the corresponding relation of user 1, role 1 and authority 2 between color and authority Delete), from the corresponding role of the authority without removing the user again, the user can also possess its under the role His authority.
The control method of the user right that the present embodiment is provided can be used in the control of authority of safe cloud platform.Wherein, Safe cloud platform is referred to by by security function virtual machine, then in conjunction with the characteristic of cloud platform, security function being moved cloud On, realization carries out a platform of security protection to business on cloud and traditional business.Safe cloud platform is safety service platform Cleaned by service traffics to be first drawn to security service, be then then sent through business and processed, this addresses the problem cloud By using the feature of cloud, the problem of upper security protection also solves the problems, such as that protective capacities is not enough simultaneously.
Step 220, receives the operation requests of keeper's user to user, corresponding relation between role and authority.
Only administrator just can be operated to the corresponding relation between user, role and authority.When will to When corresponding relation between family, role and authority is operated, administrator first logs in, and computer examines the administrator Identity after, it is allowed to its login, administrator log in pass through after can initiate a correspondence between user, role and authority The operation requests of relation, the operation requests carry specific mode of operation, and computer receives the operation requests.
Step 230, according to the operation requests, is carried out accordingly to the user, the corresponding relation between role and authority Operation.
After the operation requests are received, institute is carried out to the user user, the corresponding relation between role and authority The operation of operation requests response is stated, for example, adds a corresponding relation between user, role and authority;Or, delete one Corresponding relation between user, role and authority;Or, change a corresponding relation between user, role and authority;Or Person, inquires about the record case of user, corresponding relation between role and authority.
The technical scheme of the present embodiment, by the corresponding relation set up between user, role and authority, administrator can Directly operated to a corresponding relation between user, role and authority therein accordingly, increasing or removing During a certain item authority of user, can directly increase or remove the corresponding relation between the user, role and the authority, it is not necessary to Increase for user again or remove the corresponding role of the authority, so that the operation to user right both can be specific to role Also specific to authority, rather than only the flexibility of user right control is improve specific to role.
On the basis of above-described embodiment, it is also optional including:
According to the corresponding relation, the authority of the user in the corresponding relation is controlled.
User can initiate the request to operating first when a certain operation (such as data modification operation) is performed, and calculate After machine receives the request of the operation, according to the corresponding role of the user, the user is inquired about in the corresponding relation and is possessed Authority, if the user have this operation authority, allow user perform the operation, otherwise refuse user perform the behaviour Make.
Embodiment two
Fig. 4 is a kind of flow chart of the control method of user right that the embodiment of the present invention two is provided, and the present embodiment is upper It is optimized on the basis of stating embodiment, in the operation of the corresponding relation for receiving keeper's user to user, role and authority Before request, further increase and the corresponding relation is stored in tables of data, the method specifically includes following steps:
Step 410, the corresponding relation set up between user, role and authority.
Step 420, the corresponding relation is stored in tables of data.
After the corresponding relation set up between user, role and authority, can be by the correspondence between user, role and authority Relation is stored in tables of data, as shown in table 1.
1 user of table, the mapping table between role and authority
ID User Role Authority
1 User 1 Role 1 Authority 1
2 User 1 Role 1 Authority 2
3 User 1 Role 2 Authority 3
4 User 2 Role 1 Authority 1
5 User 2 Role 2 Authority 3
6 User 3 Role 3 Authority 4
…… …… …… ……
As shown in table 1, user corresponding each authority has been carried out into single record, increase such that it is able to flexible or The a certain item authority of user is deleted, and does not affect other authorities for the role corresponding with the authority that user possesses.
Step 430, receives the operation requests of keeper's user to user, corresponding relation between role and authority.
Step 440, according to the operation requests, is carried out accordingly to the user, the corresponding relation between role and authority Operation.
Wherein, according to the operation requests, the user, the corresponding relation between role and authority are grasped accordingly Preferably include:
When the operation requests are to increase to specify the corresponding relation between user, role and authority to ask, this is specified Corresponding relation between user, role and authority is added in the tables of data;
When the operation requests be remove specified user, corresponding relation between role and authority is asked when, this is specified Corresponding relation between user, role and authority is deleted from the tables of data;
When the operation requests are to update to specify the corresponding relation between user, role and authority to ask, this is specified Corresponding relation between user, role and authority is updated accordingly.
When operation requests be increase specified user, the corresponding relation between role and authority is asked when, inquire about first When the tables of data, corresponding relation inquiring the specified user, between role and authority, can by the specified user, Corresponding relation before role and authority is directly appended in the tables of data;When an authority of user is removed, Ke Yizhi Connect and the specified user, the corresponding relation between role and authority are deleted from the tables of data;When a power for updating user In limited time, directly the specified user, the corresponding relation between role and authority can be updated accordingly.So as to further carry The high flexibility of user right control.
The technical scheme of the present embodiment, on the basis of above-described embodiment, by will be right between user, role and authority Should be related to that storage, in tables of data, more neatly can be controlled to the authority of user.
On the basis of above-mentioned technical proposal, keeper's user to user, the corresponding relation between role and authority are received Operation requests it is optional including:
Keeper's user to user is received by the API of limiting operation, the operation of corresponding relation between role and authority Request.
Fig. 5 is the API reception pipes by limiting operation in the control method of user right provided in an embodiment of the present invention The schematic diagram of the operation requests of reason person user.As shown in figure 5, the behaviour of the administrator received by the API of limiting operation Make request for API request, administrator is carried out increasing, deleted, updating or during inquiry operation in the authority to user, is led to first Cross limiting operation API initiate API request (API request as shown in Figure 5 1., API request 2., API request 3. and API request 4.), wherein, 1. API request is to increase a certain authority to user, and 2. API request is a certain authority for removing user, API request 3. it is a certain authority for updating user, 4. API request is some of inquiry user or all permissions.Computer is receiving this After API request, according to API request inquiry storage user, the tables of data of corresponding relation between role and authority, according to inquiry The result for arriving, the authority of user is increased (increases the note of the corresponding relation of user, role and an authority in tables of data Record), delete (record for deleting the corresponding relation of user, role and authority in tables of data), update (update the data user in table, The record of the corresponding relation of role and authority) or show authority Query Result.So as to when the authority to user is operated, make User right is operated with the mode for sending API request, can be come into force in time, and service need not be restarted, so as to convenient Control user right, and it is easy to administrator flexibly to control the authority of user, so as to largely simplify Administrator changes the operation of user right, makes the DRM operations more careful.
On the basis of above-described embodiment, it is also optional including:
The role that administrator creates is received, and specifies the user for adding the role;
According to the role and the specified user for adding the role, the user, the role and the corresponding authority of the role are determined Between corresponding relation, and preserve.
Administrator can also create role and the role is added to user, so as to by the user, the role and should Corresponding relation between the corresponding authority of role is stored in tables of data, so, accordingly will increase in tables of data one or A plurality of user, the corresponding relation between role and authority.
On the basis of above-described embodiment, administrator can also remove a certain role of user or add user's A certain role, so, can accordingly delete or increase user's all corresponding relations corresponding with the role in tables of data, that is, manage When reason person user removes a role of user, corresponding can delete to the corresponding all permissions of the role in the authority of the user, Accordingly can delete in tables of data and the user and the corresponding all of user of the role, the corresponding pass between role and authority System;When administrator increases a role of user, accordingly the user can be authorized by the role corresponding all permissions, counted According to can accordingly increase all users corresponding with the user and the role, the corresponding relation between role and authority in table.
Embodiment three
Fig. 6 is a kind of structural representation of the control device of user right that the embodiment of the present invention three is provided, such as Fig. 6 institutes Show, the control device of the user right described in the present embodiment includes:Corresponding relation building module 610, operation requests receiver module 620 and limiting operation module 630.
Wherein, corresponding relation building module 610, for the corresponding relation set up between user, role and authority;
Operation requests receiver module 620, for receiving keeper's user to user, the corresponding relation between role and authority Operation requests;
Limiting operation module 630, for according to the operation requests, to the user, the correspondence between role and authority Relation is operated accordingly.
Optionally, also include:
According to the corresponding relation, the authority of the user in the corresponding relation is controlled.
Preferably, also include:
Corresponding relation memory module, for the behaviour in the corresponding relation for receiving keeper's user to user, role and authority Before asking, the corresponding relation is stored in tables of data.
Optionally, the limiting operation module includes:
Authority adding device, is to increase to specify the correspondence between user, role and authority to close for working as the operation requests During system's request, the specified user, the corresponding relation between role and authority are added in the tables of data;
Authority delete unit, for when the operation requests be remove specified user, between role and authority correspondence close During system's request, the specified user, the corresponding relation between role and authority are deleted from the tables of data;
Authority updating block, is to update to specify the correspondence between user, role and authority to close for working as the operation requests During system's request, the specified user, the corresponding relation between role and authority are updated accordingly.
Optionally, the operation requests receiver module specifically for:
Keeper's user to user is received by the API of limiting operation, the operation of corresponding relation between role and authority Request.
The control device of above-mentioned user right can perform the controlling party of the user right provided by any embodiment of the present invention Method, possesses the corresponding functional module of execution method and beneficial effect.Ins and outs of detailed description in the present embodiment, can not join See the control method of the user right provided by any embodiment of the present invention.
Note, above are only presently preferred embodiments of the present invention and institute's application technology principle.It will be appreciated by those skilled in the art that The invention is not restricted to specific embodiment described here, can carry out for a person skilled in the art various obvious changes, Readjust and substitute without departing from protection scope of the present invention.Therefore, although the present invention is carried out by above example It is described in further detail, but the present invention is not limited only to above example, without departing from the inventive concept, also More other Equivalent embodiments can be included, and the scope of the present invention is determined by scope of the appended claims.

Claims (10)

1. a kind of control method of user right, it is characterised in that methods described includes:
The corresponding relation set up between user, role and authority;
Receive the operation requests of keeper's user to user, corresponding relation between role and authority;
According to the operation requests, the user, the corresponding relation between role and authority are operated accordingly.
2. method according to claim 1, it is characterised in that also include:
According to the corresponding relation, the authority of the user in the corresponding relation is controlled.
3. method according to claim 1 and 2, it is characterised in that receiving keeper's user to user, role and authority Corresponding relation operation requests before, also include:
The corresponding relation is stored in tables of data.
4. method according to claim 3, it is characterised in that according to the operation requests, to the user, role and power Corresponding relation between limit carries out corresponding operation to be included:
When the operation requests are to increase to specify corresponding relation between user, role and authority to ask, by the specified user, Corresponding relation between role and authority is added in the tables of data;
When the operation requests be remove specified user, corresponding relation between role and authority is asked when, by the specified user, Corresponding relation between role and authority is deleted from the tables of data;
When the operation requests are to update to specify corresponding relation between user, role and authority to ask, to the specified user, Corresponding relation between role and authority is updated accordingly.
5. method according to claim 1 and 2, it is characterised in that receive keeper's user to user, role and authority it Between the operation requests of corresponding relation include:
Keeper's user to user, right between role and authority is received by application programming interface API of limiting operation The operation requests that should be related to.
6. a kind of control device of user right, it is characterised in that described device includes:
Corresponding relation building module, for the corresponding relation set up between user, role and authority;
Operation requests receiver module, the operation of the corresponding relation for receiving keeper's user to user, between role and authority Request;
Limiting operation module, for according to the operation requests, carrying out to the user, the corresponding relation between role and authority It is corresponding to operate.
7. device according to claim 6, it is characterised in that also include:
According to the corresponding relation, the authority of the user in the corresponding relation is controlled.
8. the device according to claim 6 or 7, it is characterised in that also include:
Corresponding relation memory module, please for the operation in the corresponding relation for receiving keeper's user to user, role and authority Before asking, the corresponding relation is stored in tables of data.
9. device according to claim 8, it is characterised in that the limiting operation module includes:
Authority adding device, is to increase to specify the corresponding relation between user, role and authority to ask for working as the operation requests When asking, the specified user, the corresponding relation between role and authority are added in the tables of data;
Authority deletes unit, for when the operation requests be remove specified user, corresponding relation between role and authority please When asking, the specified user, the corresponding relation between role and authority are deleted from the tables of data;
Authority updating block, is to update to specify the corresponding relation between user, role and authority to ask for working as the operation requests When asking, the specified user, the corresponding relation between role and authority are updated accordingly.
10. the device according to claim 6 or 7, it is characterised in that the operation requests receiver module specifically for:
Keeper's user to user is received by the API of limiting operation, the operation requests of corresponding relation between role and authority.
CN201610980677.5A 2016-11-08 2016-11-08 The control method and device of user right Expired - Fee Related CN106529219B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610980677.5A CN106529219B (en) 2016-11-08 2016-11-08 The control method and device of user right

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610980677.5A CN106529219B (en) 2016-11-08 2016-11-08 The control method and device of user right

Publications (2)

Publication Number Publication Date
CN106529219A true CN106529219A (en) 2017-03-22
CN106529219B CN106529219B (en) 2019-04-09

Family

ID=58349911

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610980677.5A Expired - Fee Related CN106529219B (en) 2016-11-08 2016-11-08 The control method and device of user right

Country Status (1)

Country Link
CN (1) CN106529219B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491987A (en) * 2020-11-16 2021-03-12 珠海格力电器股份有限公司 User permission configuration method, device, server and configuration system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102402663A (en) * 2011-12-01 2012-04-04 浪潮电子信息产业股份有限公司 Method for customizing role authorization in management information system
US20140101439A1 (en) * 2012-10-05 2014-04-10 General Electric Company Systems and methods for authentication between networked devices
CN103780604A (en) * 2014-01-06 2014-05-07 中国科学技术大学苏州研究院 Ubiquitous resource user access control method for multiple roles
CN104463015A (en) * 2014-12-15 2015-03-25 浪潮通用软件有限公司 Authority management method and device
CN104519072A (en) * 2015-01-14 2015-04-15 浪潮(北京)电子信息产业有限公司 Authority control method and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102402663A (en) * 2011-12-01 2012-04-04 浪潮电子信息产业股份有限公司 Method for customizing role authorization in management information system
US20140101439A1 (en) * 2012-10-05 2014-04-10 General Electric Company Systems and methods for authentication between networked devices
CN103780604A (en) * 2014-01-06 2014-05-07 中国科学技术大学苏州研究院 Ubiquitous resource user access control method for multiple roles
CN104463015A (en) * 2014-12-15 2015-03-25 浪潮通用软件有限公司 Authority management method and device
CN104519072A (en) * 2015-01-14 2015-04-15 浪潮(北京)电子信息产业有限公司 Authority control method and device

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491987A (en) * 2020-11-16 2021-03-12 珠海格力电器股份有限公司 User permission configuration method, device, server and configuration system

Also Published As

Publication number Publication date
CN106529219B (en) 2019-04-09

Similar Documents

Publication Publication Date Title
US10848522B2 (en) Just-in-time access based on screening criteria to maintain control of restricted data in cloud computing environments
US10924497B2 (en) Just-in-time access based on geolocation to maintain control of restricted data in cloud computing environments
CN107948203A (en) A kind of container login method, application server, system and storage medium
CN111709046A (en) User permission data configuration method, device, equipment and storage medium
US20190147021A1 (en) Multiplexing, isolating and collaborative management information system and method
US8365261B2 (en) Implementing organization-specific policy during establishment of an autonomous connection between computer resources
CN103067463A (en) Centralized management system and centralized management method for user root permission
CN105592052A (en) Method and device for configuring firewall rules
US11126460B2 (en) Limiting folder and link sharing
CN107515783A (en) Application container management-control method and device based on application container cluster tool
CN111274561A (en) Identity management method, device, equipment and storage medium
CN112738200B (en) Convenient operation and maintenance tool and method based on closed public network system
CN111815301B (en) Cooperative office management and control method and device and readable storage medium
TW201346623A (en) Control system and method for network service level and function of virtual desktop application in cloud
CN108270858A (en) A kind of private cloud framework and its data processing method based on API gateway
US20040199639A1 (en) Automated shared drive mapping
CN106529219A (en) User authority control method and device
CN107203594A (en) A kind of data processing equipment, method and computer-readable recording medium
KR101923639B1 (en) Network security apparatus
CN106130969A (en) The method of controlling security of a kind of system for cloud computing and system
EP2778956A2 (en) Processing a link on a device
CN104506524B (en) Distinguish user domain and to the transparent AAA system of network access server and method
CN112069474B (en) Method for using and forgetting user data and third-party trusted server
KR102269885B1 (en) An access control system of making up customized server work environment for each user
US20220400021A1 (en) Network multi-tenant architecture for distributed ledger systems

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20190409

Termination date: 20201108

CF01 Termination of patent right due to non-payment of annual fee