CN102096785B - Authority control method and device - Google Patents
Authority control method and device Download PDFInfo
- Publication number
- CN102096785B CN102096785B CN2011100454763A CN201110045476A CN102096785B CN 102096785 B CN102096785 B CN 102096785B CN 2011100454763 A CN2011100454763 A CN 2011100454763A CN 201110045476 A CN201110045476 A CN 201110045476A CN 102096785 B CN102096785 B CN 102096785B
- Authority
- CN
- China
- Prior art keywords
- authority
- role
- descriptor
- data
- self
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 26
- 238000004422 calculation algorithm Methods 0.000 claims description 37
- 230000000694 effects Effects 0.000 claims description 17
- 238000004458 analytical method Methods 0.000 claims description 5
- 238000013515 script Methods 0.000 claims description 5
- JEIPFZHSYJVQDO-UHFFFAOYSA-N ferric oxide Chemical compound O=[Fe]O[Fe]=O JEIPFZHSYJVQDO-UHFFFAOYSA-N 0.000 description 13
- 238000004364 calculation method Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 2
- 239000012141 concentrate Substances 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The embodiment of the invention provides an authority control method and device which can be used for flexibly setting the user-defined authority. The authority control method comprises the following steps: pre-registering and storing authority description information of a user-defined authority; storing the authority value of the user-defined authority set for a role corresponding to one data by virtue of application software; searching the authority value of the role relative to the data according to the corresponding request of one role corresponding to one data; and analyzing and determining whether the current role has the authority according to the authority description information.
Description
Technical field
The present invention relates to the file processing field, relate in particular to a kind of authority control method and device.
Background technology
In the prior art; Document file library system itself has certain default access for factors such as safety, as checks document; Check catalogue etc.; But these authorities all are simple two-value authorities, can't satisfy application increased requirement with rapid changepl. never-ending changes and improvements, print the umber authority such as being beyond expression and show number of watermarks authority etc.
Even more important thing though the mode of present self-defined authority is stored in the document file library system, when judging authority, all is that application software is at first obtained corresponding authority information from document file library system, and is judged by application software at every turn.In this case, document file library system can't be understood the implication of self-defined authority itself as just storage tool.Simultaneously, under the situation, the usable range of self-defined authority has also strict control like this, that is, the authority of which application software definition can only be judged by himself.For instance, application software A has defined authority a in document library, and at this moment only application software A could understand authority a, and authority a is only effective to using software A; When a certain role passes through application software B access document storehouse system, because application software B can't understand authority a, can not judge, so authority a is invalid to using software B to authority a.That is to say that the method for prior art makes self-defined authority only effective to specific program, rather than all can use the program in the document storehouse effective.
Secondly, because document file library system itself has a large amount of operations, make that the authority that is in outside application software setting will be very difficult with original authority perfect cooperation.For example; Application software A is provided with a self-defined authority a, but has the variation of 5 authorities all can have influence on self-defined authority a in the document file library system in the default access, and application software A just must detect the variation of 5 authorities constantly so; The as easy as rolling off a log authority that occurs is judged careless mistake, and the system that makes starts a leak.
For this reason, need press for a kind of authority control method, can overcome the above problems simultaneously.
Summary of the invention
The technical matters that the present invention will solve provides a kind of authority control method and device, and self-defined authority can be set more flexibly.
In order to address the above problem, the embodiment of the invention provides a kind of authority control method, comprising:
Registered in advance is also preserved the authority descriptor of a self-defined authority;
Preserve through application software and set authority credentials the said self-defined authority of data for the role;
According to the corresponding operating request of a role to data, search a said role to the authority credentials of said data, and according to the analysis of authority descriptor and judge whether a said role has authority.
Wherein, said authority descriptor comprises:
Authority name is used for the said self-defined authority of unique sign;
Data type is used to indicate the data type of authority credentials;
The authority comparison algorithm is used to define the implication of authority numerical value; And/or
Authority effect algorithm is used to describe the influence of this authority to other authorities.
Wherein, said authority descriptor further comprises:
The default value of authority under unauthorized state.
Wherein, adopt preset algorithm mode or embedding script mode to describe said authority comparison algorithm, authority effect algorithm.
The embodiment of the invention also provides a kind of control of authority device, comprising:
First module is used to preserve the authority descriptor of a self-defined authority;
Second module is used to preserve through application software and sets the authority credentials to the said self-defined authority of data for the role;
Three module is used for the corresponding operating request to data according to a role, searches a said role to the authority credentials of said data, and according to the analysis of authority descriptor and judge whether a said role has authority.
Wherein, further comprise:
Four module is used for the judged result according to three module, carries out corresponding operation; Or refusal is carried out corresponding operation.
Through the technical scheme that the embodiment of the invention provides, technical scheme of the present invention can be provided with all kinds of self-defined authorities according to various demands, and the determination methods for all kinds of self-defined authorities is provided.Utilize this mode; Make document file library system to understand and resolve authority according to the authority descriptor; Judge thereby do authority, finally can be so that the authority of an application software definition is not done under any corresponding situation about realizing still effective at Another Application software; Make that can share various self-defining special authorities between different application software limits, and improves system extension property.In addition; Even in triangular web; Self-defined authority definition becomes the some of document file library system, makes application software need both not alleviate the difficulty of applied software development in each module to frequent the testing of authority; Also make self-defined authority and document library preset authority simultaneously and combine closely, reduced the authority leak of system.
Description of drawings
The schematic flow sheet of a kind of authority setting method that provides for one embodiment of the invention shown in Figure 1;
The schematic flow sheet of the authority setting method that provides for another embodiment of the present invention shown in Figure 2.
Embodiment
To combine accompanying drawing and embodiment that technical scheme of the present invention is explained in more detail below.
Need to prove that if do not conflict, each characteristic among the embodiment of the invention and the embodiment can mutually combine, all within protection scope of the present invention.In addition; Can in computer system, carry out in the step shown in the process flow diagram of accompanying drawing such as a set of computer-executable instructions, and, though logical order has been shown in process flow diagram; But in some cases, can carry out step shown or that describe with the order that is different from here.
The embodiment of the invention provides a kind of authority setting method, and this method can be applicable in the document file library system, and wherein document file library system is the first floor system that the document data operation is provided, and application software is the upper layer application system around the document file library system functional development.As shown in Figure 1, this method comprises the steps:
Step 101: provide a self-defined authority descriptor registration a self-defined authority; Specifically, the descriptor of authority is by constituting like the lower part:
Authority name: be used for this authority of unique sign, can obtain/be provided with the authority credentials of this authority through this title;
The data type of authority: be used to indicate the data type of authority credentials, like integer, character type, date type etc.; Such as for printing the umber authority, data type can be an integer; For term of validity authority, data type can be the date type;
The authority comparison algorithm is described: the implication of definition authority numerical value; Such as, when the umber authority was printed in definition, the authority comparison algorithm can be: the umber value was greater than 0 o'clock, and expression has print right, otherwise does not have print right;
Authority effect arthmetic statement: be used to describe the effect behind this authority setting, like influence to other authorities.
Illustrate, if the authority effect algorithm of self-defining printing umber authority is: authority credentials is 0 to show there is not print right; So, even certain role has print right, when this role's printing umber authority authority credentials was 0, this role did not still possess print right.
In an embodiment of the present invention, the descriptor of authority can also comprise: the default value under the unauthorized situation is defined in when authority not being set role's operating right; If can define: when not giving any print right, mean that this role does not have any authority to some roles; Perhaps also can define: when not giving any print right, mean that this role has the one or many print right some roles.For instance, for printing the umber authority, default value can be 0, i.e. expression is not authorized and just do not had print right; Also can be 9999, i.e. it be exactly unconfined printing that expression is not authorized.
Document file library system can mainly utilize authority comparison algorithm and authority effect algorithm in follow-up authority is judged.
Document file library system is only preserved authority credentials information in the prior art, exactly because what store in the present invention's document file library system is the authority descriptor, makes document file library system be appreciated that the authority implication.
It will be appreciated by those skilled in the art that: this step promptly can be to initiate through application software, registers to document file library system; Also can be directly to register voluntarily by document file library system.
In an embodiment of the present invention; Can in system, preset, preserve multiple different authority comparison algorithm and/or authority effect algorithm in advance; Every kind of algorithm all has unique identification, in the authority descriptor, directly adopts unique identification to describe authority comparison algorithm and/or authority effect algorithm like this.
In another embodiment of the present invention, can also be to adopt the embedding script mode to describe authority comparison algorithm and/or authority effect algorithm.As using javascript, scripts such as perl are realized an authority comparison algorithm and/or authority effect algorithm by the special interface mode, in said descriptor, adopt to embed script describing authority comparison algorithm and/or authority effect algorithm.
Step 102: through application software is that a certain role sets the authority to a certain data, specifically, is the role and gives authority credentials to certain data; Document file library system is preserved this authority credentials.
Step 103: according to operation requests the operation requests of a certain data (role to), search the corresponding authority value of role to these data, and according to the analysis of authority descriptor and judge whether current role has authority.
Here, the application software of transmit operation request can be identical or different with the application software of setting the corresponding authority descriptor.
When receiving the operation requests of application software, search relevant authority credentials, and relevant authority descriptor; Judge whether to have associated rights according to authority comparison algorithm in authority credentials and the authority descriptor and/or authority effect algorithm.As a rule, if authority credentials meets the rule in authority comparison algorithm and/or the authority effect algorithm, then has corresponding operating right.
Step 104: if authority is arranged then carry out corresponding operating according to operation requests; Otherwise the corresponding operation of refusal.
After having adopted the method for present embodiment, can realize that a plurality of application software share self-defined authority.
It will be understood by those skilled in the art that above method not only can be applied to document file library system, can also be applied to other platform softwares.
Below be that example further specifies embodiment of the invention authority control method with self-defined printing umber authority.In this example, print umber and be meant the quantity that allows the user to print, as shown in Figure 2, this method comprises the steps:
Step 201: application software A registers self-defined authority p.
Step 202: document file library system is stored the descriptor of self-defined authority p, and is specific as follows:
Authority name: print the umber authority;
Type: integer;
Comparison algorithm: use and preset algorithm, specifically, authority credentials＞0 expression has print right, otherwise is no print right;
Effect algorithm: use and preset algorithm, specifically, promptly do not have print right if authority is set;
Default value: 0, promptly acquiescence does not allow to print.
Step 203: when application software A persona R authorized, persona R specified documents D was provided with the authority credentials of self-defined authority p.Is 5 such as role R can be set to the authority credentials of the authority p of document D.
Step 204: document file library system is preserved the authority credentials of role R to the authority p of document D according to being provided with of application software A.
Step 205: application software B uses role R to login, and sends the document library operation requests, and document D is printed.
Step 206: document file library system at first can travel through all authorities, finds whether printing umber authority can have influence on print right effective; Document file library system further obtains authority credentials and the printing umber authority descriptor of role R to the authority p of document D; And rights of using comparison algorithm (promptly＞0) is verified authority credentials; If draw authority credentials greater than 0 through judging; Show that then role R has print right to document D, jumps to step 208, otherwise carry out step 207.Such as, be 5 o'clock if role R is directed against the authority credentials of the authority p of document D, because 5＞0, so this moment, role R had print right to document D.
Step 207: the operation of prompting lack of competence, process ends.
Step 208: document file library system is handled the print request of application software B, the beginning printing.Behind every printing portion role R is deducted 1 to the authority credentials of the printing umber authority of document D.
One embodiment of the invention also provides a kind of control of authority device, and this device comprises:
First module is used to preserve the authority descriptor of self-defined authority;
Second module, being used to preserve through application software is that a certain role sets the authority credentials to a certain data;
Three module is used for finding corresponding authority credentials and corresponding authority descriptor according to operation requests; And judge according to authority comparison algorithm in the authority descriptor and/or authority effect algorithm whether current role has authority;
Four module is used for the judged result according to three module, carries out corresponding operation; Or refusal is carried out corresponding operation.
In this embodiment, the existing functional module of each module of this device in can multiplexing document file library system.First module can be used as and offers application software is set the descriptor of authority in document file library system a interface.In this embodiment, said second module can also be used for when receiving application software to a role Authorized operation, finds the descriptor of corresponding authority according to this Authorized operation, in this descriptor, preserves this role's authority credentials.Other realizes that details can be identical with embodiment one, two.
Obviously, it is apparent to those skilled in the art that each above-mentioned module or each step can realize with the general calculation device; They can concentrate on the single calculation element; Perhaps be distributed on the network that a plurality of calculation element forms, alternatively, they can be realized with the executable program code of calculation element; Thereby; Can they be stored in the memory storage and carry out, perhaps they are made into each integrated circuit modules respectively, perhaps a plurality of modules in them or step are made into the single integrated circuit module and realize by calculation element.Like this, the present invention is not restricted to any specific hardware and software combination.
Certainly; The present invention also can have other various embodiments; Under the situation that does not deviate from spirit of the present invention and essence thereof; Those of ordinary skill in the art work as can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection domain of claim of the present invention.
Claims (6)
1. an authority control method is characterized in that, comprising:
Registered in advance is also preserved the authority descriptor of a self-defined authority;
Preserve through application software and set authority credentials the said self-defined authority of data for the role;
According to the corresponding operating request of a role to data, search a said role to the authority credentials of said data, and according to the analysis of authority descriptor and judge whether a said role has authority.
2. the method for claim 1 is characterized in that, said authority descriptor comprises:
Authority name is used for the said self-defined authority of unique sign;
Data type is used to indicate the data type of authority credentials;
The authority comparison algorithm is used to define the implication of authority numerical value; And/or
Authority effect algorithm is used to describe the influence of this authority to other authorities.
3. method as claimed in claim 2 is characterized in that, said authority descriptor further comprises:
The default value of authority under unauthorized state.
4. method as claimed in claim 2 is characterized in that, adopts the preset algorithm mode or embeds script mode and describe said authority comparison algorithm, authority effect algorithm.
5. a control of authority device is characterized in that, comprising:
First module is used to preserve the authority descriptor of a self-defined authority;
Second module is used to preserve through application software and sets the authority credentials to the said self-defined authority of data for the role;
Three module is used for the corresponding operating request to data according to a role, searches a said role to the authority credentials of said data, and according to the analysis of authority descriptor and judge whether a said role has authority.
6. device as claimed in claim 5 is characterized in that, further comprises:
Four module is used for the judged result according to three module, carries out corresponding operation; Or refusal is carried out corresponding operation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011100454763A CN102096785B (en) | 2011-02-24 | 2011-02-24 | Authority control method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011100454763A CN102096785B (en) | 2011-02-24 | 2011-02-24 | Authority control method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102096785A CN102096785A (en) | 2011-06-15 |
| CN102096785B true CN102096785B (en) | 2012-12-19 |
Family
ID=44129875
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2011100454763A Active CN102096785B (en) | 2011-02-24 | 2011-02-24 | Authority control method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102096785B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104657656A (en) * | 2015-03-06 | 2015-05-27 | 中国银行股份有限公司 | Operation safety control method and device based on banking system |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105426769B (en) * | 2015-10-30 | 2018-01-26 | 歌尔股份有限公司 | The dynamic control method and system of role-security |
| CN106874351B (en) * | 2016-12-27 | 2021-04-20 | 浙江宇视科技有限公司 | Authority control method and equipment |
| CN108600167A (en) * | 2018-03-19 | 2018-09-28 | 中国电子科技集团公司第三十研究所 | A kind of communication device and method of the network watermark based on OpenFlow |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1505899A (en) * | 2001-08-09 | 2004-06-16 | ���µ�����ҵ��ʽ���� | Unified Rights Management for Intellectual Property Management and Protection (IPMP) Systems |
| CN1851724A (en) * | 2005-07-13 | 2006-10-25 | 华为技术有限公司 | Business data operation coutrol method and business system |
| CN1967560A (en) * | 2006-11-09 | 2007-05-23 | 华为技术有限公司 | Controlling method of business operations competence and generating method of relational database |
| CN1971576A (en) * | 2006-12-08 | 2007-05-30 | 华中科技大学 | On-line digital copyright management method and its management server |
| CN101539922A (en) * | 2008-03-18 | 2009-09-23 | 北京书生国际信息技术有限公司 | Method for realizing authority of document library system |
| CN101645126A (en) * | 2009-09-07 | 2010-02-10 | 浪潮集团山东通用软件有限公司 | Method for controlling service-oriented authorization access based on RBAC model extension |
| CN101847197A (en) * | 2009-03-24 | 2010-09-29 | 上海任登信息科技有限公司 | Method for controlling document access authority |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2004192262A (en) * | 2002-12-10 | 2004-07-08 | Fuji Photo Film Co Ltd | Document data access restriction device and method |
| CN101405760A (en) * | 2004-10-04 | 2009-04-08 | 康坦夹德控股股份有限公司 | Authority providing and awarding system and method for using shared status variable |
| CN101369296A (en) * | 2007-08-14 | 2009-02-18 | 北京书生国际信息技术有限公司 | Method and system for implementing off-line printing limitation |
| CN101859352A (en) * | 2009-04-09 | 2010-10-13 | 北京书生国际信息技术有限公司 | Method, system, application software and platform software for controlling authority |
-
2011
- 2011-02-24 CN CN2011100454763A patent/CN102096785B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1505899A (en) * | 2001-08-09 | 2004-06-16 | ���µ�����ҵ��ʽ���� | Unified Rights Management for Intellectual Property Management and Protection (IPMP) Systems |
| CN1851724A (en) * | 2005-07-13 | 2006-10-25 | 华为技术有限公司 | Business data operation coutrol method and business system |
| CN1967560A (en) * | 2006-11-09 | 2007-05-23 | 华为技术有限公司 | Controlling method of business operations competence and generating method of relational database |
| CN1971576A (en) * | 2006-12-08 | 2007-05-30 | 华中科技大学 | On-line digital copyright management method and its management server |
| CN101539922A (en) * | 2008-03-18 | 2009-09-23 | 北京书生国际信息技术有限公司 | Method for realizing authority of document library system |
| CN101847197A (en) * | 2009-03-24 | 2010-09-29 | 上海任登信息科技有限公司 | Method for controlling document access authority |
| CN101645126A (en) * | 2009-09-07 | 2010-02-10 | 浪潮集团山东通用软件有限公司 | Method for controlling service-oriented authorization access based on RBAC model extension |
Non-Patent Citations (1)
| Title |
|---|
| JP特开2004-192262A 2004.07.08 |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104657656A (en) * | 2015-03-06 | 2015-05-27 | 中国银行股份有限公司 | Operation safety control method and device based on banking system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102096785A (en) | 2011-06-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108564339B (en) | Account management method, device, terminal equipment and storage medium | |
| US20090165100A1 (en) | Web page safety judgment system | |
| Gajek et al. | Analysis of signature wrapping attacks and countermeasures | |
| CN102957664B (en) | A kind of method and device identifying fishing website | |
| CN102096785B (en) | Authority control method and device | |
| CN103309985B (en) | For business service registration and dissemination method and the system thereof of service register center | |
| CN109948343A (en) | Leak detection method, Hole Detection device and computer readable storage medium | |
| CN101288098A (en) | Remote informed watermark detection system | |
| CN112231686B (en) | System security authentication method and device based on security authentication identification | |
| CN102713925A (en) | Sensitive information leakage prevention system, sensitive information leakage prevention method and sensitive information leakage prevention program | |
| CN107635221A (en) | A kind of car-mounted terminal identifying processing method and device | |
| US9485270B2 (en) | Polluting results of vulnerability scans | |
| CN108063833A (en) | HTTP dns resolutions message processing method and device | |
| JP2012243318A (en) | Method for enhancing security in interaction using tag | |
| CN104462366B (en) | The browser and its method for viewing thumbnail of a kind of computing device | |
| JP5661290B2 (en) | Information processing apparatus and method | |
| CN104238965A (en) | Printing selection method and electronic device | |
| CN102150090A (en) | Method for providing control information for a distributed operation in an automation system, computer program and automation system | |
| KR20190020963A (en) | Protecting personal information leakage interception system | |
| CN104375935A (en) | Method and device for testing SQL injection attack | |
| CN106959975B (en) | Transcoding resource cache processing method, device and equipment | |
| US20140297953A1 (en) | Removable Storage Device Identity and Configuration Information | |
| CN107222494A (en) | A kind of SQL injection attack defending component and method | |
| CN106657436A (en) | Message processing method and device | |
| CN103544445A (en) | Right control method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| ASS | Succession or assignment of patent right |
Owner name: BEIJING SURSEN ELECTRONIC CO., LTD. Free format text: FORMER OWNER: BEIJING SURESENSE INTERNATIONAL INFORMATION TECHNOLOGY CO., LTD. Effective date: 20120511 Owner name: TIANJIN SHUSHEN SOFTWARE TECHNOLOGY CO., LTD. Free format text: FORMER OWNER: BEIJING SURSEN ELECTRONIC CO., LTD. BEIJING SURSEN NETWORK TECHNOLOGY CO., LTD. BEIJING SURSEN DIGITAL LIBRARY SOFTWARE TECHNOLOGY CO., LTD. Effective date: 20120511 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20120511 Address after: 100191, Room 408, Taixing building, 11 Garden East Road, Beijing, Haidian District Applicant after: Beijing Sursen Electronic Technology Co., Ltd. Co-applicant after: Tianjin Scholar Software Technology Co., Ltd. Address before: 100191, room 407, Taixing building, 11 Garden East Road, Beijing, Haidian District Applicant before: Beijing Suresense International Information Technology Co., Ltd. Co-applicant before: Beijing Sursen Electronic Technology Co., Ltd. Co-applicant before: Beijing Sursen Network Technology Co., Ltd. Co-applicant before: Beijing Sursen Digital Library Software Technology Co., Ltd. |
|
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20181229 Address after: 100029 Changxin Building 408-409, 39 Anding Road, Chaoyang District, Beijing Patentee after: Beijing Sursen Electronic Technology Co., Ltd. Address before: Room 408, Taixing Building, 11 Garden East Road, Haidian District, Beijing, 100191 Co-patentee before: Tianjin Scholar Software Technology Co., Ltd. Patentee before: Beijing Sursen Electronic Technology Co., Ltd. |