CN112100592A - Authority management method, device, electronic equipment and storage medium - Google Patents

Abstract

The application provides a method and a device for managing authority, electronic equipment and a storage medium, which belong to the technical field of information, and the method comprises the following steps: if the specified operation of the user is monitored, acquiring the organization information to which the user belongs; judging whether the organization of the user is changed according to the organization information; if so, recovering the first resource queue authority of the user, and distributing a second resource queue authority for the user; the first resource queue authority is a resource queue authority corresponding to an original organization of the user, and the second resource queue authority is a resource queue authority corresponding to an existing organization of the user. The method and the device can effectively guarantee the safety of the resources and can enable the resources to be more convenient to manage.

Description

Rights management method, device, electronic device and storage medium

technical field

The present application belongs to the field of information technology, and specifically relates to rights management methods, apparatuses, electronic devices and storage media.

Background technique

All walks of life attach great importance to the security of their own resources. For example, the e-commerce industry uses big data resources for precision marketing, the financial industry uses big data resources to determine the timing of equity transactions, and the security industry also uses big data resources to capture criminals in the process of law enforcement. No matter what the application scenario is, most of them will have a platform for big data management (also called a big data platform or a resource management platform), and personnel with resource-related permissions can perform corresponding operations, such as those with resource access permissions. Personnel can access relevant data. However, business scenarios are complex and changeable, and business personnel change frequently, making it difficult to effectively manage resource-related permissions owned by personnel. For those who leave or transfer positions, there are security issues such as resource leakage.

SUMMARY OF THE INVENTION

In order to overcome the problems existing in the related art at least to a certain extent, the present application provides a rights management method, apparatus, electronic device and storage medium, which can effectively ensure the security of resources and make resources more convenient to manage.

To achieve the above purpose, the application adopts the following technical solutions:

In a first aspect, the present application provides a rights management method, comprising: if a designated operation of a user is monitored, acquiring information about an organization to which the user belongs; judging whether the organization to which the user belongs has changed according to the organization information; if so, Reclaim the user's first resource queue authority, and assign the user a second resource queue authority; wherein, the first resource queue authority is the resource queue authority corresponding to the user's original organization, and the second resource queue authority The resource queue authority is the resource queue authority corresponding to the current organization of the user.

Further, the method further includes: if an access request from the user to the target resource is received, sending the access request to the owner of the target resource for approval; according to the approval result of the owner of the target resource Access rights of the user to the target resource are determined.

Further, the step of determining the access authority of the user to the target resource according to the approval result of the owner of the target resource includes: if the approval result of the owner of the target resource is that the access request is rejected, determining The user does not have the access right of the target resource; if the approval result of the owner of the target resource is to approve the access request, the access request is sent to the manager for approval, and it is determined when the manager's approval is passed The user has the access right to the target resource, and it is determined that the user does not have the access right to the target resource when the manager approves and rejects it.

Further, the step of sending the access request to the owner of the target resource for approval includes: searching for the owner of the target resource according to the owner tag corresponding to the target resource; The request is sent to the owner of the found target resource for approval.

Further, the method further includes: setting a permission group for a specified resource; adding a user who has access permission to the specified resource to the permission group; controlling the user's access to the specified resource through the permission group Permission granularity size; wherein, the permission granularity size is used to represent the access scope of the specified resource.

Further, the method further includes: if a target user currently in a resignation state is detected, removing the target user from the permission group where the target user is located.

Further, the permission types corresponding to the permission group include one or more of resource addition permission, resource deletion permission, resource modification permission and resource search permission.

In a second aspect, the present application provides an authority management device, comprising: an information acquisition module, configured to acquire information about an organization to which the user belongs if a designated operation of the user is monitored; Whether the organization where the user is located has changed; the authority assignment module is used to reclaim the first resource queue authority of the user when the judgment result of the judgment module is yes, and allocate the second resource queue authority to the user; wherein , the first resource queue authority is the resource queue authority corresponding to the user's original organization, and the second resource queue authority is the resource queue authority corresponding to the user's current organization.

In a third aspect, the present application provides an electronic device, comprising: a processor and a storage device; a computer program is stored on the storage device, and the computer program executes any one of the first aspect when executed by the processor the method described.

In a fourth aspect, the present application provides a storage medium, where a computer program is stored on the storage medium, and when the computer program is run by a processor, the steps of the method according to any one of the above-mentioned first aspects are executed.

The above-mentioned rights management method, device, electronic device and storage medium provided by the present application acquire the information of the organization to which the user belongs when monitoring the designated operation of the user, and judge whether the organization to which the user belongs has changed according to the organization information, and if so, the user is recovered. The first resource queue authority is assigned to the user, and the second resource queue authority is allocated to the user; wherein, the first resource queue authority is the resource queue authority corresponding to the user's original organization, and the second resource queue authority is the resource corresponding to the user's current organization. Queue permissions. In this way, resource queue permissions can be automatically adjusted for users whose organizations have changed, which can effectively ensure the security of resources and make resources easier to manage.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not limiting of the present application.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

1 is a flowchart of a method for rights management according to an exemplary embodiment;

FIG. 2 is a flowchart showing a resource application according to an exemplary embodiment;

3 is a schematic flowchart of automatic authorization and recovery of permissions according to an exemplary embodiment;

Fig. 4 is a structural block diagram of an apparatus for rights management according to an exemplary embodiment.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the examples in this application, all other implementations obtained by those of ordinary skill in the art without creative work fall within the scope of protection of this application.

Considering the complex and changeable business scenarios and frequent changes of business personnel, it is difficult to effectively manage the resource-related authority owned by personnel, and there are security issues such as resource leakage, the present application provides a authority management method, device, electronic The device and the storage medium can effectively guarantee the security of resources and make the resources easier to manage. For ease of understanding, this application is introduced in detail below.

First, refer to the flowchart of a rights management method shown in FIG. 1 , which mainly includes the following steps S102 to S106:

In step S102, if the designated operation of the user is monitored, the information of the organization to which the user belongs is acquired. The specified operation can be, for example, a user's login operation for the platform where the resource is located (such as a resource management system), and then obtains the organization information to which the user belongs according to the identity information (such as account number, mailbox, etc.) entered by the user when logging in. In a specific implementation manner, in order to ensure resource security, when any user performs a specified operation such as a login operation, the execution of the rights management method of the present application will be triggered.

The above-mentioned organization information may specifically be information of the organization to which the user belongs, such as information of the department or department where the user is located, which may also be referred to as organizational structure information.

Step S104, according to the organization information, determine whether the organization where the user is located has changed; if yes, go to step S106, if not, go to step S108.

For example, if user A's original organization is the development room of the big data center, and then he is transferred to the second development room of the big data center or is dispatched to other parts, it can be understood that the organization of user A has changed. In practical applications, the organization information of the user's last login and the organization information of the user's current login can be retrieved, and whether the user's organization has changed is determined by comparing the two organization information.

Step S106, recovering the user's first resource queue authority, and assigning a second resource queue authority to the user; wherein, the first resource queue authority is the resource queue authority corresponding to the user's original organization, and the second resource queue authority is the user's current resource queue authority. The resource queue permission corresponding to the belonging organization.

The programs that users need to run to access big data resources usually require certain computing resources, and the resource queue can provide computing resources for them. The specific implementation of the resource queue can refer to the resource scheduler, which will not be repeated here. Different organizations have different resource queue permissions, and accordingly, the amount of computing resources that can be enjoyed is different. In practical applications, corresponding resource queues can be allocated to each organization in advance, and each organization can be bound to the corresponding resource queue. When it is detected that the user's organization has changed, it means that the resource queue authority that the user has has changed. Therefore, it is necessary to re-determine the resource queue available to the user. In the specific implementation, the original record corresponding to the user in the original organization can be deleted. and record the new resource queue name corresponding to the user's existing organization.

For each organization, only users belonging to the organization have access rights to the resource queue bound to the organization, and utilize the resource queue bound to the organization, such as submitting tasks on the resource queue bound to the organization. When the user's organization changes, the user cannot submit tasks on the original resource queue, but can only submit tasks on the resource queue corresponding to the changed organization. In practical applications, it is also possible to quickly locate the resource queue corresponding to the user's existing organization when the user fails to submit a task on the resource queue corresponding to the original organization.

Step S108, maintaining the user's first resource queue authority.

When it is detected that the user's organization has not changed, the user's resource queue permissions remain unchanged, and the amount of computing resources that can be enjoyed remains unchanged.

In the above manner, the resource queue authority can be automatically adjusted for users whose organization has changed, which can effectively ensure the security of the resources, and can make the resources more convenient to manage.

In order to further ensure the access security of resources, this embodiment may further refer to the following steps a and b to perform the following steps for users who apply for resource access:

Step a: If a user's access request for the target resource is received, the access request is sent to the owner of the target resource for approval.

In one embodiment, the owner of the target resource can be searched according to the owner tag corresponding to the target resource; the access request is sent to the found owner of the target resource for approval. In practical applications, the owner of the resource can be pre-determined, and a label is attached to the owner of the resource (or the publisher of the resource), so as to directly find the owner of the resource based on the label.

Step b: Determine the user's access authority to the target resource according to the approval result of the owner of the target resource. The owner of the target resource approves the target resource that the user applies to access, which can effectively control sensitive data resources and improve data security.

In an implementation manner, if the approval result of the owner of the target resource is passed, it can be determined that the user has access rights to the target resource.

In another implementation manner, after the approval result of the owner of the target resource is passed, it may be sent to the upper-level administrator for further approval. That is, if the approval result of the owner of the target resource is that the access request is rejected, it is determined that the user does not have the access right to the target resource; if the approval result of the owner of the target resource is that the access request is approved, the access request is further sent to the manager. Approval is carried out, and when the manager's approval is approved, it is determined that the user has the access right to the target resource, and when the manager's approval is rejected, it is determined that the user does not have the access right to the target resource.

For ease of understanding, based on the above steps a and b, this embodiment provides a specific implementation example. Referring to a flowchart of a resource application shown in FIG. 2 , it mainly includes the following steps S202 to S220:

Step S202: the user logs in. For example, users log in to the resource management system of the big data platform.

Step S204: The user applies for a cluster account.

Step S206: Determine whether the account application request is approved or not. If yes, go to step S208 and/or step S210; if no, go to step S218; in practical applications, some resources can be accessed by the user as long as the user applies for a cluster account without further approval, so as to ensure the smoothness of the business. If the security of the resource is strong, it needs to go through the approval process before it can be accessed, so as to ensure the security of the data. In this way, the fluency of the business and the security of the data can also be effectively balanced.

Step S208: Automatically open relevant resources for the user according to the user's organizational information.

Step S210: The user applies for cluster resources.

Step S212: Determine whether the resource owner approves or not. If yes, go to step S214, if not, go to step S220;

Step S214: Determine whether the administrator approves or not. If yes, go to step S216, if not, go to step S220;

Step S216: Terminate, the user can access the applied resource.

Step S218: Terminate, the user cannot access any resources.

Step S220: Terminate, the user cannot access the applied resource.

In addition, the coarse and fine granularity of resource access rights in the prior art cannot be dynamically adjusted, resulting in a failure to achieve a good balance between business fluency and data security. For example, when users access hive warehouse data, they can access the data in the entire database, and You can only access the data of a certain table or you can only access the data of a few fields. If the granularity of permissions is coarse, everyone can view the data resource, which ensures the smoothness of the business, but the security of the data cannot be guaranteed; if the granularity of permissions is very fine, everyone only has field-level access permissions, which ensures data security. Security, but greatly reduces the fluency of business. In order to improve this problem, the present application can further perform the following steps 1 to 3:

Step 1: Set a permission group for the specified resource; the permission types corresponding to the permission group include one or more of resource addition permission, resource deletion permission, resource modification permission and resource search permission. A permission group can be understood as a certain permission of the specified resource is divided into the permission group, as long as the users in the permission group have the permission of the specified resource.

Step 2: Add users who have access rights to the specified resources to the permission group. In practical applications, users who join the permission group can also be flexibly determined, and users who join the permission group can also be dynamically adjusted. The user can be only a single individual, or all members of a certain project group or all department personnel of a certain department, which can be set according to the actual situation.

Step 3: Control the user's authority granularity to the specified resource through the authority group; wherein, the authority granularity is used to represent the access scope of the specified resource. For example, coarse-grained permissions represent a large access scope, while fine-grained permissions represent a small access scope. For example, permission control can be performed on the entire library, and permission control can be performed on tables and fields.

By dynamically adjusting the coarse and fine-grained permissions of the permission group, it is possible to balance the flow of the business and the security of the data according to the actual situation.

The application further provides an automatic reclaiming authority mechanism. If a target user who is currently resigned is detected, the target user will be removed from the authority group where the target user is located, thereby effectively ensuring resource security and preventing illegal personnel from conducting illegal operations. The system can regularly query the status of all users, take the user who is in the resignation state as the target user, and automatically remove the target user from the permission group and reclaim all permissions, so as to prevent the resigned user from still using resources, or to prevent others from stealing the account of the resigned employee. Operate data, avoid data leakage, and effectively improve data security.

For ease of understanding, please refer to the schematic flowchart of automatic authorization and recovery of permissions as shown in FIG. 3, and refer to the following steps S302 to S316:

Step S302: Set resource permission types such as adding, deleting, modifying, and checking;

Step S310: Grant the resource permission to the permission group;

Step S312: adding qualified users to the permission group;

Step S314: Periodically and automatically query the users who have left the cluster;

Step S316: Remove the resigned user from all existing permission groups to recover all their permissions.

The above steps may be implemented with reference to the relevant steps in the foregoing embodiments, and details are not described herein again.

It is understandable that the existing big data platform usually has many components, such as hive, kafka, hbase and other components. However, in the embodiment of the present application, platform components such as hive and hbase can be connected to a unified rights management portal, and the rights management method of the present application can be executed through the rights management portal.

Corresponding to the aforementioned rights management method, the present application further provides a rights management device. Referring to the structural block diagram of a rights management device shown in FIG. 4 , it mainly includes the following modules:

The information acquisition module 402 is used to acquire the organization information to which the user belongs if the specified operation of the user is monitored;

The judgment module 404 is used for judging whether the organization where the user is located has changed according to the organization information;

The authority allocation module 406 is used to reclaim the user's first resource queue authority when the judgment result of the judgment module is yes, and allocate the second resource queue authority to the user; wherein, the first resource queue authority corresponds to the user's original organization The resource queue permission of the user, the second resource queue permission is the resource queue permission corresponding to the user's current organization.

Through the above device, the resource queue authority can be automatically adjusted for the user whose organization has changed, the security of the resource can be effectively guaranteed, and the management of the resource can be made more convenient.

In one embodiment, the above-mentioned apparatus further includes an approval module and an authority determination module, wherein:

an approval module, configured to send the access request to the owner of the target resource for approval if the user's access request for the target resource is received;

A permission determination module, configured to determine the access permission of the user to the target resource according to the approval result of the owner of the target resource.

In a specific embodiment, the authority determination module is further configured to: if the approval result of the owner of the target resource is to reject the access request, determine that the user does not have the access authority to the target resource; if the approval result of the owner of the target resource is Approve the access request, send the access request to the manager for approval, determine that the user has the access right to the target resource when the manager approves it, and determine that the user does not have the access right to the target resource when the manager approves the rejection.

In a specific embodiment, the approval module is further configured to: find the owner of the target resource according to the owner tag corresponding to the target resource; send the access request to the found owner of the target resource for approval.

In a specific embodiment, the above-mentioned device further includes:

The permission group setting module is used to set the permission group of the specified resource;

The permission group adding module is used to add users who have access rights to the specified resources to the permission group;

The authority group control module is used to control the authority granularity of the user to the specified resource through the authority group; wherein, the authority granularity is used to represent the access scope of the specified resource.

In a specific embodiment, the above-mentioned apparatus further includes: an elimination module, configured to exclude the target user from the permission group where the target user is located if it is detected that the target user is currently in a resignation state.

In a specific implementation manner, the permission types corresponding to the permission group include one or more of resource addition permission, resource deletion permission, resource modification permission and resource search permission.

Further, this embodiment also provides an electronic device, including: a processor and a storage device; wherein, a computer program is stored on the storage device, and the computer program executes the foregoing rights management method when executed by the processor.

Further, this embodiment also provides a storage medium, where a computer program is stored on the storage medium, and the computer program executes the above-mentioned rights management method when the computer program is run by the processor.

It can be understood that, the same or similar parts in the above embodiments may refer to each other, and the content not described in detail in some embodiments may refer to the same or similar content in other embodiments.

It should be noted that, in the description of the present application, the terms "first", "second" and the like are only used for the purpose of description, and should not be construed as indicating or implying relative importance. In addition, in the description of the present application, unless otherwise specified, the meanings of "plurality" and "multiple" refer to at least two.

It will be understood that when an element is referred to as being "fixed to" or "disposed to" another element, it can be directly on the other element or intervening elements may also be present; when an element is referred to as being "connected" to another element, it will be This may be directly connected to another element or intervening elements may be present at the same time, in addition, "connected" as used herein may include wireless connections; use of the word "and/or" includes any of one or more of the associated listed items. One unit and all combinations.

Any description of a process or method in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing a particular logical function or step of the process , and the scope of the preferred embodiments of the present application includes alternative implementations in which the functions may be performed out of the order shown or discussed, including performing the functions substantially concurrently or in the reverse order depending upon the functions involved, which should It is understood by those skilled in the art to which the embodiments of the present application belong.

It should be understood that various parts of this application may be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or a combination of the following techniques known in the art: Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, Programmable Gate Arrays (PGA), Field Programmable Gate Arrays (FPGA), etc.

Those skilled in the art can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be stored in a computer-readable storage medium. When executed, one or a combination of the steps of the method embodiment is included.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing module, or each unit may exist physically alone, or two or more units may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

The above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the description of this specification, description with reference to the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples", etc., mean specific features described in connection with the embodiment or example , structure, material or feature is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and should not be construed as limitations to the present application. Embodiments are subject to variations, modifications, substitutions and variations.

Claims (10)

1. A method of rights management, comprising:

if the specified operation of the user is monitored, acquiring the organization information to which the user belongs;

judging whether the organization of the user is changed according to the organization information;

if so, recovering the first resource queue authority of the user, and distributing a second resource queue authority for the user; the first resource queue authority is a resource queue authority corresponding to an original organization of the user, and the second resource queue authority is a resource queue authority corresponding to a current organization of the user.

2. The method of claim 1, further comprising:

if an access request of the user for a target resource is received, the access request is sent to a person to which the target resource belongs for approval;

and determining the access authority of the user to the target resource according to the approval result of the owner of the target resource.

3. The method according to claim 2, wherein the step of determining the access right of the user to the target resource according to the approval result of the owner of the target resource comprises:

if the approval result of the owner of the target resource is a refusal access request, determining that the user does not have the access authority of the target resource;

and if the approval result of the owner of the target resource is that the access request is approved, sending the access request to a manager for approval, determining that the user has the access authority of the target resource when the administrator approves, and determining that the user does not have the access authority of the target resource when the administrator approves.

4. The method of claim 2, wherein the step of sending the access request to the owner of the target resource for approval comprises:

searching the belonger of the target resource according to the belonger label corresponding to the target resource;

and sending the access request to the searched belonged to the target resource for approval.

5. The method of claim 1, further comprising:

setting an authority group of the appointed resource;

adding users having access rights to the specified resource to the rights group;

controlling the granularity of the authority of the user on the specified resource through the authority group; wherein the permission granularity size is used for characterizing the access range of the specified resource.

6. The method of claim 5, further comprising:

and if the target user in the current off-duty state is detected, removing the target user from the authority group in which the target user is located.

7. The method of claim 5, wherein the permission types corresponding to the permission groups include one or more of resource addition permission, resource deletion permission, resource modification permission, and resource search permission.

8. A rights management device, comprising:

the information acquisition module is used for acquiring organization information to which a user belongs if the specified operation of the user is monitored;

the judging module is used for judging whether the organization of the user is changed according to the organization information;

the authority distribution module is used for recovering the first resource queue authority of the user and distributing a second resource queue authority to the user when the judgment result of the judgment module is yes; the first resource queue authority is a resource queue authority corresponding to an original organization of the user, and the second resource queue authority is a resource queue authority corresponding to a current organization of the user.

9. An electronic device, comprising: a processor and a storage device;

the storage device has stored thereon a computer program which, when executed by the processor, performs the method of any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, wherein the computer program is adapted to perform the steps of the method according to any of the claims 1 to 7 when executed by a processor.

Images