CN118797668A - Terminal authority configuration method, device, equipment and storage medium - Google Patents

Abstract

The present application discloses a terminal authority configuration method, device, equipment and storage medium, belonging to the field of security technology. The present application allocates pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different contents according to the different access ranges, that is, by pre-configuring permissions of different terminals corresponding to the same account, thereby ensuring the difference in permissions configured by multiple terminals, limiting the scope of information that can be browsed by different terminals, and thus avoiding the situation where different terminals cause the loss of corresponding information to the account when multiple terminals share the same account, that is, by controlling the permission problem configured by multiple terminals of the same account, the security of the information in the account is guaranteed.

Description

Terminal authority configuration method, device, equipment and storage medium

Technical Field

The present application relates to the field of security technology, and in particular to a terminal authority configuration method, device, equipment and storage medium.

Background Art

With the rapid development of network technology, a user's account can log in to the same client on multiple terminals at the same time. In each terminal, corresponding operations can be performed based on the account to achieve interconnection and interoperability of users in multiple terminals.

Specifically, user A can log in to his account on terminal A and terminal B at the same time, browse information on both terminals, and complete operations with the same permissions on both terminals (for example, browse or modify information in the account). In the case where the terminal is not used by user A himself, for example, user B uses user A's account to log in to the corresponding client, but when user B uses the account, some of user B's operations may cause a certain degree of damage to the information corresponding to the account, for example, user B deletes information or changes information at will.

Therefore, in the above scenario where the same account is used in multiple terminals, the operation behavior of user B may cause corresponding losses to user A, resulting in certain security risks for user A's account.

Application Contents

The main purpose of this application is to provide a terminal permission configuration method, device, equipment and storage medium, aiming to solve the technical problem that when the same account is used in multiple terminals, there are security risks in the information data in the account.

To achieve the above purpose, the present application provides a terminal authority configuration method, which comprises the following steps:

When at least one terminal corresponding to the same account is online, pre-configured permissions of different access ranges are allocated to different terminals, so that the different terminals can display different contents according to the different access ranges.

Optionally, after the step of assigning pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, the method further includes:

When at least one sub-terminal corresponding to the same account is in an online state, if a permission adjustment request initiated by the sub-terminal is received, determining the number of sub-terminals that initiate the permission adjustment request;

If the number is less than or equal to a preset threshold, performing security verification on the operation behavior of the secondary terminal;

If the result of the security verification is safe, adjusting the pre-configured permissions of the terminal;

or,

When at least one sub-terminal corresponding to the same account is in an online state, if a permission adjustment request initiated by the sub-terminal is received, determining the number of sub-terminals that initiate the permission adjustment request;

If the number is greater than a preset threshold, performing security verification on the identity information of the secondary terminal;

If the result of the security verification is safe, the pre-configured permissions of the terminal are adjusted.

Optionally, if the number is less than or equal to a preset threshold, the step of performing security verification on the operation behavior of the secondary terminal includes:

If the number is less than or equal to a preset threshold, determining a reliability index of the operation behavior of the secondary terminal within a preset time period;

If the reliability index is within a preset index range, the result of the safety verification is determined to be safe;

If the reliability index is not within the preset index range, permission application failure information is fed back to the secondary terminal, so that the secondary terminal displays the content of the permission application failure information to the corresponding user.

Optionally, the step of determining the reliability index of the operation behavior of the secondary terminal within a preset time period includes:

Acquiring operation behavior data, login behavior data and abnormal behavior data of the secondary terminal within a preset time period;

updating a safety factor pre-configured on the secondary terminal according to the operation behavior data, the login behavior data and the abnormal behavior data;

According to the updated safety factor, a reliability index of the operation behavior of the secondary terminal within a preset time period is determined.

Optionally, if the number is greater than a preset threshold, the step of performing security verification on the identity information of the secondary terminal further includes:

If the number is greater than a preset threshold, generating a permission code according to the permission-related data of the secondary terminal;

sending the permission code to the secondary terminal, so that the secondary terminal can generate a private key for identity authentication according to the permission code and the permission corresponding to the secondary terminal;

The private key is received from the secondary terminal, and identity verification is performed on the secondary terminal according to the private key. When the verification is successful, permission-related information involved in the result of the security verification is fed back to the secondary terminal.

Optionally, the step of authenticating the secondary terminal according to the private key includes:

Comparing the permissions of the secondary terminal contained in the private key with the preset permissions for consistency, and comparing the permissions code contained in the private key with the initially generated permissions code for consistency;

If the results of the consistency comparison are all consistent, the verification is passed.

Optionally, the same account is pre-set with a main terminal and a plurality of sub-terminals, and when at least one terminal corresponding to the same account is online, if a permission adjustment request initiated by the terminal is received, the step of performing security verification on the terminal further includes:

When the main terminal and at least one secondary terminal corresponding to the same account are online, if a permission adjustment request initiated by the terminal is received, forwarding the permission adjustment request to the main terminal;

The specific content of the permission adjustment request is displayed by the main terminal, so that the user of the main terminal can determine whether to adjust the permission pre-configured by the secondary terminal according to the permission adjustment request.

In addition, to achieve the above purpose, the present application also provides a terminal authority configuration device, the terminal authority configuration device comprising:

The configuration module is used to allocate pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different contents according to the different access ranges.

In addition, to achieve the above-mentioned purpose, the present application also provides a device, which includes: a memory, a processor, and a terminal permission configuration program stored in the memory and executable on the processor, wherein the terminal permission configuration program is configured to implement the steps of the terminal permission configuration method as described above.

In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a terminal authority configuration program is stored, and when the terminal authority configuration program is executed by a processor, the steps of the terminal authority configuration method described above are implemented.

The present application distributes pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different content according to the different access ranges. That is, by pre-configuring permissions of different terminals corresponding to the same account, the permissions configured for multiple terminals are different, and the scope of information that can be browsed by different terminals is limited, thereby avoiding the situation where different terminals cause loss of corresponding information of the account when multiple terminals share the same account. That is, by controlling the permissions configured for multiple terminals of the same account, the security of the information in the account is guaranteed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a flow chart of a first embodiment of a method for configuring terminal permissions in the present application;

FIG2 is a schematic diagram showing the relationship between the same account and multiple terminals in an embodiment of the present application;

FIG3 is a flow chart of a second embodiment of the terminal authority configuration method of the present application;

FIG4 is a schematic diagram of a flow chart of a third embodiment of a method for configuring terminal permissions in the present application;

FIG5 is a structural block diagram of an embodiment of a terminal authority configuration device of the present application;

FIG. 6 is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

DETAILED DESCRIPTION

It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

Refer to Figure 1, which is a flowchart of the first embodiment of the terminal authority configuration method of the present application.

In a first embodiment, the terminal authority configuration method includes the following steps:

S10, when at least one terminal corresponding to the same account is in an online state, pre-configured permissions of different access ranges are allocated to different terminals, so that the different terminals can display different contents according to the different access ranges.

It is understandable that with the continuous development of network technology, the same account can be used to log in, access and operate the same client on different terminals. For example, the same account can be logged in on a computer, mobile phone and tablet respectively.

It should be understood that when logging into the same account on different terminals, the corresponding access and operations may be performed by the user to which the account belongs, or by different users. For example, family members borrow each other's accounts to log in to different terminals. Specifically, user A can lend his account to user B for use, and user A and user B can simultaneously perform corresponding browsing access, information change and other operations through different terminals (for example, a mobile phone and a computer) or the same terminal (for example, two different mobile phones).

Specifically, reference may be made to FIG2 . According to FIG2 , user A's account may be simultaneously logged into user A's main terminal, user A's sub-terminal, user B's sub-terminal, user C's sub-terminal, etc., wherein the main terminal refers only to the commonly used login terminal for user A's account, and the sub-terminals are the remaining login terminals of user A and the login terminals of other users.

It should be noted that when different users use the same account, users other than the account owner may delete, tamper with or clear some access records, favorite data resources or other information in the account, thereby causing the loss of information and data in the corresponding account.

Therefore, in order to avoid the above-mentioned losses, in this embodiment, different permission ranges are allocated to different terminals of the same account, and the corresponding terminals are restricted from executing operations that cause information loss. Consideration is given to configuring permissions with different access ranges for multiple terminals corresponding to the same account, thereby limiting the access range of each terminal to different levels and avoiding the exposure of important information to other terminals.

It is understandable that in the relevant technology, the permission of the access scope usually refers to the different scopes of content that different accounts can browse and the information that they can access when logging into the same platform. Specifically, information content corresponding to different levels can be set in the platform, and different accounts can browse different content according to the permission content they enjoy. For example, in an entertainment software platform, each user enjoys an account, and the account can open VIP privileges to enjoy more operational permissions than ordinary users (listen to member-exclusive songs, view member-exclusive documents, etc.). In this embodiment, it specifically refers to binding multiple terminals to the same account, and assigning different permissions to each terminal. Specifically, taking terminal A as the terminal used by the main user of the account and terminal B as the terminal used by other users of the account as an example, in order to ensure the security of the information resources of the main user, the permission of the entire access scope can be granted on terminal A, that is, all content can be browsed through the account on terminal A, and only content that can be browsed by non-VIP accounts can be accessed on terminal B, so that terminal A and terminal B are configured with different permissions to avoid other users directly changing or stealing information at will through terminal B.

It should be noted that the biggest difference between the permission configuration scheme in this embodiment and the related art lies in the corresponding matching relationship between the account and the terminal, that is, the same account corresponds to multiple terminals that can log in to the account, so as to control the permissions configured for different terminals, which is equivalent to controlling multiple users using the same account to enjoy different permissions respectively. For example, user A uses terminal A, and user B uses terminal B. User A is the owner of the account, and terminal A can configure all permissions. User B is the borrower of the account, and terminal B can configure part of the permissions.

It is further understandable that, when different terminals are configured with different permissions, different terminals can display different content according to the access permissions they obtain. Taking the account as a member account of a video website as an example, terminal A displays all historical browsing records and all operation information, and enjoys all the member rights and interests of the video website. Terminal B may only display part of the video content marked as to be watched, or enjoy part of the member rights and interests of the video website (for example, on the member's birthday, the video website staff will mail a physical gift to the owner of the account, etc., and the user corresponding to terminal B cannot enjoy this right).

In addition, when controlling different terminals to display content with different access permissions, different terminals can also be restricted to enjoy different operating permissions. For example, terminal A can enjoy all modification operations (delete, modify, copy and download, etc.), and terminal B can only enjoy browsing, but cannot modify the data or information resources in the account.

In this embodiment, when at least one terminal corresponding to the same account is online, pre-configured permissions of different access ranges are allocated to different terminals, so that the different terminals can display different content according to the different access ranges. That is, permissions of different terminals corresponding to the same account are pre-configured, thereby ensuring differences in permissions configured for multiple terminals, limiting the scope of information that can be browsed by different terminals, and thus avoiding the situation where different terminals cause loss of corresponding information to the account when multiple terminals share the same account. That is, by controlling the permissions configured for multiple terminals of the same account, the security of the information in the account is guaranteed.

As shown in FIG3 , a second embodiment of the terminal authority configuration method of the present application is proposed based on the first embodiment. In this embodiment, step S10 specifically includes:

S110, when at least one sub-terminal corresponding to the same account is in an online state, if a permission adjustment request initiated by the sub-terminal is received, determine the number of sub-terminals that initiate the permission adjustment request.

It should be noted that the same account can correspond to multiple terminals, and the terminals corresponding to the same account include a main terminal and multiple sub-terminals, where the main terminal refers to the terminal mainly used by the account owner, and the sub-terminal refers to other terminals used by the account owner, or terminals used by other users, etc.

For example, the account owner can use a computer, mobile phone and tablet to log in to the account at the same time, where the mobile phone serves as the main terminal of the account, the computer and tablet serve as the secondary terminals of the account, and any terminal of any user except the owner serves as a secondary terminal.

It is understandable that when the sub-terminal is online, corresponding permission adjustment issues may arise. For example, the sub-terminal needs to apply for more browsing permissions, or apply for permissions to modify data in the account. Therefore, in this embodiment, when it is determined that at least one sub-terminal is online, it is necessary to monitor whether there are sub-terminals that need to change permissions, and the number refers to the number of sub-terminals that initiate permission adjustment requests.

It should be noted that the number of sub-terminals affects the security verification of the sub-terminals. For example, when the number is large, some illegal terminals may apply for permissions at the same time as the normal sub-terminals that have been granted permissions, confusing the account owner's cognition and allowing the illegal terminals to steal the permissions of the account. Therefore, when the number is large, it is necessary to perform more stringent security verification on a large number of terminals that need to adjust permissions, while when the number is small, the intensity and standards of the security verification can be reduced.

Specifically, in order to achieve flexible configuration of terminal permissions, it is necessary to first monitor the situation of each terminal in real time, and monitor the online situation of multiple terminals corresponding to the same account through the corresponding server. In this process, the login situation of the same account and the IP address of the account can be monitored through the server, or the device properties of the account can be directly monitored to determine the online situation of multiple terminals corresponding to the same account, and when such terminal is online and the terminal initiates a permission adjustment request, determine that the terminal applies for permission adjustment. In order to avoid directly adjusting the permission of the terminal and avoiding the user corresponding to the terminal from damaging the information of the account, it is necessary to first perform security verification on the terminal that initiates the permission adjustment request.

It is understandable that the permission adjustment request is a request initiated by the user corresponding to the terminal through the terminal using the same account defined in this embodiment. The request mainly includes adjusting the scope of permissions such as access permissions and/or operation permissions that can be achieved on the terminal. For example, the owner of the same account configures terminal A with the permission to browse all content, and configures terminal B with the permission to browse half of the content. Terminal B may want to browse content that exceeds its permission scope in some scenarios, and it needs to apply for corresponding permissions through terminal B.

It is understandable that security verification is the verification step of conducting security assessment on the terminal that initiates the permission adjustment request. Its main purpose is to determine whether increasing the terminal's permissions may cause the loss of corresponding information and data. For example, if the security verification determines that terminal A is safe, the permissions of terminal A can be adjusted. If the security verification determines that terminal B is unsafe, the permissions of terminal B will not be adjusted.

It should be understood that the security verification can be performed by comprehensively scoring the security of different terminals based on their historical information, or by evaluating the historical operating behaviors of the terminals, etc., as long as it can satisfy the security judgment of different terminals.

S121: If the number is less than or equal to a preset threshold, perform security verification on the operation behavior of the secondary terminal.

It is understandable that when the number is less than or equal to the preset threshold, a verification method with a lower security authentication level can be selected. For example, the security statistics and verification of the historical operation behaviors of the sub-terminal can be carried out, the previous historical records of the sub-terminal can be extracted, and the normal operation, login frequency or abnormal operation can be counted, and the above characteristics can be combined to determine whether the sub-terminal is trustworthy.

Among them, the preset threshold can be set to a smaller value. For example, considering that the owner of the account may use three terminals (mobile phone, computer and tablet) at the same time, the preset threshold can be set to 2, or the preset threshold can be directly set to 1, etc., without specific limitation.

Specifically, when the number is less than a preset threshold, it is necessary to perform security verification on the operating behavior of the sub-terminal. To this end, the reliability index of the operating behavior of the sub-terminal within a preset time period can be determined, and it can be judged whether the size of the reliability index is within the preset index range. If the reliability index is within the preset index range, the result of the security verification is determined to be safe. Similarly, if the reliability index is not within the preset index range, the permission application failure information is fed back to the sub-terminal, so that the sub-terminal can display the content of the permission application failure information to the corresponding user.

It is understandable that the operation behavior refers to the previous historical operation behavior of the sub-terminal. Therefore, some operation behaviors can be extracted from the historical operation behaviors as the basis for judging the reliability index of the sub-terminal, and the preset time length can be used as the extraction standard. For example, the preset time length is one month. When extracting the operation behavior from the historical operation behavior, the corresponding operation behavior of the sub-terminal in the past month can be extracted.

It is understandable that the reliability index refers to an index obtained by evaluating the reliability of the operation behavior of the secondary terminal, and the size of the index can be used to judge whether the secondary terminal is a trustworthy terminal.

The reliability index may be obtained by presetting a corresponding formula, which mainly relies on data on the operation behavior of the secondary terminal, and calculates the reliability index based on the operation behavior.

It is understandable that the preset index range refers to the preset index interval for judging the reliability index. For example, the preset index range may be 1-10 or 5-20, etc., and is not specifically limited here. The preset index range is only used to judge the reliability of the secondary terminal represented by the reliability index.

It should be understood that when the reliability index is within the preset index range, it can be proved that the sub-terminal is reliable and trustworthy. Therefore, the server can respond to the permission adjustment request of the sub-terminal within a certain limit, wherein the certain limit refers to the maximum permission pre-defined by the account owner for the sub-terminal.

It should be understood that when the reliability index is not within the preset index range, it can be proved that the sub-terminal is unreliable and cannot be trusted. Therefore, the server can directly not respond to the permission adjustment request of the sub-terminal, and at the same time feedback the permission application failure information to the sub-terminal, so that the sub-terminal can display the content of the corresponding permission application failure information to the user of the sub-terminal.

It should be noted that when determining the reliability index of the sub-terminal, it is necessary to first obtain the corresponding operation behavior data. Specifically, the operation behavior data, login behavior data and abnormal behavior data of the sub-terminal within a preset time period can be obtained, and the pre-configured safety factor of the sub-terminal is updated according to the operation behavior data, the login behavior data and the abnormal behavior data, so as to use the updated safety factor to determine the reliability index of the operation behavior of the sub-terminal within the preset time period.

Among them, operation behavior should include multiple behaviors, such as access browsing behavior, information change behavior or login behavior, etc.

Specifically, the operation behavior data refers to the behavior of modifying or accessing the information in the account, such as deleting information, modifying the content of information, etc. The login behavior data may refer to the behavior of the sub-terminal logging into the account, specifically the login time, login frequency and login location, etc. The abnormal behavior may refer to the sub-terminal frequently applying for permissions, or logging in from an abnormal location, etc.

It is understandable that, according to the above-mentioned different behaviors, the corresponding pre-configured safety factor can be updated, and the main purpose of the update is to affect the coefficient of the formula when calculating the reliability index.

Specifically, for better explanation, the owner of the account is regarded as the main user, and the other users using the account are regarded as secondary users. When there is only one terminal device online, and the terminal device is a secondary terminal, the main terminal can be considered to be offline. In this state, the secondary user can only browse the information preset by the main user, and the user only has the authority to browse the information under the account.

If the secondary user corresponding to the secondary terminal wishes to obtain more permissions, it is necessary to send an authentication token request (permission adjustment request) to the server to obtain an access token so that the secondary terminal can obtain more access permissions.

The security verification process is as follows:

The secondary terminal sends the reliability index P of the secondary terminal to the server within the T1 time period (preset duration). The value is calculated based on the initial security factor of the secondary terminal, the security factor of the account, the user's trust index of the secondary terminal, the stability time of the terminal and other dimensions.

The calculation formula of the reliability index is as follows:

P = (1/ɑ)U + ILβ;

Among them, ɑ is the security factor of the sub-terminal. The smaller the factor is, the more secure the sub-terminal is. At the same time, the security factor does not change with the change of the permissions enjoyed by the sub-terminal. Instead, when a security incident occurs in the sub-terminal, the calculation is re-triggered, that is, it is recalculated in the security verification link.

Among them, U is the security factor of the account. The larger the coefficient, the safer the account. The security factor is related to the activity of the account and the complexity of data permissions:

The calculation formula of the safety factor is as follows:

Wherein, H represents the login frequency of the account in the secondary terminal, ξ(b _i ,d _i ) represents the complexity and sensitivity of the account authority, and M represents the number of terminals associated with the account.

Among them, I is the trust index of the terminal, which is the similarity score of the accessible information and operation permissions of the secondary terminal and the main terminal, where the permissions are discretized in order according to the security level. Assume that (b0, d0) and (b1, d1) are the data accessible to the user's main terminal and secondary terminal and the corresponding operation permission set, respectively. The higher the index, the higher the user's trust in the device.

The calculation formula of the trust index is as follows:

Where L is the success rate of terminal B2 requesting additional permissions, and its calculation formula is as follows:

Among them, λ represents the sensitivity of the permission, w represents the security level of the requested operation permission, i represents the additional permission tag requested, and j represents the additional permission tag approved by the request.

Among them, β is the number of days without abnormal time, wherein the initial value of β is 0, and the higher the number of days, the larger the β value. If an abnormal event occurs, β=β-X, where X is set by the user based on experience.

If the reliability evaluation value of the secondary terminal is within the preset range, and the IP login address of the secondary terminal is a frequently used login address (an address frequently logged in within a certain period of time), the server grants the secondary terminal the authority to browse all information and a token that does not allow it to perform irreversible modification operations such as deletion on the information.

If the reliability index of the secondary terminal is not within the preset index range, the server does not respond to the request of the secondary terminal, and feeds back a permission application failure message to the secondary terminal.

S122: If the number is greater than a preset threshold, perform security verification on the identity information of the secondary terminal.

It is understandable that when the number is greater than the preset threshold, it is necessary to increase the verification level of the security verification of the sub-terminal. When the number is 1, it is only necessary to determine whether the sub-terminal is reliable. When the number is 10 or other numbers, there may be some illegal terminal intrusions. Therefore, it is necessary to perform security verification on the identity information of the sub-terminal to improve the security protection when the authority is finally adjusted.

Specifically, when the number is greater than a preset threshold, a permission code is generated according to the permission-related data of the sub-terminal, and the permission code is sent to the sub-terminal, so that the sub-terminal can generate a private key for identity authentication according to the permission code and the permission corresponding to the sub-terminal, so that the sub-terminal can feed back the private key to the server, and when the server receives the private key from the sub-terminal, the sub-terminal is authenticated according to the private key, and when the verification is passed, the permission-related information involved in the result of the security verification is fed back to the sub-terminal.

Among them, when performing identity authentication, the main verification content includes two parts. On the one hand, the permissions of the sub-terminal contained in the private key are compared with the preset permissions for consistency. On the other hand, the permission code contained in the private key is compared with the initially generated permission code for consistency. If the results of the consistency comparison in the above two aspects are consistent, the verification is passed, proving that the current sub-terminal is safe.

In addition, it should be noted that permissions include operation permissions and access permissions. During the above identity authentication, different permissions need to be verified for different private keys generated by different sub-terminals.

Specifically, the server generates a permission code set to Bsk, and the specific formula of the permission code Bsk is as follows:

Bsk(b,d)=(bn,dn)×(b1,d1)·(b2,d2)/Tn×φ;

Among them, (bn, dn) is the data permission and corresponding operation permission set accessible to the sub-terminal, (b1, d1) is the accessible information and operation permission information range preset by the main user, (b2, d2) represents the maximum accessible information and operation permission information in the sub-user's historical range, Tn is the public key corresponding to the data set used to decrypt the information hidden from the current sub-user, and φ is the attribute set of the object most recently accessible to the sub-user.

After the server sends the permission code Bsk to each sub-terminal that needs to apply for additional access rights, each sub-terminal will generate a corresponding private key Re1 based on the permission code Bsk. The specific formula of the private key Re1 is as follows:

in, It is the set of all information nodes that the secondary user can currently access;

Among them, Q1 is the attribute information that the secondary user applies to browse this time, that is, the attribute range set. For example, if the user wants to access images and texts, the attribute set for this access is {k (data storage location), 1 (text), 2 (image)}.

The server sends the permission code Bsk to each secondary terminal that needs to apply for additional operation permissions, so that the secondary terminal generates the corresponding private key Re2. The specific formula of the private key Re2 is as follows:

Among them, Q2 is the permission information range set of the secondary user's current application operation, for example, {1 (modify permission), 2 (delete permission)}.

The access rights and operation rights of the secondary terminal are integrated to obtain Re, which can be fed back to the server. The specific formula of Re is as follows:

Re＝(Re1, Re2);

When the server receives the private key information Re sent by the secondary terminal, it authenticates the private key, binds the corresponding access and operation permissions to the private key Re, and feeds back to the user;

Among them, the authentication operation is: compare whether the current access and operation permissions sent by the secondary user to the server are consistent with the initial access and operation permissions actually retained by the secondary user in the server, and determine whether the Bsk(b, d) contained in the private key is consistent with that retained in the server. If the above two conditions are consistent, the verification is considered to be successful.

Among them, the secret key G after binding authority is: G = {Z}/Re·Bsk(b, d);

Among them, Z represents the operation permission set given by the system after taking the intersection of the access permission range E preset by the primary user and the user permission range set Q2 applied for by the secondary user.

It should be noted that there is a potential condition in the adjustment process after authority authentication. Specifically, after security verification, the server will meet the access rights requested by the user and open the corresponding access range for the user. However, for the operation rights applied by the user, the server will open the corresponding operation rights for the secondary user terminal within the authority range preset by the main user.

Finally, the server will send the secret key G to the secondary user terminal. Based on the secret key G sent by the server, the secondary user's secondary terminal will initiate a corresponding access request, access the data under the corresponding account, and perform operations within the scope of authority.

In addition, when the main terminal corresponding to the same account is online, all permissions are configured to the main terminal.

It is understandable that the master terminal, as the terminal of the account owner, should have full authority to use the account. Therefore, the server will configure all operating permissions, access permissions and other permissions of the account to the master terminal to ensure the normal use of the master terminal.

In this embodiment, when the master terminal is online, all permissions are directly configured to the master terminal, thereby ensuring the permissions of the user corresponding to the master terminal when using the account.

S130: If the result of the security verification is safe, adjust the pre-configured permissions of the terminal.

It is understandable that when the result of the security verification is safe, it can be determined that the current terminal meets the conditions for adjusting permissions, and therefore, the permissions pre-configured for the terminal can be adjusted.

It should be noted that the pre-configured permissions refer to the permissions pre-configured when the terminal logs in to the account. For example, user A is the owner of the account, and user B wants to borrow the account. Through communication with user A, user A allows the use of the account, and will preset terminal B used by user B, and limit the maximum permissions of terminal B. Taking the maximum permission of browsing all information content in the account as an example, the server will use any permission range under the maximum permission as the pre-configured permission. Taking the configured permission of browsing half of the information content as an example, when user B logs in to the account through terminal B, he can browse half of the information content in the account according to the pre-configured permissions, and the maximum permission enjoyed by terminal B is browsing all information content. Therefore, the pre-configured permissions of terminal B can be adjusted, and the range of permission adjustment is within the maximum permission.

It should be noted that the pre-configured permissions can be understood as permissions configured by the server for the terminal, and the permission range corresponding to the pre-configured permissions is less than or equal to the permission range of the maximum permission configured by the account owner.

In this embodiment, the number of sub-terminals that initiate permission adjustment requests is determined, and different security verification methods are selected according to the number. The security verification of the operation behavior is performed on the sub-terminals whose number is less than or equal to the preset threshold, and the security verification is performed on the identity information of the sub-terminals whose number is greater than the preset threshold. This allows different security verification methods to be used for different application scenarios to ensure the reliability and security of the adjustment operation when adjusting the permissions of the sub-terminals.

As shown in FIG4 , a third embodiment of the terminal authority configuration method of the present application is proposed based on the first embodiment. In this embodiment, the method further includes:

S41, when the main terminal and at least one secondary terminal corresponding to the same account are in an online state, if a permission adjustment request initiated by the terminal is received, the permission adjustment request is forwarded to the main terminal.

It is understandable that the main terminal, as the terminal of the account owner, should have all the permissions to use the account, and the account owner should have the right to arbitrarily control the permissions of each sub-terminal. Therefore, in this embodiment, if the terminals in the online state include the main terminal and the sub-terminal, there is no need for the server to participate in the corresponding security verification and dynamic adjustment of the permissions of the sub-terminal. The permission adjustment request initiated by the sub-terminal can be directly sent to the main terminal through the server, and the permissions of the corresponding sub-terminal can be configured by the owner of the main terminal.

S42, displaying the specific content of the permission adjustment request through the main terminal, so that the user of the main terminal can determine whether to adjust the permission pre-configured by the secondary terminal according to the permission adjustment request.

It is understandable that after the main terminal receives the permission adjustment request forwarded by the server, the permission adjustment request can be displayed through the display unit of the main terminal in the form of an inquiry or a permission configuration information table. The specific content of the permission adjustment request may include the permission required by the sub-terminal. For example, the sub-terminal wants to apply for the permission to browse all information in the account, so that the user of the main terminal (account owner) can determine whether to adjust the pre-configured permissions of the sub-terminal according to the specific content displayed on the main terminal. If so, the permissions of the sub-terminal are adjusted through the server. If not, the server will feedback the information that the permission application of the sub-terminal failed, and will not respond to the permission adjustment application initiated by the sub-terminal.

In this embodiment, when both the main terminal and the sub-terminal are online and the sub-terminal initiates a corresponding permission adjustment request, the permission adjustment request is directly forwarded to the main terminal, so that the user corresponding to the main terminal can make real-time adjustments to the permission adjustment request. At the same time, in this way, the accuracy of the permission configuration of the sub-terminal can be guaranteed by directly relying on the subjective ideas of the user corresponding to the main terminal.

In addition, the embodiment of the present application also proposes a terminal authority configuration device. Referring to FIG. 5 , the terminal authority configuration device includes:

The configuration module 10 is used to allocate pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different contents according to the different access ranges.

This embodiment distributes pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different content according to the different access ranges. That is, permissions of different terminals corresponding to the same account are pre-configured to ensure differences in permissions configured for multiple terminals, limit the scope of information that can be browsed by different terminals, and avoid the situation where different terminals cause loss of corresponding information of the account when multiple terminals share the same account. That is, the security of information in the account is guaranteed by controlling the permissions configured for multiple terminals of the same account.

It should be noted that each module in the above-mentioned device can be used to implement each step in the above-mentioned method and achieve corresponding technical effects, which will not be described in detail in this embodiment.

Refer to Figure 6, which is a schematic diagram of the structure of the device of the hardware operating environment involved in the embodiment of the present application.

As shown in Figure 6, the device may include: a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

Those skilled in the art will appreciate that the structure shown in FIG. 6 does not constitute a limitation on the device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

As shown in FIG. 6 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a terminal authority configuration program.

In the device shown in FIG6 , the network interface 1004 is mainly used for data communication with an external network; the user interface 1003 is mainly used for receiving input instructions from a user; the device calls the terminal authority configuration program stored in the memory 1005 through the processor 1001, and performs the following operations:

When at least one terminal corresponding to the same account is online, pre-configured permissions of different access ranges are allocated to different terminals, so that the different terminals can display different contents according to the different access ranges.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

When at least one sub-terminal corresponding to the same account is in an online state, if a permission adjustment request initiated by the sub-terminal is received, determining the number of sub-terminals that initiate the permission adjustment request;

If the number is less than or equal to a preset threshold, performing security verification on the operation behavior of the secondary terminal;

If the result of the security verification is safe, adjusting the pre-configured permissions of the terminal;

or,

When at least one sub-terminal corresponding to the same account is in an online state, if a permission adjustment request initiated by the sub-terminal is received, determining the number of sub-terminals that initiate the permission adjustment request;

If the number is greater than a preset threshold, performing security verification on the identity information of the secondary terminal;

If the result of the security verification is safe, the pre-configured permissions of the terminal are adjusted.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

If the number is less than or equal to a preset threshold, determining a reliability index of the operation behavior of the secondary terminal within a preset time period;

If the reliability index is within a preset index range, the result of the safety verification is determined to be safe;

If the reliability index is not within the preset index range, permission application failure information is fed back to the secondary terminal, so that the secondary terminal displays the content of the permission application failure information to the corresponding user.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

Acquiring operation behavior data, login behavior data and abnormal behavior data of the secondary terminal within a preset time period;

updating a safety factor pre-configured on the secondary terminal according to the operation behavior data, the login behavior data and the abnormal behavior data;

According to the updated safety factor, a reliability index of the operation behavior of the secondary terminal within a preset time period is determined.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

If the number is greater than a preset threshold, generating a permission code according to the permission-related data of the secondary terminal;

sending the permission code to the secondary terminal, so that the secondary terminal can generate a private key for identity authentication according to the permission code and the permission corresponding to the secondary terminal;

The private key is received from the secondary terminal, and identity verification is performed on the secondary terminal according to the private key. When the verification is successful, permission-related information involved in the result of the security verification is fed back to the secondary terminal.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

Comparing the permissions of the secondary terminal contained in the private key with the preset permissions for consistency, and comparing the permissions code contained in the private key with the initially generated permissions code for consistency;

If the results of the consistency comparison are all consistent, the verification is passed.

Further, the processor 1001 may call the terminal authority configuration program stored in the memory 1005, and further perform the following operations:

When the main terminal and at least one secondary terminal corresponding to the same account are online, if a permission adjustment request initiated by the terminal is received, forwarding the permission adjustment request to the main terminal;

The specific content of the permission adjustment request is displayed by the main terminal, so that the user of the main terminal can determine whether to adjust the permission pre-configured by the secondary terminal according to the permission adjustment request.

This embodiment distributes pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different content according to the different access ranges. That is, permissions of different terminals corresponding to the same account are pre-configured to ensure differences in permissions configured for multiple terminals, limit the scope of information that can be browsed by different terminals, and avoid the situation where different terminals cause loss of corresponding information of the account when multiple terminals share the same account. That is, the security of information in the account is guaranteed by controlling the permissions configured for multiple terminals of the same account.

In addition, the embodiment of the present application further proposes a computer-readable storage medium, on which a terminal authority configuration program is stored, and when the terminal authority configuration program is executed by a processor, the following operations are implemented:

When at least one terminal corresponding to the same account is online, pre-configured permissions of different access ranges are allocated to different terminals, so that the different terminals can display different contents according to the different access ranges.

This embodiment distributes pre-configured permissions of different access ranges to different terminals when at least one terminal corresponding to the same account is online, so that the different terminals can display different content according to the different access ranges. That is, permissions of different terminals corresponding to the same account are pre-configured to ensure differences in permissions configured for multiple terminals, limit the scope of information that can be browsed by different terminals, and avoid the situation where different terminals cause loss of corresponding information of the account when multiple terminals share the same account. That is, the security of information in the account is guaranteed by controlling the permissions configured for multiple terminals of the same account.

It should be noted that when the above-mentioned computer-readable storage medium is executed by a processor, it can also implement the various steps in the above-mentioned method and achieve the corresponding technical effects, which will not be described in detail in this embodiment.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims (10)

1. The terminal authority configuration method is characterized by comprising the following steps of:

And under the condition that at least one terminal corresponding to the same account number is in an online state, correspondingly distributing the preset authorities of different access ranges to different terminals so that the different terminals can display different contents according to the different access ranges.

2. The terminal authority configuration method according to claim 1, wherein after the step of allocating the preset authority correspondence of different access ranges to different terminals in the case that at least one terminal corresponding to the same account is in an on-line state, the method further comprises:

If the permission adjustment request initiated by the auxiliary terminal is received under the condition that at least one auxiliary terminal corresponding to the same account is in an online state, determining the number of the auxiliary terminals initiating the permission adjustment request;

If the number is smaller than or equal to a preset threshold value, performing security verification on the operation behavior of the auxiliary terminal;

If the security verification result is safe, adjusting the preset authority of the terminal;

Or alternatively, the first and second heat exchangers may be,

If the permission adjustment request initiated by the auxiliary terminal is received under the condition that at least one auxiliary terminal corresponding to the same account is in an online state, determining the number of the auxiliary terminals initiating the permission adjustment request;

If the number is larger than a preset threshold, carrying out security verification on the identity information of the auxiliary terminal;

and if the security verification result is security, adjusting the preset authority of the terminal.

3. The terminal authority configuration method according to claim 2, wherein the step of performing security verification on the operation behavior of the secondary terminal if the number is equal to or smaller than a preset threshold value includes:

If the number is smaller than or equal to a preset threshold value, determining a reliability index of the operation behavior of the auxiliary terminal in a preset duration;

If the reliability index is within the preset index range, determining that the safety verification result is safe;

if the reliability index is not within the preset index range, feeding back authority application failure information to the auxiliary terminal so that the auxiliary terminal can display the content of the authority application failure information to the corresponding user.

4. The terminal authority configuration method as claimed in claim 3, wherein the step of determining the reliability index of the operation behavior of the secondary terminal for a preset period of time comprises:

Acquiring operation behavior data, login behavior data and abnormal behavior data of the auxiliary terminal in a preset time period;

Updating the pre-configured safety coefficient of the auxiliary terminal according to the operation behavior data, the login behavior data and the abnormal behavior data;

and determining the reliability index of the operation behavior of the auxiliary terminal in the preset duration according to the updated safety coefficient.

5. The terminal authority configuration method as claimed in claim 3, wherein the step of performing security verification on the identity information of the secondary terminal if the number is greater than a preset threshold value, further comprises:

If the number is larger than a preset threshold, generating a permission code according to the permission related data of the auxiliary terminal;

The authority codes are sent to the auxiliary terminal, so that the auxiliary terminal generates a private key for identity verification according to the authority codes and the authorities corresponding to the auxiliary terminal;

And receiving the private key from the auxiliary terminal, carrying out identity verification on the auxiliary terminal according to the private key, and feeding back authority related information related to a security verification result to the auxiliary terminal when verification passes.

6. The terminal authority configuration method as claimed in claim 5, wherein the step of authenticating the sub-terminal according to the private key comprises:

consistency comparison is carried out on the authority of the auxiliary terminal contained in the private key and a preset authority, and consistency comparison is carried out on the authority code contained in the private key and the initially generated authority code;

And if the consistency comparison results are consistent, the verification is passed.

7. The method for configuring terminal rights according to claim 1, wherein a main terminal and a plurality of auxiliary terminals are preset corresponding to the same account, and the step of performing security verification on the terminal if a rights adjustment request initiated by the terminal is received in a case that at least one terminal corresponding to the same account is in an online state, further comprises:

If a permission adjustment request initiated by the terminal is received under the condition that a main terminal and at least one auxiliary terminal corresponding to the same account are in an online state, forwarding the permission adjustment request to the main terminal;

And displaying the specific content of the permission adjustment request through the main terminal so that a user of the main terminal can determine whether to adjust the preset permission of the auxiliary terminal according to the permission adjustment request.

8. A terminal rights configuration device, characterized in that the terminal rights configuration device comprises:

and the configuration module is used for correspondingly distributing the preset rights of different access ranges to different terminals under the condition that at least one terminal corresponding to the same account is in an online state so that the different terminals can display different contents according to the different access ranges.

9. A terminal rights configuration device, characterized in that the terminal rights configuration device comprises: a memory, a processor and a terminal rights configuration program stored on the memory and executable on the processor, the terminal rights configuration program being configured to implement the steps of the terminal rights configuration method according to any one of claims 1 to 7.

10. A storage medium, characterized in that a program for realizing the terminal authority configuration method is stored on the storage medium, the program for realizing the terminal authority configuration method being executed by a processor to realize the steps of the terminal authority configuration method according to any one of claims 1 to 7.