WO2024235206A1 - Permission management method and apparatus, device, storage medium, and program product - Google Patents

Abstract

Embodiments of the present disclosure relate to a permission management method and apparatus, a device, a storage medium, and a computer program product. The method provided herein comprises: in a permission configuration interface for managing users and/or devices in a target organization, determining a target application to be configured; using the permission configuration interface to acquire a permission policy to be applied to the target application, wherein the permission policy at least indicates a target range of the target application authorized to be used in the target organization and a handling policy for use of the target application outside the target range, and the target range comprises a group of target users and/or a group of target devices; and on the basis of the permission policy, managing the execution of the target application in the target organization.

Description

Method, device, equipment, storage medium and program product for rights management

This application claims priority to the Chinese invention patent application with application number 202310554413.3 filed on May 16, 2023 and titled “Method, apparatus, device and storage medium for rights management”, the entire contents of which are incorporated by reference into this application.

Technical Field

Example embodiments of the present disclosure generally relate to the computer field, and more particularly, to a method, apparatus, device, computer-readable storage medium, and program product for rights management.

Background Art

Software or application usage management is an important task within an enterprise or organization. An enterprise or organization may obtain a predetermined number of installation or usage permissions for some applications, which may lead to unauthorized use or installation beyond the predetermined number, thus bringing potential risks to the enterprise or organization.

Summary of the invention

In a first aspect of the present disclosure, a method for permission management is provided. The method includes: determining a target application to be configured in a permission configuration interface for managing users and/or devices in a target organization; obtaining a permission policy to be applied to the target application using the permission configuration interface, the permission policy at least indicating a target scope in the target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, the target scope including a group of target users and/or a group of target devices; and managing the execution of the target application in the target organization based on the permission policy.

In a second aspect of the present disclosure, a device for permission management is provided. The device includes: a determination module configured in a permission configuration interface for managing users and/or devices in a target organization, determining a target application to be configured; an acquisition module configured to A permission configuration interface is used to obtain a permission policy to be applied to a target application, wherein the permission policy at least indicates a target scope in a target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, wherein the target scope includes a group of target users and/or a group of target devices; and a management module is configured to manage the execution of the target application in the target organization based on the permission policy.

In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the device executes the method of the first aspect.

In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to implement the method of the first aspect.

In a fifth aspect of the present disclosure, there is provided a computer program product, which is tangibly stored in a computer storage medium and comprises computer executable instructions, which when executed by a device cause the device to perform the method according to the first aspect.

It should be understood that the contents described in this content section are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

FIG1 shows a schematic diagram of an example environment in which embodiments according to the present disclosure may be implemented;

FIG2 shows a flow chart of an example process of rights management according to some embodiments of the present disclosure;

3A to 3F illustrate example permission configurations according to some embodiments of the present disclosure. interface;

FIG4 shows a schematic structural block diagram of an apparatus for rights management according to some embodiments of the present disclosure; and

FIG5 shows a block diagram of an electronic device capable of implementing various embodiments of the present disclosure.

DETAILED DESCRIPTION

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

It should be noted that the titles of any sections/subsections provided herein are not restrictive. Various embodiments are described throughout this article, and any type of embodiment may be included under any section/subsection. In addition, the embodiments described in any section/subsection may be combined in any manner with any other embodiments described in the same section/subsection and/or different sections/subsections.

In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may be included below. The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may be included below.

The embodiments of the present disclosure may involve user data, data acquisition and/or use, etc. These aspects shall comply with the relevant laws, regulations and provisions. In the embodiments of the present disclosure, all data collection, acquisition, processing, processing, forwarding, use, etc. are carried out under the premise that the user knows and confirms. Accordingly, when implementing the embodiments of the present disclosure, the data or information that may be involved shall be disclosed in an appropriate manner in accordance with the relevant laws and regulations. The type, scope of use, and usage scenario of the device may be notified to the user and the user's authorization may be obtained. The specific notification and/or authorization method may vary according to the actual situation and application scenario, and the scope of the present disclosure is not limited in this respect.

In this specification and the embodiments, if personal information processing is involved, it will be processed on the premise of having a legal basis (such as obtaining the consent of the subject of personal information, or it is necessary to perform a contract, etc.), and will only be processed within the scope of regulations or agreements. If a user refuses to process personal information other than the necessary information for basic functions, it will not affect the user's use of basic functions.

As briefly mentioned above, for enterprises or other types of organizations, managing the compliance of application use within the organization is an important task. Organizations need to manage members within the organization to use within the scope of authorization, which brings great management difficulties to the organization.

The embodiments of the present disclosure propose a scheme for permission management. According to the scheme, the target application to be configured can be determined in the permission configuration interface for managing users and/or devices in the target organization. Furthermore, the permission configuration interface can be used to obtain the permission policy to be applied to the target application, and the permission policy at least indicates the target scope of the target organization that is authorized to use the target application and the disposal policy for using the target application outside the target scope, and the target scope includes a group of target users and/or a group of target devices. Accordingly, the execution of the target application in the target organization can be managed based on the permission policy.

In this way, embodiments of the present disclosure may support unified and standardized management of usage permissions of applications in an organization, thereby improving the efficiency of application permission management and reducing risks associated with unauthorized use.

Various example implementations of the solution are described in detail below in conjunction with the accompanying drawings.

Example Environment

FIG1 shows a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. As shown in FIG1 , the environment 100 may include a management device 110 .

As will be described in detail below, the management device 110 may be configured to manage the usage rights of the application 130 within the organization. An "organization" may include a group consisting of multiple users such as a company, department, institution, etc. An "application" may include an application that can be installed and used by a terminal device. Any suitable program product for use may also be referred to as software in some contexts.

For example, the management device 110 can use the permission configuration interface 160 provided by the terminal device 120 to implement permission management for the application 130. Such a terminal device 120 may correspond to an electronic device used by an administrator in an organization, for example. It should be understood that although in FIG. 1 , the management device 110 and the terminal device 120 are shown as separate boxes, they may also be implemented in the same electronic device.

Exemplarily, the management device 110 may use the permission configuration interface 160 to determine the target scope of the authorized scope, for example, a group of devices 140 of the authorized scope and/or a group of users 150 of the authorized scope. Such a permission configuration interface 160 may be used to manage users and/or devices in the target organization.

Additionally, the management device 110 may also manage the handling measures for using the application 130 outside the target scope. For example, the management device 110 may disable the application 130 for users and/or devices in the organization that are not within the target scope according to the configuration information obtained by the permission configuration interface 160 .

The specific process of permission configuration will be described in detail below with reference to FIG. 2 .

In some embodiments, the terminal device 120 can be any type of mobile terminal, fixed terminal or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio/video players, digital cameras/camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The management device 110 can be, for example, various types of computing systems/servers that can provide computing capabilities, including but not limited to mainframes, edge computing nodes, computing devices in cloud environments, and the like.

It should be understood that the structure and function of the various elements in the environment 100 are described for exemplary purposes only and do not imply any limitation on the scope of the present disclosure.

Some example embodiments of the present disclosure will be described below with continued reference to the accompanying drawings.

Example Process

FIG2 shows a flow chart of an example process 200 for rights management according to some embodiments of the present disclosure. Process 200 may be implemented at terminal device 120 (or in combination with management device 120). Process 200 is described below with reference to FIG1.

As shown in FIG. 2 , in box 210 , the terminal device 120 determines the target application 130 to be configured using the permission configuration interface 160 for managing users and/or devices in the target organization.

As shown in FIG. 3A , the terminal device 120 may provide a permission configuration interface 300A as shown in FIG. 3A for a management user within an organization, for example.

Taking Figure 3A as an example, the terminal device 120 can present a group of candidate applications (for example, candidate applications 310-1 to candidate applications 310-4, individually or collectively referred to as candidate applications 310) in the permission configuration interface 300A, and determine the target application to be configured based on the selection operation of the management user on a group of candidate applications.

Exemplarily, such a set of candidate applications 310 may include a set of preset candidate applications. For example, the terminal device 120 and/or the management device 110 may configure a set of commonly used preset applications in the organization as candidate applications that can be used for management according to the usage needs in the organization.

Alternatively, such a set of candidate applications 310 may also be determined based on procurement information of the organization and include a set of applications that the organization has already procured.

In some embodiments, if the application that the management user desires to configure is not in the list, the management user may also trigger the selection of other applications by, for example, operating the add control 305 .

Exemplarily, in the case of receiving a selection for adding control 305, terminal device 120 may present interface 300B, for example. As shown in FIG3B , in interface 300B, terminal device 120 may present a group of candidate applications 315 determined based on application installation information within the organization. Such application installation information may be reported by users within the organization, or determined based on uploaded information of user devices within the organization with the knowledge and permission of the users. For example, the management user may add such candidate applications 315 to the management application list shown in FIG3A .

In some embodiments, the terminal device 120 can also provide management users with Detect the determined set of candidate applications. As shown in FIG3C , the terminal device 120 may also provide an interface 300C as shown in FIG3C .

In the interface 300C, the terminal device 120 may, for example, provide a group of candidate applications 320 determined based on real-time reference detection within the organization. Accordingly, the management device 120 may also add such candidate applications to the management application list shown in FIG. 3A .

Additionally, in the case where none of the above candidate applications include the target application that is expected to be configured, the terminal device 120 can also support, for example, managing the target application that the user inputs the expected configuration. Exemplarily, after receiving a selection for adding an entry 325 as shown in FIG. 3C , the terminal device 120 can present, for example, an interface 300D as shown in FIG. 3D .

As shown in FIG3D , the interface 300D may allow the user to input application description information in the interface 300D. Such application description information may include, for example, the name of the application, the operating system of the application, the BUNDLE ID (bundle identifier) of the application, the version number of the application, etc.

After completing such application description information, the terminal device 120 may support adding the target application determined based on the input application description information to the management application list as shown in FIG. 3A .

In this way, the embodiments of the present disclosure can support multi-channel configuration application addition, thereby facilitating unified management of applications within an organization and improving the efficiency of application management.

Continuing with reference to Figure 2, in box 220, the terminal device 120 uses the permission configuration interface 160 to obtain a permission policy to be applied to the target application 130, wherein the permission policy at least indicates a target scope in the target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, and the target scope includes a group of target users and/or a group of target devices.

3A , an application 310 - 1 in the management application list is used as an example of a selected target application. The management user can select the target application 310 - 1 as the target application to be managed by, for example, clicking “Open Permission”.

Furthermore, the terminal device 120 may allow the management user to complete the configuration of the permissions for the target application according to the “per-device authorization” and “per-user authorization” methods.

Further, the terminal device 120 may present a configuration component 300E as shown in FIG. 3E . As shown in Fig. 3E, the terminal device 120 may present a group of candidate devices 335 in the configuration component 300E. Such a group of candidate devices may include, for example, a group of candidate devices preset in the organization, for example, a set of devices that the current management user has the authority to manage.

Alternatively or additionally, the configuration component 300E may further include a search entry 330, and the management user may enter a search term through the search entry 330 to implement screening or filtering of candidate devices. For example, such a search term may be associated with device description information of the device, such as the device identifier, the device type, the user corresponding to the device, and the like.

Further, the configuration component 300E can allow the administrative user to add one or more devices from the candidate devices 335 as target devices authorized to use the target application within the organization.

In some examples, as shown in Figure 3E, the configuration component 300E can also be used to configure the upper limit of devices in the organization that are allowed to use the target application. Such an upper limit can be determined based on the application purchase information of the organization, which can be less than or equal to the total purchase amount.

In some other embodiments, when the management user selects "per user authorization" to configure permissions, the terminal device 120 may, for example, provide a configuration component 300F as shown in FIG. 3F .

As shown in Fig. 3F, the terminal device 120 may present a group of candidate users in the configuration component 300F. Such a group of candidate users may include, for example, a group of candidate users 345 preset in the organization, for example, a set of users that the current management user has the authority to manage.

Alternatively or additionally, the configuration component 300E may further include a search entry 340, through which the management user may enter a search term to screen or filter the candidate users. For example, such a search term may be associated with the user description information of the user, such as the user's ID, the user's role, the user's department, etc.

Further, the configuration component 300E can allow the administrative user to add one or more devices from the candidate users 345 as target users within the organization who are authorized to use the target application.

Through the above-discussed approach, the embodiments of the present disclosure can further provide flexibility in application permission management and better match different licensing modes of application-based licensing and user-based licensing, thereby increasing the scope of application of the solution.

In some other embodiments, the terminal device 120 may also support managing the handling policy input by the user regarding the use of the target application outside the target range. The target application 310 - 1 in FIG. 1 is taken as an example.

In some embodiments, the terminal device 120 may adopt a default handling strategy when no specific input from the user is received. Such a default handling strategy may be appropriately configured according to organizational needs, for example, to prohibit unauthorized users or devices from using the target application.

In some embodiments, as shown in FIG3A , the management user can also implement permission configuration for the target application 310-1 by, for example, clicking on the entry “Disable Software”. For example, after receiving the selection of “Disable Software”, the terminal device 110 can determine that the disposal policy selected by the management user indicates that the target application is disabled outside the target range. In this case, even if an unauthorized user and/or device installs the target application 310-1, it cannot start the target application.

In some embodiments, the management user may also configure, for example, reminders regarding unauthorized use or unauthorized attempts to use. For example, the management user may configure that when an unauthorized user attempts to launch the target application or attempts to launch the target application in an unauthorized device, the target application will not be launched, and the management user may control the device to provide a reminder that the current device and/or current user is not authorized to use the application.

As another example, the management user may also configure to generate a reminder during the first unauthorized use of a user and/or device. That is, when an unauthorized user attempts to launch a target application or attempts to launch a target application in an unauthorized device, the target application may be launched normally for the first time, and the device may provide a reminder during use that the current device and/or current user is not authorized to use the application and should obtain authorization as soon as possible.

In some embodiments, a reminder for unauthorized use and/or attempted use of the target application outside the target scope may also be generated for the management user. For example, a reminder for unauthorized use or attempted use within the organization may be provided to the management user via appropriate means such as email, office system message, instant messaging message, etc.

In some other embodiments, as discussed above, the terminal device 120 may also receive a designation of an upper limit on authorized devices and/or authorized users. In some embodiments, the terminal device 120 may also receive a configuration for managing an excess number and/or an excess ratio of a management user.

For example, such excess amount and/or excess percentage may be determined based on the organization's application procurement information. The information is appropriately configured to, for example, reduce the risk of usage beyond the scope of purchase. As an example, the administrative user can configure the upper limit of the number of devices authorized to use the target application within the organization to 100, and can configure the excess ratio to 15% (for example, the organization purchases 120 devices). Thus, when the total number of devices authorized for use and unauthorized for use within the organization exceeds 115, a reminder about exceeding the quota can be sent to the administrative user of the target organization through appropriate means such as email, office system message, instant messaging message, etc., so that the administrative user's terminal device displays the reminder. In some examples, such an excess reminder can occur, for example, when the administrative user has not disabled usage outside the target scope.

Based on this approach, the embodiments of the present disclosure can support detailed configuration of the permission policy for the target application to specify the authorized users and/or devices within the organization, and can specify the disposal policy for unauthorized ones. Based on this approach, the embodiments of the present disclosure can greatly reduce the difficulty of the management party in managing applications within the organization and improve management efficiency.

Continuing to refer to FIG. 2 , in block 230 , the terminal device 120 manages the execution of the target application in the target organization based on the permission policy.

For example, the terminal device 120 can determine the user or device in the organization that is authorized to use the target application according to the permission policy, and enable the device in the organization to respond to the permission policy. For example, the device in the organization can allow the user to install or use the target application if it is determined that the device is an authorized device or the logged-in user is an authorized user.

On the contrary, when it is determined that the device is not an authorized device and the logged-in user is not an authorized user, the device in the organization can determine whether to prohibit the user from starting or using the target application according to the permission policy. For example, the device may not respond when the user double-clicks to start the application, and may generate a reminder that the current device and/or the current user is not authorized to use the application. Alternatively, the device may generate a reminder that authorization needs to be obtained as soon as possible after the application is normally started.

Through the above process, the embodiments of the present disclosure can provide a unified configuration interface for application permission management within an organization, can allow target applications to be added from multiple sources, and can manage the use of target applications within the organization through multiple permission policies. Therefore, the embodiments of the present disclosure can improve the uniformity of application management and reduce the time cost of application permission management.

In some other embodiments, with continued reference to FIG. 3A , the permission configuration interface 300A may further provide application statistics information, where the application statistics information indicates a comparison between authorized usage of at least one application within the target organization and total usage.

Taking the application 310-2 in FIG. 3A that has been enabled for management as an example, the information in the column "Allowed/All" may indicate, for example, the comparison result of the number of devices or users that the management party has authorized (for example, number C) and the number of all devices or users that have installed or used the application in the organization (for example, number B). In some examples, the permission configuration interface 300A may also directly provide information on the ratio of number C to number B, instead of providing specific values of the two.

In some embodiments, the terminal device 120 may provide risk description information generated based on the comparison result, which may indicate whether the use of a specific application within the target organization has a risk of exceeding the permission or being unauthorized. For example, when the number B is greater than the number C, the application may be determined to have a risk of unauthorized use. Accordingly, the permission configuration interface 300A may, for example, indicate that the application may currently have a risk through the "Software Risk" column.

In some other embodiments, the terminal device 120 may also provide a purchase suggestion for the application 310 - 2 according to the comparison result. For example, when the number B is greater than the number C, the terminal device 120 may generate a purchase suggestion for additional purchase of the application 310 - 2 .

Based on this approach, the embodiments of the present disclosure can also achieve information aggregation for applications to be managed within an organization, thereby further improving the efficiency of application management within the organization.

Example devices and equipment

The embodiments of the present disclosure also provide corresponding devices for implementing the above methods or processes.

4 shows a schematic structural block diagram of an apparatus 400 for rights management according to some embodiments of the present disclosure. The apparatus 400 may be implemented as or included in the terminal device 120. Each module/component in the apparatus 400 may be implemented by hardware, software, firmware or any combination thereof.

As shown in FIG. 4 , the apparatus 400 includes a determination module 410 configured to determine the permissions to be configured in a permission configuration interface for managing users and/or devices in a target organization. Target application; an acquisition module 420, configured to use a permission configuration interface to obtain a permission policy to be applied to the target application, the permission policy at least indicating a target scope in the target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, the target scope including a group of target users and/or a group of target devices; and a management module 430, configured to manage the execution of the target application in the target organization based on the permission policy.

In some embodiments, the determination module 410 is further configured to: display a group of candidate applications in the permission configuration interface; and receive a selection of a target application from the group of candidate applications.

In some embodiments, the group of candidate applications includes at least one of the following: a preset first group of applications, a second group of applications determined based on application installation information, and a third group of applications determined based on real-time application detection.

In some embodiments, the determination module 410 is further configured to: obtain input application description information in the permission configuration interface; and determine the target application based on the application description information.

In some embodiments, the acquisition module 420 is further configured to: provide a first configuration component corresponding to the device configuration in the permission configuration interface, the first configuration component displaying a group of candidate devices; and determine the target scope in the target organization that is authorized to use the target application based on the selection of at least one device from the group of candidate devices.

In some embodiments, a group of candidate devices includes: a first group of candidate devices preset in a target organization, a second group of candidate devices matching a first search term, and the first search term is associated with device description information of the device.

In some embodiments, the acquisition module 420 is also configured to: provide a second configuration component corresponding to the user configuration in the permission configuration interface, and the first configuration component displays a group of candidate users; and based on the selection of at least one user from the group of candidate users, determine the target scope in the target organization that is authorized to use the target application.

In some embodiments, a group of candidate users includes: a first group of candidate users preset in the target organization, a second group of candidate users matching a second search term, and the second search term is associated with user description information of the user.

In some embodiments, the acquisition module 420 is further configured to: receive input of a handling policy for using the target application outside the target scope using the permission configuration interface, wherein the handling policy includes at least one of the following: a first handling policy indicating that the target application is used outside the target scope; Disable; a second handling policy indicating generation of a first reminder for unauthorized use and/or attempted use of a target application outside a target scope, so that a first device associated with the unauthorized use and/or attempted use displays the first reminder; and/or, a third handling policy indicating generation of a second reminder for unauthorized use exceeding a predetermined number so that a terminal device associated with an administrative user of the target organization displays the second reminder, wherein the predetermined number is configured using a permission configuration interface.

In some embodiments, the apparatus 400 further includes a display module configured to: display application statistics information in the permission configuration interface, wherein the application statistics information indicates a comparison result between authorized usage of at least one application in the target organization and all usage.

In some embodiments, the presentation module is further configured to: provide risk description information for at least one application, where the risk description information is generated based on the comparison result.

FIG5 shows a block diagram of an electronic device 500 in which one or more embodiments of the present disclosure may be implemented. It should be understood that the electronic device 500 shown in FIG5 is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. The electronic device 500 shown in FIG5 may be used to implement the terminal device 120 and/or the management device 110 of FIG1 .

As shown in FIG5 , the electronic device 500 is in the form of a general electronic device. The components of the electronic device 500 may include, but are not limited to, one or more processors or processing units 510, a memory 520, a storage device 530, one or more communication units 540, one or more input devices 550, and one or more output devices 560. The processing unit 510 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 520. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 500.

The electronic device 500 typically includes a plurality of computer storage media. Such media may be any accessible media that is accessible to the electronic device 500, including but not limited to volatile and nonvolatile media, removable and non-removable media. The memory 520 may be a volatile memory (e.g., registers, cache, random access memory (RAM)), a nonvolatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 530 may be a removable The electronic device 500 may be removable or non-removable and may include machine-readable media such as a flash drive, a disk, or any other media that may be capable of storing information and/or data (e.g., training data for training) and may be accessed within the electronic device 500.

The electronic device 500 may further include additional removable/non-removable, volatile/non-volatile storage media. Although not shown in FIG. 5 , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a “floppy disk”) and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to a bus (not shown) by one or more data media interfaces. The memory 520 may include a computer program product 525 having one or more program modules configured to perform various methods or actions of various embodiments of the present disclosure.

The communication unit 540 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 500 can be implemented in a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 500 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

The input device 550 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 560 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 500 may also communicate with one or more external devices (not shown) through the communication unit 540 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 500, or communicate with any device that allows the electronic device 500 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input/output (I/O) interface (not shown).

According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above. Execute to implement the method described above.

Various aspects of the present disclosure are described herein with reference to the flowcharts and/or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and/or block diagram and the combination of each box in the flowchart and/or block diagram can be implemented by computer-readable program instructions.

These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions/actions specified in one or more boxes in the flowchart and/or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and/or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

The flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the systems, methods and computer program products according to multiple implementations of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment or a portion of an instruction, and a module, a program segment or a portion of an instruction contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions marked in the boxes may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and/or flowchart, and the combination of boxes in the block diagram and/or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with dedicated hardware and computer instructions. combination to achieve this.

The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims (15)

A method for rights management, comprising: In a permission configuration interface for managing users and/or devices in a target organization, determining a target application to be configured; Acquiring a permission policy to be applied to the target application by using the permission configuration interface, the permission policy at least indicating a target scope in the target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, the target scope including a group of target users and/or a group of target devices; and Based on the permission policy, the execution of the target application in the target organization is managed. The method according to claim 1, wherein determining the target application to be configured comprises: Displaying a group of candidate applications in the permission configuration interface; and A selection of the target application from the set of candidate applications is received. The method according to claim 2, wherein the set of candidate applications includes at least one of the following: The first set of preset applications, A second group of applications determined based on the application installation information, A third group of applications is determined based on real-time application detection. The method according to claim 1, wherein determining the target application to be configured comprises: In the permission configuration interface, obtaining input application description information; and Based on the application description information, the target application is determined. The method according to claim 1, wherein using the permission configuration interface to obtain the permission policy to be applied to the target application comprises: Providing a first configuration component corresponding to the device configuration in the permission configuration interface, wherein the first configuration component displays a group of candidate devices; and Based on the selection of at least one device from the group of candidate devices, the target scope in the target organization that is authorized to use the target application is determined. The method according to claim 5, wherein the set of candidate devices comprises: A first group of candidate devices preset in the target organization, A second group of candidate devices matching the first search term, wherein the first search term is associated with device description information of the device. The method according to claim 1, wherein using the permission configuration interface to obtain the permission policy to be applied to the target application comprises: providing a second configuration component corresponding to the user configuration in the permission configuration interface, wherein the first configuration component displays a group of candidate users; and Based on the selection of at least one user from the group of candidate users, the target scope in the target organization that is authorized to use the target application is determined. The method according to claim 7, wherein the set of candidate users comprises: A first group of candidate users preset in the target organization, A second group of candidate users matching a second search term, wherein the second search term is associated with user description information of the user. The method according to claim 1, wherein using the permission configuration interface to obtain the permission policy to be applied to the target application comprises: receiving, by using the permission configuration interface, an input of the handling policy for using the target application outside the target scope, The treatment strategy includes at least one of the following: A first handling policy indicating that the target application is disabled outside the target range; A second handling policy instructs to generate a first reminder for unauthorized use and/or attempted use of the target application outside the target range, so that a first device associated with the unauthorized use and/or attempted use displays the first reminder; A third handling policy indicates generating a second reminder for unauthorized use exceeding a predetermined number, so that a terminal device associated with the management user of the target organization displays the second reminder, wherein the predetermined number is configured using the permission configuration interface. The method according to claim 1, further comprising: Display application statistics in the permission configuration interface, the application statistics indicating the authorized use and total use of at least one application in the target organization The comparison results. The method according to claim 10, further comprising: Risk description information for the at least one application is provided, the risk description information being generated based on the comparison result. A device for rights management, comprising: A determination module configured to determine a target application to be configured in a permission configuration interface for managing users and/or devices in a target organization; an acquisition module configured to acquire, by using the permission configuration interface, a permission policy to be applied to the target application, the permission policy at least indicating a target scope in a target organization that is authorized to use the target application and a disposal policy for using the target application outside the target scope, the target scope including a group of target users and/or a group of target devices; and The management module is configured to manage the execution of the target application in the target organization based on the permission policy. An electronic device, comprising: at least one processing unit; and At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 11 when executed by the at least one processing unit. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 11. A computer program product, the computer program product being tangibly stored in a computer storage medium and comprising computer executable instructions which, when executed by a device, cause the device to perform the method according to any one of claims 1 to 11.