User authority control method and device, computer equipment and readable storage medium

Abstract

The invention relates to a user permission control method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: when a function access request for a page module sent by a user through a terminal is received, obtaining a user function role and a user data role according to a user identifier of the user; determining a user function permission of the user according to the user function role, issuing page data of the page module to the terminal when determining that the user has a function access permission to the page module according to the user function permission, and determining a user data permission of the user according to the user data role; and when a data access request triggered by the user on the page module through the terminal is received, processing the data access request according to the user data permission to obtain a data processing result, and feeding back the data processing result to the terminal. By adopting the method, the data security can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a user authority control method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of computer technology, the digital transformation of enterprises has gradually deepened, and enterprise application platforms have emerged. As an important platform to support the core business processes of enterprises, integrate enterprise resources, and achieve rapid business innovation, the service security management of enterprise application platforms is particularly important.

[0003] In traditional technology, in an enterprise application platform, multiple types of users may be involved, and each type of user corresponds to a different data access scope. When performing service security management, different data permissions need to be set for different jobs based on business needs.

[0004] However, as enterprise application platforms become increasingly large and complex, the demand for data permissions has also become very complex. Traditional methods cannot meet the needs of complex data permission control and have the problem of low data security. Summary of the invention

[0005] Based on this, it is necessary to provide a user authority control method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve data security in response to the above technical problems.

[0006] In a first aspect, the present application provides a user authority control method, comprising:

[0007] When receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to a user identifier of the user;

[0008] Determine the user function authority of the user according to the user function role, and when it is determined according to the user function authority that the user has the function access authority to the page module, send the page data of the page module to the terminal, and determine the user data authority of the user according to the user data role;

[0009] When receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and a data processing result is obtained and fed back to the terminal.

[0010] In one embodiment, when receiving a data access request triggered by the user through the terminal in the page module, processing the data access request according to the user data authority, obtaining a data processing result and feeding it back to the terminal includes:

[0011] When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data query request, constructing a data query statement according to the data query request and the user data authority;

[0012] The database is accessed through the data query statement, and the data query result is obtained and fed back to the terminal.

[0013] In one embodiment, when a data access request triggered by the user through the terminal in the page module is received, and the data access request is a data query request, constructing a data query statement according to the data query request and the user data authority includes:

[0014] When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data query request, parsing the data query request, constructing a basic query statement, and generating a query restriction condition according to the user data authority;

[0015] A data query statement is constructed based on the basic query statement and the query restriction condition.

[0016] In one embodiment, when receiving a data access request triggered by the user through the terminal in the page module, processing the data access request according to the user data authority, obtaining a data processing result and feeding it back to the terminal includes:

[0017] When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data change request, verifying the data operation authority of the user according to the user data authority;

[0018] When the user passes the data operation authority verification, the data change request is executed, the data processing result is obtained and fed back to the terminal.

[0019] In one embodiment, the user authority control method further includes:

[0020] The organizational level of the user is determined according to the user identifier of the user, and based on the organizational level of the user, the constructed data permission model is queried to determine the user function role and the user data role of the user.

[0021] In one embodiment, the user authority control method further includes:

[0022] Acquire multiple platform system permissions, divide the multiple platform system permissions into multiple functional permissions and multiple data permissions, and set a functional role for each of the functional permissions, and set a data role for each of the data permissions;

[0023] Acquire multiple organizational levels, set roles for each organizational level, obtain role setting results, and construct the data permission model based on the role setting results.

[0024] In a second aspect, the present application also provides a user authority control device, comprising:

[0025] A role acquisition module, configured to acquire a user function role and a user data role according to a user identifier of the user when receiving a function access request for a page module sent by a user through a terminal;

[0026] a function permission verification module, used to determine the user function permission of the user according to the user function role, and when it is determined according to the user function permission that the user has the function access permission to the page module, send the page data of the page module to the terminal, and determine the user data permission of the user according to the user data role;

[0027] The data authority verification module is used to process the data access request according to the user's data authority when receiving the data access request triggered by the user through the terminal in the page module, obtain the data processing result and feed it back to the terminal.

[0028] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0029] When receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to a user identifier of the user;

[0030] Determine the user function authority of the user according to the user function role, and when it is determined according to the user function authority that the user has the function access authority to the page module, send the page data of the page module to the terminal, and determine the user data authority of the user according to the user data role;

[0031] When receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and a data processing result is obtained and fed back to the terminal.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0033] When receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to a user identifier of the user;

[0034] Determine the user function authority of the user according to the user function role, and when it is determined according to the user function authority that the user has the function access authority to the page module, send the page data of the page module to the terminal, and determine the user data authority of the user according to the user data role;

[0035] When receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and a data processing result is obtained and fed back to the terminal.

[0036] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0037] When receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to a user identifier of the user;

[0038] Determine the user function authority of the user according to the user function role, and when it is determined according to the user function authority that the user has the function access authority to the page module, send the page data of the page module to the terminal, and determine the user data authority of the user according to the user data role;

[0039] When receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and a data processing result is obtained and fed back to the terminal.

[0040] The above-mentioned user authority control method, device, computer equipment, computer-readable storage medium and computer program product, when receiving a function access request for a page module sent by a user through a terminal, obtains the user function role and the user data role according to the user's user identification, and can realize the determination of the user role, and then can use the user function role to realize the determination of the user function authority, and use the user function authority to realize the determination of whether the user has the function access right to the page module, and realize the verification of the user's function authority, so that when the user has the function access right to the page module, the page data of the page module can be sent to the terminal so that the terminal displays the page module, and on the basis of using the user data role to realize the determination of the user data authority, when receiving the user's data access request, the data access request is processed using the user data authority, and the data processing result is obtained and fed back to the terminal, so that the user's data authority can be verified. During the whole process, by first determining the user's functional role and user's data role, using the user's functional role to determine the user's functional permissions, and using the user's data role to determine the user's data permissions, and then using the user's functional permissions and user's data permissions, dual control of functional permissions and data permissions is achieved, which can achieve refined control over user permissions and improve data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] FIG1 is an application environment diagram of a user authority control method in one embodiment;

[0043] FIG2 is a schematic diagram of a flow chart of a method for controlling user rights in one embodiment;

[0044] FIG3 is a schematic diagram of a data permission model in one embodiment;

[0045] FIG4 is a schematic flow chart of a method for controlling user rights in another embodiment;

[0046] FIG5 is a schematic diagram of a flow chart of a method for controlling user rights in yet another embodiment;

[0047] FIG6 is a schematic diagram of a database in one embodiment;

[0048] FIG7 is a structural block diagram of a user authority control device in one embodiment;

[0049] FIG. 8 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] The user authority control method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, can be integrated on the server 104, or can be placed on the cloud or other network servers. When receiving a function access request for a page module sent by a user through the terminal 102, the server 104 obtains the user function role and the user data role according to the user's user identification, and determines the user function authority of the user according to the user function role. When it is determined that the user has the function access authority to the page module according to the user function authority, the page data of the page module is sent to the terminal 102, and the user data authority of the user is determined according to the user data role. When a data access request triggered by the user in the page module through the terminal 102 is received, the data access request is processed according to the user data authority, and the data processing result is obtained and fed back to the terminal 102.

[0052] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0053] In an exemplary embodiment, as shown in FIG2 , a user authority control method is provided, which can be executed by a terminal or a server alone, or by a terminal and a server in collaboration. The method is applied to the server in FIG1 as an example for description, and includes the following steps 202 to 206. Among them:

[0054] Step 202: when a function access request for a page module sent by a user through a terminal is received, a user function role and a user data role are obtained according to the user identifier of the user.

[0055] Among them, page module refers to an independent, reusable part that constitutes a web page or application interface. For example, a page module can refer to a part of a page, which is an independent component or part that constitutes the entire page. In this case, the page includes multiple page modules, each of which is responsible for displaying specific content or functions, and they together constitute the entire page. For another example, a page module can specifically refer to the complete structure of the entire page, that is, it is a complete page view, which may contain multiple sub-modules or components. In this embodiment, a page module can specifically refer to a module on an enterprise application platform, which can be a part of any page or the entire page.

[0056] Among them, the function access request for the page module refers to the function access request initiated by the user for the page module, and the function access request here can be specifically for creating, modifying, deleting, approving data or performing other operations. The user identifier refers to a unique identifier used to identify and distinguish users. For example, the user identifier can specifically refer to a string used to identify and distinguish users.

[0057] Among them, user function roles refer to roles assigned to users based on the responsibilities and permissions they assume. They define the operations that users can perform and the resources they can access. User function roles help to achieve permission control and separation of power and responsibility. For example, common user function roles can be administrators, editors, auditors, etc. Administrators have the highest permissions on the platform and can manage other users, configure platform settings, and access all data. Editors can create, edit, and delete content, but usually cannot access the platform's system settings or user management. Auditors can review and approve content.

[0058] Among them, user data roles refer to the definition of the data that users can access or operate based on their roles in data management and data security. It can be understood that user data roles are related to the data that users can access. It defines the scope of data that users can view or operate, and is used to ensure data security and compliance.

[0059] Exemplarily, when receiving a function access request for a page module sent by a user through a terminal, the server obtains the user's user ID from the function access request, and obtains the user's function role and user data role based on the user ID. In a specific application, the server has already assigned a user function role and a user data role to each user of the platform in advance, and stores a "user-function role" correspondence table and a "user-data role" correspondence table. After obtaining the user ID, the server uses the user ID to query the "user-function role" correspondence table to determine the user's user function role, and uses the user ID to query the "user-data role" correspondence table to determine the user's user data role.

[0060] Step 204, determine the user's user function permissions according to the user function role. When it is determined that the user has function access rights to the page module according to the user function permissions, send the page data of the page module to the terminal, and determine the user's user data permissions according to the user data role.

[0061] User functional permissions refer to the functions or operations that users can perform according to the user's functional role. For example, user functional permissions can be specifically view permissions, edit permissions, create permissions, delete permissions, manage permissions, etc. User data permissions refer to the range and type of data that users can view or operate according to the user's data role. Page data refers to data related to the page in a web page or application interface, which is used to display information, perform functions, or support user interaction.

[0062] Exemplarily, based on the user's functional role, the server can determine the user's user functional permissions, and then use the user functional permissions to determine whether the user has functional access permissions to the page module. When it is determined that the user has functional access permissions to the page module, the page data of the page module is sent to the terminal so that the terminal can load and display the page module based on the page data, and determine the user's user data permissions based on the user data role, so as to further control the user permissions using the user data permissions. If it is determined that the user does not have functional access permissions to the page module, the server will deny the user access to the page module and feedback the access denial prompt to the terminal.

[0063] In a specific application, the server pre-stores a "functional role-module-functional permission" correspondence table. By using the user's functional role to query the "functional role-module-functional permission" correspondence table, the user's functional permission can be determined. By comparing the user's functional permission and the functional access request for the page module, it can be determined whether the user has functional access rights to the page module. In a specific application, if the data operation type indicated by the functional access request for the page module is within the range of the user's executable operation types in the page module in the user's functional permissions, the user is considered to have functional access rights to the page module.

[0064] In a specific application, the server pre-stores a "data role-module-data permission" correspondence table. By using the user data role to query the "data role-module-data permission" correspondence table, the user data permission can be determined.

[0065] Step 206, when receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and the data processing result is obtained and fed back to the terminal.

[0066] Among them, data access request refers to a request initiated by a user for the purpose of accessing or operating data, which may include operations such as querying, adding, modifying, and deleting data. For example, a data access request may specifically be a data query request, the purpose of which is to retrieve information from a database. For another example, a data access request may specifically be a data change request, the purpose of which is to change data, and the change here may be at least one of adding, modifying, and deleting.

[0067] Exemplarily, when receiving a data access request triggered by a user through a terminal in a page module, the server will process the data access request according to the user's data permissions, obtain the data processing results and feed them back to the terminal. In a specific application, the user's data permissions may specifically include the data range that the user can view or operate in the page module. The server can verify the user's data access permission based on the data range that the user can view or operate in the page module and the data access range indicated by the data access request. When the user passes the data access permission verification, the data access request is executed, the data processing results are obtained and fed back to the terminal.

[0068] The above user authority control method, when receiving a function access request for a page module sent by a user through a terminal, obtains the user function role and the user data role according to the user's user ID, can achieve the determination of the user role, and then can use the user function role to determine the user's function authority, and use the user function authority to determine whether the user has the function access authority to the page module, and realize the verification of the user's function authority, so that when the user has the function access authority to the page module, the page data of the page module can be sent to the terminal so that the terminal displays the page module, and on the basis of using the user data role to determine the user data authority, when receiving the user's data access request, the user data authority is used to process the data access request, obtain the data processing result and feedback to the terminal, and can realize the verification of the user's data authority. The whole process, by determining the user function role and the user data role on the basis of first determining the user function role and the user data role, using the user function role to determine the user function authority, and using the user data role to determine the user data authority, and then using the user function authority and the user data authority, realizes the dual control of function authority and data authority, can realize the refined control of user authority, and improve data security.

[0069] In an exemplary embodiment, when a data access request triggered by a user through a terminal in a page module is received, the data access request is processed according to the user data authority, and the data processing result is obtained and fed back to the terminal, including:

[0070] When receiving a data access request triggered by a user through a terminal in a page module, and the data access request is a data query request, a data query statement is constructed according to the data query request and the user's data authority;

[0071] Access the database through data query statements, obtain data query results and feed them back to the terminal.

[0072] Among them, a data query request refers to a request for retrieving or reading data. For example, a data query request may specifically be a request to retrieve data from a relational database using a structured query statement. For another example, a data query request may specifically be a request to retrieve data from other databases using an unstructured query statement. A data query statement refers to a statement for querying the data to be read. For example, a data query statement may specifically be a structured query statement or an unstructured query statement.

[0073] The database refers to a system for storing, retrieving and analyzing data, which allows a large amount of data to be stored and retrieved when needed. It should be noted that the database can be local, integrated on a server, or separately set on a remote server and accessed through a network. In this embodiment, the database can be a relational database or a non-relational database.

[0074] Exemplarily, when a data access request triggered by a user through a terminal in a page module is received, and the data access request is a data query request, the server will parse the data query request, construct a basic query statement, and based on the basic query statement and user data permissions, construct a data query statement, access the database through the data query statement, obtain the data query results and feedback to the terminal.

[0075] In specific applications, user data permissions include the range and type of data that the user can view or operate. Therefore, the data query statement constructed based on the user data permissions actually includes the range of data that the user can view or operate. That is, accessing the database through a data query statement is actually accessing the database within the range of data that the user can view or operate. If the user has permission to view the data, the data query result obtained is the data requested by the user. If the user does not have permission to view the data, the data query result obtained is empty.

[0076] In a specific application, after determining the user data permissions, the server will store the key value of the user data permissions in the session. After the user triggers a data access request in the page module through the terminal, the server will obtain the user data permissions based on the key value of the user data permissions stored in the session, and parse the data query request and build a basic query statement. Based on the basic query statement and user data permissions, the server will build a data query statement, that is, inject the user data permissions into the data query statement.

[0077] In this embodiment, when the data access request is a data query request, a data query statement is constructed using the data query request and user data permissions, and the database is accessed through the data query statement to obtain the data query result and feed it back to the terminal. The control of user data permissions can be achieved by constructing a data query statement through user data permissions.

[0078] In an exemplary embodiment, when a data access request triggered by a user through a terminal in a page module is received, and the data access request is a data query request, constructing a data query statement according to the data query request and the user data authority includes:

[0079] When receiving a data access request triggered by a user through a terminal in a page module, and the data access request is a data query request, parsing the data query request, constructing a basic query statement, and generating query restriction conditions according to the user's data permissions;

[0080] Construct data query statements based on basic query statements and query restriction conditions.

[0081] Exemplarily, when a data access request is received from a user through a terminal in a page module, and the data access request is a data query request, the server will parse the data query request, determine the data table to be queried, the field to be retrieved, and whether there are other conditions such as filtering conditions, sorting requirements, grouping requirements, etc., and build a basic query statement based on the determined data table, the field to be retrieved, and other conditions. At the same time, the server will generate query restrictions based on the data range that the user can view or operate in the user's data permissions. After generating the query restrictions, the server can build a data query statement based on the basic query statement and the query restrictions.

[0082] In a specific application, taking a structured query statement as an example, a basic query statement may generally include a SELECT clause, a FROM clause, a WHERE clause, a GROUP BY clause, an ORDER BY clause, etc. Among them, the SELECT clause is used to specify the field to be retrieved. The FROM clause is used to specify the data table to be queried. The WHERE clause is used to specify the filtering condition. The GROUP BY clause is used for data grouping. The ORDER BY clause is used to sort the results. The query restriction condition may specifically be a range restriction statement, which is expressed by the WHERE clause.

[0083] In a specific application, after generating the query restriction condition, the server can add the query restriction condition as an encapsulated method to the data query statement, and the data query statement constructed based on this can realize the control of the data access scope. It can be understood that when the data permission scope of the user under the page module changes, it is only necessary to change the data permission scope of the user under the page module, and there is no need to change the data access code to realize the control of the user's data permission. If the system needs to modify the data permission scope, it only needs to change the method encapsulated by the query restriction condition to realize the modification of the data permission. By encapsulating the query restriction condition as a method in this way, the code modification during data access control can be effectively reduced.

[0084] In this embodiment, when the data access request is a data query request, the data query request is parsed, a basic query statement is constructed, and query restriction conditions are generated according to user data permissions. The basic query statement and the query restriction conditions are used to construct a data query statement. The query restriction conditions can be generated through user data permissions, and the query restriction conditions can be used to construct a data query statement to achieve control over user data permissions.

[0085] In an exemplary embodiment, when a data access request triggered by a user through a terminal in a page module is received, the data access request is processed according to the user data authority, and the data processing result is obtained and fed back to the terminal, including:

[0086] When receiving a data access request triggered by a user through a terminal in a page module, and the data access request is a data change request, the user's data operation authority is verified according to the user's data authority;

[0087] When the user passes the data operation authority verification, executes the data change request, obtains the data processing result and feeds it back to the terminal.

[0088] Exemplarily, when a data access request is received from a user through a terminal in a page module, and the data access request is a data change request, the server will verify the user's data operation authority based on the data range that the user can operate in the user's data permissions to verify whether the user can make data changes. When the user passes the data operation authority verification, the data change request is executed, the data processing result is obtained and fed back to the terminal.

[0089] In a specific application, the server will compare the data range that the user can operate in the user data authority with the data range to be processed indicated by the data change request. When the data range to be processed is within the data range that the user can operate in the user data authority, the server will determine that the user can make data changes, that is, the user passes the data operation authority verification, executes the data change request, obtains the data processing result and feeds it back to the terminal. At this time, the data processing result is the data change result. If the data range to be processed is not within the data range that the user can operate in the user data authority, the server will feed back a prompt of no data authority to the terminal.

[0090] In this embodiment, when the data access request is a data change request, the user's data operation authority is verified based on the user's data permissions. When the user passes the data operation authority verification, the data change request is executed, the data processing result is obtained and fed back to the terminal. The control of user data permissions can be achieved by verifying data operation permissions through user data permissions.

[0091] In an exemplary embodiment, the user authority control method further includes:

[0092] According to the user's user ID, determine the user's organizational level. Based on the user's organizational level, query the constructed data permission model to determine the user's user function role and user data role.

[0093] The organizational level of a user refers to the user's position and level in the organizational structure. It is understandable that the user's organizational level may affect their roles, permissions, and the data they can access. The data permission model refers to a set of rules and policies used to control user access to data, which ensures that users can only access the data they are authorized to access. The data permission model includes the association between organizational level and functional role, functional role and functional permission, organizational level and data role, data role and data permission, etc.

[0094] Exemplarily, the server can query pre-stored organizational structure data based on the user's user ID to determine the user's organizational level, and based on the user's organizational level, query the constructed data permission model to determine the user's user function role and user data role, and set the user function role and user data role for the user, store the first association between the user ID and the user function role in the "user-function role" correspondence table, and store the second association between the user ID and the user data role in the "user-data role" correspondence table.

[0095] In specific applications, organizational structure data refers to data used to describe organizational structure relationships, which can be organizational structure diagrams and related data. Based on user identification and organizational structure data, the user's position in the organizational structure, that is, the organizational level the user is in, can be determined. Organizational structure relationships refer to the formal or informal levels and relationships between departments, teams, and individuals within an organization.

[0096] In specific applications, the constructed data permission model is built based on the organizational structure relationship and is a direct mapping of the organizational structure relationship. In the data permission model, the role setting results of each organizational level are defined. After the server determines the organizational level of the user, it directly queries the data permission model based on the organizational level of the user to determine the user's user function role and user data role.

[0097] In this embodiment, based on the use of user identification to determine the user's organizational level, the user's organizational level can be used to query the constructed data permission model to determine the user's user function role and user data role, and then set the user's user function role and user data role.

[0098] In an exemplary embodiment, the user authority control method further includes:

[0099] Obtain multiple platform system permissions, divide the multiple platform system permissions into multiple functional permissions and multiple data permissions, and set a functional role for each functional permission, and set a data role for each data permission;

[0100] Obtain multiple organizational levels, set roles for each organizational level, obtain role setting results, and build a data permission model based on the role setting results.

[0101] Among them, platform system permissions refer to the permissions provided by the platform to users in the organization, which can be assigned according to the user's role and responsibilities in the organization. It can be understood that these permissions determine what data, functions or services the user can access and operate.

[0102] Exemplarily, before setting user function roles and user data roles for users, it is necessary to build a data permission model. When building the data permission model, the server will first obtain multiple platform system permissions, and then divide the multiple platform system permissions into multiple function permissions and multiple data permissions, and set a function role for each function permission, and set a data role for each data permission, and then obtain multiple organizational levels, and set roles for each organizational level according to the positions and responsibilities of each organizational level, and obtain the role setting results. Based on the role setting results, a data permission model is built. Among them, functional permissions are used to limit users' access to specific platform functions or page modules, such as access to reports, settings or other management tools. Data permissions are used to allow users to access only data related to their work, such as only being able to view or edit data in their own department.

[0103] In specific applications, the server can determine the functions or operations that each organizational level can perform based on the positions and responsibilities of each organizational level, and then set the functional role for each organizational level based on the functions or operations that each organizational level can perform. At the same time, the server can determine the data scope that each organizational level can view or operate based on the positions and responsibilities of each organizational level, and then set the data role for each organizational level based on the data scope that each organizational level can view or operate.

[0104] In a specific application, after determining the positions and responsibilities of each organizational level, the server can push the positions and responsibilities of each organizational level to the platform administrator's terminal, so that the platform administrator can set roles for each organizational level, generate role setting results and feedback to the server.

[0105] In a specific application, taking the organizational level as an example, the constructed data permission model can be shown in Figure 3, including users, functional roles assigned to users, data roles, functional permissions assigned to functional roles, and data permissions assigned to data roles. In addition, as shown in Figure 3, functional roles, functional permissions, data roles, and data permissions are restrictions on user permission control. In the process of user permission control, the user functional role and user data role obtained after determining the user identity can be stored in the session for use when permission verification is required.

[0106] In this embodiment, by obtaining multiple platform system permissions, the multiple platform system permissions are divided into multiple functional permissions and multiple data permissions, and a functional role is set for each functional permission, and a data role is set for each data permission. The set functional roles and data roles can be used to set roles for each organizational level to obtain role setting results, and then the role setting results can be used to construct a data permission model, which can achieve accurate construction of the data permission model.

[0107] In an exemplary embodiment, as shown in FIG4 , a user authority control method of the present application is described by a flowchart, and the user authority control method specifically includes the following steps:

[0108] Step 402, obtaining multiple platform system permissions, dividing the multiple platform system permissions into multiple functional permissions and multiple data permissions, and setting a functional role for each functional permission, and setting a data role for each data permission;

[0109] Step 404, obtaining multiple organizational levels, performing role settings for each organizational level, obtaining role setting results, and constructing a data permission model based on the role setting results;

[0110] Step 406, according to the user's user ID, determine the user's organizational level, based on the user's organizational level. Query the constructed data permission model to determine the user's user function role and user data role;

[0111] Step 408, when receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to the user ID of the user;

[0112] Step 410, determining the user's user function rights according to the user function role, and when it is determined according to the user function rights that the user has the function access rights to the page module, sending the page data of the page module to the terminal, and determining the user's user data rights according to the user data role;

[0113] Step 412: when a data access request triggered by a user through a terminal in a page module is received, and the data access request is a data query request, the data query request is parsed, a basic query statement is constructed, and query restriction conditions are generated according to the user data authority;

[0114] Step 414, constructing a data query statement based on the basic query statement and the query restriction condition;

[0115] Step 416, access the database through the data query statement, obtain the data query result and feed it back to the terminal.

[0116] In an exemplary embodiment, as shown in FIG5 , a user authority control method of the present application is described by a flowchart, and the user authority control method specifically includes the following steps:

[0117] Step 502, obtaining multiple platform system permissions, dividing the multiple platform system permissions into multiple functional permissions and multiple data permissions, and setting a functional role for each functional permission, and setting a data role for each data permission;

[0118] Step 504, obtaining multiple organizational levels, performing role settings for each organizational level, obtaining role setting results, and constructing a data permission model based on the role setting results;

[0119] Step 506, according to the user's user ID, determine the user's organizational level, based on the user's organizational level. Query the constructed data permission model to determine the user's user function role and user data role;

[0120] Step 508, when receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to the user ID of the user;

[0121] Step 510, determining the user's user function rights according to the user function role, and when it is determined according to the user function rights that the user has the function access rights to the page module, sending the page data of the page module to the terminal, and determining the user's user data rights according to the user data role;

[0122] Step 512: when a data access request triggered by a user through a terminal in a page module is received, and the data access request is a data change request, the user's data operation authority is verified according to the user's data authority;

[0123] Step 514: When the user passes the data operation authority verification, the data change request is executed, the data processing result is obtained and fed back to the terminal.

[0124] In an exemplary embodiment, the user authority control method of the present application is described by taking the application of the user authority control method of the present application to a mobile application platform of an enterprise as an example.

[0125] The inventor believes that in the enterprise's mobile application platform, multiple types of users may be involved, and each type of user corresponds to a different data access scope. When performing service security management, different data permissions need to be set for different jobs according to business needs. However, with the increasing size and complexity of mobile application platforms, the demand for data permissions has also become very complex. Traditional methods cannot meet the needs of complex data permission control, and there are problems with low data security, which may lead to data leakage, non-compliant operations, security vulnerabilities, unclear responsibilities, increased management complexity, and business process interruptions. These problems not only affect the data security and compliance of the enterprise, but may also damage the company's reputation and financial situation. Therefore, a more advanced permission management method is needed to solve these problems, ensure data security, improve management efficiency, and support the business continuity and compliance requirements of the enterprise.

[0126] Based on this, the present application provides a user authority control method to meet the needs of complex data authority control to ensure the security, reliability and efficiency of mobile application platform services.

[0127] In an exemplary embodiment, the user authority control method of the present application can implement authority management, authority allocation, data access control and audit monitoring, and each part is described below.

[0128] Among them, permission management refers to the use of a unified data permission model to strengthen the security of shared services, ensure consistency in accessing and operating data within the organization, and reasonably allocate user identification permissions within the organization. It is necessary to meet current business needs while not exceeding the scope of access, avoid confusion and abuse of permissions, and ensure the compliance and legality of information acquisition.

[0129] Among them, consistency in accessing and operating data means ensuring that all users and systems follow unified rules and standards when accessing or operating data. This includes: Unified permission rules: All users obtain permissions based on their roles to ensure consistency in permission allocation. Fine-grained access control: Limit users to access and operate only the data they are authorized to. Audit and monitoring: Record all data access behaviors to ensure traceability and compliance. Adapt to organizational changes: As the organizational structure adjusts, permission updates are kept synchronized to ensure that new members obtain appropriate permissions. Reduce errors: Reduce human errors and improve the accuracy of data management through standardized processes.

[0130] Among them, authority allocation refers to rational management according to different organizational structures and personnel with different responsibilities, authority allocation according to structural organization and role responsibilities, simplifying the empowerment operation of platform managers, and taking the administrative organizational structure as the benchmark. When new members join the organization or adjust departments, authority is allocated and adjusted according to their organizational units, without the need to set the authority of each member one by one.

[0131] Among them, the way to allocate permissions according to the organizational structure and role responsibilities includes: Analyze the organizational structure: First, you need to understand the organizational structure of the enterprise and clarify the responsibilities of different departments and positions. Define roles: Based on these responsibilities, define different roles, and each role has the permissions required to complete its responsibilities. Assign permissions: Configure specific permissions for each role to clarify which data can be accessed and which operations can be performed. Associate users with roles: Users are assigned corresponding roles according to their positions, thereby indirectly obtaining the permissions attached to the roles. Automated management: When new members join or employees change their positions, the system automatically assigns or updates roles according to their positions, thereby automatically adjusting their permissions. Permission inheritance and refinement: In the organizational structure, subordinate roles can inherit the permissions of superior roles and refine or restrict them as needed. Audit and monitoring: Regularly check the permission allocation to ensure compliance with security policies and compliance requirements. Dynamic adjustment: As the organization changes and business needs are updated, dynamically adjust the role and permission allocation to maintain the flexibility and adaptability of permission management.

[0132] Among them, controlling data access means using a unified data permission model to accurately control data access, and to perform fine-grained data access control based on the hierarchical relationship and needs of the administrative organizational structure. Platform administrators can obtain different data access permissions based on the job functions and responsibilities at different levels of the organizational structure, and have specific control and access to sensitive data, ensuring that only personnel with corresponding permissions can access and operate specific data, thereby improving data security and confidentiality.

[0133] Among them, audit monitoring refers to the audit and monitoring of data access supported by a unified data permission model. The allocation and control of permissions are based on the organizational structure, and the scope of permissions and responsibilities of different personnel in the organizational structure are clarified to ensure the traceability and responsibility of information, and to more easily track and monitor the access behavior of different organizational units and members to data. When an accident occurs, the audit monitoring module can quickly trace back to find the responsible person and the responsibility chain, confirm the cause of the accident and the response measures, and avoid the accident from happening again. Among them, accidents usually refer to violations of security policies, operational errors, data leaks or other events that cause damage to data integrity, availability or confidentiality.

[0134] Among them, the relationship in the data permission model is as follows: P(u, o)=Pr(r(u), o), where u is the User, r is the Role, and p is the privilege. Pr(r(u), o) is the permission of the role r granted by the user u to the business object o, where the user is the organizational unit, which can also be understood as the organizational level of the user. The permission of the user u to the business object o is recorded as P(u, o), then there is the following relationship: P(u, o)=Pr(r(u), o), where Pr(r(u), o) is the permission of the role r granted by the user u to the business object o.

[0135] Among them, assuming that the number of functional permissions is m and the number of data permissions is n, then in the data permission model, there are m*n permission relationships for complete permission management. The data permission model divides permissions into functional permissions and data permissions, and sets different roles for functional permissions and data permissions, namely data roles and functional roles. Functional roles and data roles are assigned to users. When users need to access data, they need to obtain the functional permissions of the functional role corresponding to the module and the data permissions of the data role at the same time.

[0136] It can be understood that the data permission model divides roles into type roles, and the relationship between users and roles becomes the relationship between users and functional roles and the relationship between users and data roles. The relationship between roles and functional permissions and data permissions is decoupled, so that the full permission set only contains m+n permissions. Assuming that the number of data permission types increases to n+x, the full permission set only needs to increase to m+n+x, and the full permission set in the data permission model corresponds to m*(n+x)=m*n+m*x. Similarly, when the functional permissions increase to m+x, the full permission set only increases to m+n+x, and the full permission set in the data permission model corresponds to (m+x)*n=m*n +n*x.

[0137] Specifically, data permission types can be view, edit, delete, share, etc. Specifically, view: allows users to view data but cannot make changes. Edit: allows users to modify data. Delete: allows users to delete data. Share: allows users to share data with other users or teams. Specifically, function permission types can be create, modify, delete, approve, etc. Specifically, create: allows users to create new records or files. Modify: allows users to modify existing records or files. Delete: allows users to delete records or files. Approve: allows users to approve operation requests from other users.

[0138] In a specific application, an example of adding permissions is given. Assuming that a company has 3 types of functional permissions (m=3: create, modify, delete) and 3 types of data permissions (n=3: view, edit, delete), there will be 3+3=6 basic permission combinations in the full permission set. If x data permission types are added: Add a new data permission type: export. The number of permissions added to the full permission set: 3×1=3, 3×1=3 (each functional permission type is combined with the new "export" data permission type). New full permission set: 3+3+1=7, 3+3+1=7 permissions. If x functional permission types are added: Add a new functional permission type: restore (used to restore previously deleted data). The number of permissions added to the full permission set: 1×3=3, 1×3=3 (each data permission type is combined with the new "restore" functional permission type). New full permission set: 3+3+1=7, 3+3+1=7 permissions.

[0139] This makes the data permission model less variable as the system data permissions change, has better scalability, and reduces the large amount of modification work caused by the increase of functional permissions and data permissions for role permission maintenance. In actual operation, it can also make the user's role assignment clearer and achieve more concise role permission control.

[0140] Type roles can include functional roles, data roles, security roles, and project roles. Functional roles are related to the user's responsibilities in the organization and define the types of operations that the user can perform. Data roles are related to the data that the user can access and define the scope of data that the user can view or operate. Security roles are based on security and compliance requirements and define the security standards that users must meet to obtain permissions. Project roles are related to the projects or tasks that the user participates in and define the user's permissions in a specific project.

[0141] It can be understood that in this application, there is a many-to-many relationship between users and roles. A user can be assigned to several roles, and a role can also be assigned to several specific users. Similarly, there is a many-to-many relationship between roles and permissions. A role can have multiple permissions, and one permission can also be assigned to multiple different roles. The operating user can determine the system resources he can access and the operations he can perform on the system resources based on the permissions of the roles he has.

[0142] Among them, the permission control system of the data permission model adopts a common three-layer architecture, including the presentation layer, the business layer and the data layer, wherein the data layer is composed of a database system, and permission management is based on the database. The design structure of the database is shown in Figure 6, including a user table, a function role table, a "user-function role" correspondence table, a "function role-module-button" correspondence table, a data role table, a "user-data role" correspondence table, and a "data role-module-data range (i.e. data permission)" correspondence table, wherein the "function role-module-button" correspondence table stores the association between function roles, modules and buttons, and the "data role-module-data range (i.e. data permission)" correspondence table stores the association between data roles, modules and data ranges. The module here refers to the page module, and the button refers to the operation button or control provided by the user interface on the user's terminal.

[0143] Among them, the actual application of the module buttons and the module data range changes with the increase or decrease of system modules, and the maintenance amount only changes linearly with the increase or decrease of system modules and the change of data authority range; the user authorization part is implemented by user management, function role management, data role management, and user function role and data role allocation management. According to actual needs, roles are assigned to the menu modules that users need to access and the data range accessed under this menu module.

[0144] In a specific application, the data access control of the user authority control method of the present application is explained. When the page module is read in, the server obtains the user's user function role and user data role according to the user identifier, and determines whether the user has functional access rights to the page module according to the user function role. When it is determined that the user has functional access rights to the page module, the user's user data rights are determined according to the user data role, and the key value of the user data rights is stored in the Session. When the user uses buttons on the terminal, the data permission range in the Session is determined, and the data permission range is injected into the structured query statement. At this time, you only need to add a certain range restriction statement as an encapsulated method to the structured query statement to achieve control of the data access range.

[0145] It is understandable that when the scope of data permissions changes, the system needs to flexibly adjust the scope of data that users can access without modifying the underlying data access code. This adjustment is usually achieved by modifying the permission configuration or the encapsulated data access method. The following example illustrates the change in the scope of data permissions: Assume a company's sales team, where each sales representative can initially only access the customer data for which he is responsible. Initial permission settings: Sales representative A: can only access data for customer IDs from 1 to 100. Sales representative B: can only access data for customer IDs from 101 to 200. Permission changes: The company decides to expand the scope of responsibility of sales representative A to include some of sales representative B's customers. New permission settings: Sales representative A: can now access data for customer IDs from 1 to 150. In this example, there is no need to modify the code of the data access layer, only the data permission scope configuration of sales representative A needs to be adjusted.

[0146] The user authority control method of the present application is applied to the mobile application platform of the enterprise, which meets the needs of dual control of data authority and functional authority. It is based on the administrative organizational structure. When a new member joins the organization or adjusts the department, the authority is allocated and adjusted according to the organizational unit to which he belongs. There is no need to set the authority of each member one by one, which reduces the complexity of authority management and maintenance. It is applicable to service security management function modules at multiple organizational levels. At the same time, when the service security management method changes the data authority scope of the user under the module, it does not need to change the code of the data access layer. If the system needs to modify the data authority scope, it only needs to change the method encapsulated by the data authority restriction statement to realize the modification of the data authority, which effectively reduces the modification of the data access layer code.

[0147] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0148] Based on the same inventive concept, the embodiment of the present application also provides a user authority control device for implementing the user authority control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more user authority control device embodiments provided below can refer to the limitations on the user authority control method above, and will not be repeated here.

[0149] In an exemplary embodiment, as shown in FIG. 7 , a user authority control device is provided, including: a role acquisition module 702, a function authority verification module 704 and a data authority verification module 706, wherein:

[0150] The role acquisition module 702 is used to acquire the user function role and the user data role according to the user ID of the user when receiving the function access request for the page module sent by the user through the terminal;

[0151] The function permission verification module 704 is used to determine the user's user function permission according to the user's function role. When it is determined according to the user function permission that the user has the function access permission to the page module, the page data of the page module is sent to the terminal, and the user data permission of the user is determined according to the user data role;

[0152] The data authority verification module 706 is used to process the data access request according to the user's data authority when receiving the data access request triggered by the user through the terminal in the page module, obtain the data processing result and feed it back to the terminal.

[0153] The above user authority control device, when receiving a function access request for a page module sent by a user through a terminal, obtains a user function role and a user data role according to the user's user ID, can determine the user role, and then can use the user function role to determine the user's function authority, and use the user function authority to determine whether the user has the function access authority to the page module, and verify the user's function authority, so that when the user has the function access authority to the page module, the page data of the page module can be sent to the terminal so that the terminal displays the page module, and on the basis of using the user data role to determine the user data authority, when receiving the user's data access request, the user data authority is used to process the data access request, obtain the data processing result and feedback to the terminal, and verify the user's data authority. The whole process, by determining the user function role and the user data role on the basis of first determining the user function role and the user data role, using the user function role to determine the user function authority, and using the user data role to determine the user data authority, and then using the user function authority and the user data authority, realizes the dual control of function authority and data authority, can realize the refined control of user authority, and improve data security.

[0154] In an exemplary embodiment, the data permission verification module is also used to, when receiving a data access request triggered by a user through a terminal in a page module, and the data access request is a data query request, construct a data query statement based on the data query request and user data permissions, access the database through the data query statement, obtain the data query results and feed them back to the terminal.

[0155] In an exemplary embodiment, the data permission verification module is also used to parse the data query request, construct a basic query statement, and generate query restriction conditions based on the user's data permissions when receiving a data access request triggered by a user through a terminal in the page module, and the data access request is a data query request, and construct a data query statement based on the basic query statement and the query restriction conditions.

[0156] In an exemplary embodiment, the data permission verification module is also used to verify the data operation permission of the user according to the user's data permissions when a data access request triggered by the user through the terminal in the page module is received, and the data access request is a data change request. When the user passes the data operation permission verification, the data change request is executed, the data processing result is obtained and fed back to the terminal.

[0157] In an exemplary embodiment, the user authority control device also includes a authority allocation module, which is used to determine the organizational level of the user based on the user's user identification, and based on the organizational level of the user, query the constructed data authority model to determine the user's user function role and user data role.

[0158] In an exemplary embodiment, the permission allocation module is also used to obtain multiple platform system permissions, divide the multiple platform system permissions into multiple functional permissions and multiple data permissions, set a functional role for each functional permission, and set a data role for each data permission, obtain multiple organizational levels, set roles for each organizational level, obtain role setting results, and build a data permission model based on the role setting results.

[0159] Each module in the above user authority control device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0160] In an exemplary embodiment, a computer device is provided, which can be a server or a terminal. Taking the computer device as a server as an example, its internal structure diagram can be shown in Figure 8. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as a function role table and a data role table. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a user authority control method is implemented.

[0161] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0162] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0163] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0164] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0165] It should be noted that the user information (including but not limited to user identification, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0166] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0167] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0168] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A user authority control method, characterized in that: The method comprises: When receiving a function access request for a page module sent by a user through a terminal, obtaining a user function role and a user data role according to a user identifier of the user; Determine the user function authority of the user according to the user function role, and when it is determined according to the user function authority that the user has the function access authority to the page module, send the page data of the page module to the terminal, and determine the user data authority of the user according to the user data role; When receiving a data access request triggered by the user through the terminal in the page module, the data access request is processed according to the user data authority, and a data processing result is obtained and fed back to the terminal.

2. The method according to claim 1, characterized in that When receiving a data access request triggered by the user through the terminal in the page module, processing the data access request according to the user data authority, obtaining a data processing result and feeding it back to the terminal includes: When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data query request, constructing a data query statement according to the data query request and the user data authority; The database is accessed through the data query statement, and the data query result is obtained and fed back to the terminal.

3. The method according to claim 2, characterized in that When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data query request, constructing a data query statement according to the data query request and the user data authority includes: When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data query request, parsing the data query request, constructing a basic query statement, and generating a query restriction condition according to the user data authority; A data query statement is constructed based on the basic query statement and the query restriction condition.

4. The method according to claim 1, characterized in that: When receiving a data access request triggered by the user through the terminal in the page module, processing the data access request according to the user data authority, obtaining a data processing result and feeding it back to the terminal includes: When receiving a data access request triggered by the user through the terminal in the page module, and the data access request is a data change request, verifying the data operation authority of the user according to the user data authority; When the user passes the data operation authority verification, the data change request is executed, the data processing result is obtained and fed back to the terminal.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The organizational level of the user is determined according to the user identifier of the user, and based on the organizational level of the user, the constructed data permission model is queried to determine the user function role and the user data role of the user.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Acquire multiple platform system permissions, divide the multiple platform system permissions into multiple functional permissions and multiple data permissions, and set a functional role for each of the functional permissions, and set a data role for each of the data permissions; Acquire multiple organizational levels, set roles for each organizational level, obtain role setting results, and construct the data permission model based on the role setting results.

7. A user authority control device, characterized in that: The device comprises: A role acquisition module, configured to acquire a user function role and a user data role according to a user identifier of the user when receiving a function access request for a page module sent by a user through a terminal; a function permission verification module, used to determine the user function permission of the user according to the user function role, and when it is determined according to the user function permission that the user has the function access permission to the page module, send the page data of the page module to the terminal, and determine the user data permission of the user according to the user data role; The data authority verification module is used to process the data access request according to the user's data authority when receiving the data access request triggered by the user through the terminal in the page module, obtain the data processing result and feed it back to the terminal.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images