Authority management method based on OA examination and approval and business system

Abstract

The invention belongs to the technical field of authority management, particularly relates to an authority management method based on OA (Open Architecture) approval and a business system, and provides the following scheme aiming at the problems that in the existing authority management process, access authority is inconvenient to automatically distribute and cannot be correspondingly adjusted according to real-time changes, so that diversified application scenes cannot be met. The method comprises the following steps that S1, a management system is prepared, the management system comprises a service library module, the service library module is connected with a service classification module, the service classification module is connected with a function permission module, the function permission module is connected with a data permission module, the data permission module is connected with a flow permission module, and the flow permission module is connected with a flow management module; according to the system and the method, the access authority can be conveniently and automatically distributed in the using process, and corresponding adjustment can be made according to real-time changes, so that the requirements of diversified application scenes are met.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to an authority management method based on OA approval and business systems. Background Art

[0002] Permission management refers to the process of controlling user access to resources based on the security rules or policies set by the system to ensure that users can only access authorized resources. Permission management is crucial to maintaining system security, data privacy, and operational efficiency.

[0003] In the existing technology, it is not convenient to automatically allocate access rights during the permission management process, and it is impossible to make corresponding adjustments based on real-time changes, resulting in the inability to meet diverse application scenarios. For this reason, we propose a permission management method based on OA approval and business systems to solve the above problems. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art in that it is inconvenient to automatically allocate access rights during the permission management process, and it is impossible to make corresponding adjustments according to real-time changes, resulting in the inability to meet the diverse application scenarios. A permission management method based on OA approval and business systems is proposed.

[0005] This application provides a method for managing permissions between OA approval and business systems using the following technical solutions:

[0006] A method for authority management between OA approval and business systems, comprising the following steps:

[0007] S1: Prepare a management system. The management system includes a business library module. The business library module is connected to a business classification module. The business classification module can use a business classification algorithm. Common business classification algorithms include:

[0008] Decision Tree Algorithm:

[0009] The decision-making process is represented by a tree structure. Each node represents a feature or attribute, each branch represents a different value of the feature, and the leaf node represents the classification result. It is suitable for processing business scenarios with clear classification standards, such as credit assessment, customer segmentation, etc.

[0010] Support Vector Machine (SVM):

[0011] Classification is achieved by constructing hyperplanes or hyperspheres to divide data points of different categories. It is suitable for processing high-dimensional data and nonlinear classification problems, such as text classification and image recognition.

[0012] K-Nearest Neighbor (KNN) Algorithm:

[0013] Predict the category of a sample point based on the categories of the K nearest neighboring sample points around it. This method is suitable for business scenarios with small sample size and low feature dimension, such as recommendation systems and pattern recognition.

[0014] Naive Bayes Algorithm:

[0015] Based on Bayesian theorem, it is assumed that features are independent of each other and the category of the sample point is predicted by calculating the posterior probability. It is suitable for processing business scenarios with clear features such as text classification and spam filtering.

[0016] Neural Network Algorithms:

[0017] By simulating the working mode of human brain neurons, a multi-layer network structure is constructed to achieve the classification of complex data. It is suitable for processing large-scale data, nonlinear classification and complex pattern recognition problems, such as image recognition, speech recognition, etc.

[0018] Clustering algorithms (such as K-means, hierarchical clustering, etc.):

[0019] Although it is mainly used for data clustering in unsupervised learning, it can also be used in the preprocessing stage of business classification to help discover potential categories or patterns in the data;

[0020] The business classification module is connected to a function authority module, the function authority module is connected to a data authority module, the data authority module is connected to a process authority module, the process authority module is connected to an OA authority approval module, the OA authority approval module is connected to an automatic authority allocation module and a authority application module, the authority application module is connected to an application record module, the automatic authority allocation module is connected to an authorization module, a process setting module and a position allocation module, the authorization module is connected to an authentication module, the authentication module is connected to a periodic review module, the periodic review module is connected to an update module, a monitoring module and a security module, the process setting module is connected to a test module, and the position allocation module is connected to a department allocation module and a user group allocation module;

[0021] S2: Business data is collected and stored through the business library module. The business classification module classifies the business according to the data in the business library module. The function permission module sets the access, addition and modification permissions. The data permission module controls the access and operation scope of data for different positions and departments. The process permission module sets the operation permissions for different positions and roles in different processes.

[0022] S3: The permission application module sends a permission application message, the OA permission approval module receives the application message and approves it according to the settings of the function permission module, data permission module and process permission module. The permission automatic allocation module automatically allocates permissions according to the approval results. The authorization module grants permissions to roles or users. When a user accesses a resource, the authentication module determines whether access is allowed based on the authorization.

[0023] S4: Finally, the periodic audit module conducts permission review on the permission settings of roles or users. The update module promptly updates the permission settings according to organizational structure changes and security requirements. The security module encrypts data transmission, sets up a firewall to protect the log recording server, and monitors file access behavior, records visitors, access time and operations through the monitoring module.

[0024] Furthermore, the functional permission module includes an access unit, an adding unit and a first modifying unit, the access unit is connected to the adding unit, and the adding unit is connected to the first modifying unit.

[0025] Furthermore, the process setting module includes a process definition unit, a rule setting unit and a second modification unit, the process definition unit is connected to the rule setting unit, and the rule setting unit is connected to the second modification unit.

[0026] Furthermore, the monitoring module includes an access behavior recording unit, a visitor recording unit and an operation time recording unit, wherein the access behavior recording unit is connected to the visitor recording unit, and the visitor recording unit is connected to the operation time recording unit.

[0027] Furthermore, the security module includes an encryption transmission unit, a firewall unit and a log recording unit, the encryption transmission unit is connected to the firewall unit, and the firewall unit is connected to the log recording unit.

[0028] Furthermore, the process setting module is used to clarify the type, purpose and required tasks of the approval process, and set the approval rules, process path and authority allocation according to the needs of the enterprise. The testing module is used to perform regular testing on the automatic approval process.

[0029] Furthermore, the department allocation module is used to authorize departmental business and functions, the position allocation module authorizes modules or functions to positions and roles, and users inherit corresponding permissions. The user group allocation module combines users with the same characteristics and simplifies permission allocation by granting permissions to the combination.

[0030] Furthermore, the functional permission module is used to set access, add and modify permissions according to modules and actions, the data permission module is used to control the access and operation scope of data by different positions and departments, and the process permission module is used to assign operation permissions to different positions and roles in different processes.

[0031] Furthermore, the permission application module is used to receive a permission application message and send the application message to the OA permission approval module, and the OA permission approval module is used to approve the permission application message.

[0032] Furthermore, the automatic permission allocation module is used to automatically allocate permissions according to the approval results, the authorization module is used to grant permissions to roles or users, and the authentication module is used to determine whether access is allowed based on authorization when a user accesses a resource.

[0033] In summary, the present application includes at least one of the following beneficial technical effects:

[0034] 1. This solution collects and stores business data through the business library module. The business classification module classifies the business according to the data in the business library module. The function permission module sets the access, addition and modification permissions. The data permission module controls the access and operation scope of data for different positions and departments. The process permission module sets the operation permissions for different positions and roles in different processes.

[0035] 2. This solution sends permission application messages through the permission application module. The OA permission approval module receives the application messages and approves them according to the settings of the function permission module, data permission module and process permission module. The permission automatic allocation module automatically allocates permissions according to the approval results. The authorization module grants permissions to roles or users. When a user accesses a resource, the authentication module determines whether access is allowed based on the authorization.

[0036] 3. This solution uses a regular audit module to review the permission settings of roles or users. The update module promptly updates the permission settings based on organizational structure changes and security requirements. The security module encrypts data transmission, sets up a firewall to protect the log recording server, and monitors file access behavior, records visitors, access time and operations through the monitoring module.

[0037] The present invention can facilitate automatic allocation of access rights during use, and can make corresponding adjustments according to real-time changes, thereby meeting the needs of diverse application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a structural diagram of a management system based on an authority management method between OA approval and business systems proposed by the present invention;

[0039] Figure 2This is a structural block diagram of a functional authority module based on an authority management method between OA approval and business systems proposed by the present invention;

[0040] Figure 3 This is a structural block diagram of a process setting module of a method for managing rights between OA approval and business systems proposed by the present invention;

[0041] Figure 4 This is a structural block diagram of a monitoring module of a method for managing rights between OA approval and business systems proposed by the present invention;

[0042] Figure 5 This is a structural block diagram of a security module based on an authority management method between OA approval and business systems proposed by the present invention. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0044] Embodiment 1

[0045] Reference Figure 1-Figure 5 , a method for authority management between OA approval and business systems, including the following steps:

[0046] S1: Prepare a management system. The management system includes a business library module. The business library module is connected to a business classification module. The business classification module is connected to a functional authority module. The functional authority module is connected to a data authority module. The data authority module is connected to a process authority module. The process authority module is connected to an OA authority approval module. The OA authority approval module is connected to an automatic authority allocation module and a authority application module. The authority application module is connected to an application record module. The automatic authority allocation module is connected to an authorization module, a process setting module and a position allocation module. The authorization module is connected to an authentication module. The authentication module is connected to a periodic review module. The periodic review module is connected to an update module, a monitoring module and a security module. The process setting module is connected to a test module. The position allocation module is connected to a department allocation module and a user group allocation module. The process setting module is used to clarify the type, purpose and required tasks of the approval process, and set approval rules, process paths and authority allocation according to enterprise needs. The test module is used to test the automatic approval process. The program is tested regularly. The department allocation module is used to authorize departmental business and functions. The position allocation module authorizes modules or functions to positions and roles, and users inherit corresponding permissions. The user group allocation module combines users with the same characteristics and simplifies permission allocation by granting permissions to the combination. The function permission module is used to set access, increase and modify permissions according to modules and actions. The data permission module is used to control the access and operation scope of different positions and departments to data. The process permission module is used to assign operation permissions to different positions and roles in different processes. The permission application module is used to receive permission application messages and send the application messages to the OA permission approval module. The OA permission approval module is used to approve permission application messages. The automatic permission allocation module is used to automatically allocate permissions according to the approval results. The authorization module is used to grant permissions to roles or users. The authentication module is used to determine whether access is allowed based on authorization when users access resources. The automatic permission allocation module adopts an automatic permission allocation algorithm.

[0047] Automatic permission allocation algorithm:

[0048] Usually based on the role-permission model, the core is to effectively associate users, roles and permissions. The algorithm implementation steps can be summarized as follows:

[0049] Define roles and permissions: First, clarify the roles (such as ADMIN, USER, EDITOR) and permissions (such as CREATE, READ, UPDATE, DELETE, etc.) in the system;

[0050] Establish a mapping relationship between roles and permissions: assign a corresponding set of permissions to each role;

[0051] User-role association: When a user is created or updated, one or more roles are assigned to him or her;

[0052] Automatic permission allocation: Automatically calculate and allocate the set of permissions that the user should have based on his or her role;

[0053] Permission verification: When a user performs an operation, verify whether he or she has the corresponding permission;

[0054] S2: Business data is collected and stored through the business library module. The business classification module classifies the business according to the data in the business library module. The function permission module sets the access, addition and modification permissions. The data permission module controls the access and operation scope of data for different positions and departments. The process permission module sets the operation permissions for different positions and roles in different processes.

[0055] S3: The permission application module sends a permission application message, the OA permission approval module receives the application message and approves it according to the settings of the function permission module, data permission module and process permission module. The permission automatic allocation module automatically allocates permissions according to the approval results. The authorization module grants permissions to roles or users. When a user accesses a resource, the authentication module determines whether access is allowed based on the authorization.

[0056] S4: Finally, the periodic audit module conducts permission review on the permission settings of roles or users. The update module promptly updates the permission settings according to organizational structure changes and security requirements. The security module encrypts data transmission, sets up a firewall to protect the log recording server, and monitors file access behavior, records visitors, access time and operations through the monitoring module.

[0057] Reference Figure 2 The functional authority module includes an access unit, an adding unit and a first modifying unit. The access unit is connected to the adding unit, and the adding unit is connected to the first modifying unit.

[0058] Reference Figure 3 The process setting module includes a process definition unit, a rule setting unit and a second modification unit. The process definition unit is connected to the rule setting unit, and the rule setting unit is connected to the second modification unit.

[0059] Reference Figure 4 The monitoring module includes an access behavior recording unit, a visitor recording unit and an operation time recording unit. The access behavior recording unit is connected to the visitor recording unit, and the visitor recording unit is connected to the operation time recording unit.

[0060] Reference Figure 5 The security module includes an encryption transmission unit, a firewall unit and a log recording unit. The encryption transmission unit is connected to the firewall unit, and the firewall unit is connected to the log recording unit. The encryption transmission unit adopts a data encryption algorithm, and the data encryption algorithm includes:

[0061] Symmetric encryption:

[0062] AES, DES: Encryption and decryption use the same key, fast, efficient, suitable for large amounts of data encryption;

[0063] Application scenarios: data transmission and storage encryption, such as database, file encryption and instant messaging.

[0064] Asymmetric encryption:

[0065] RSA, ECC: Use public key and private key pairs, public key encryption, private key decryption, high security.

[0066] Application scenarios: digital signatures, security certificates, and key exchange protocols, such as HTTPS / TLS.

[0067] Hash function:

[0068] MD5, SHA-1, SHA-256: Map arbitrary length input to fixed length output, irreversible;

[0069] Application scenarios: Verify data integrity, password storage, and digital signatures.

[0070] End-to-end encryption:

[0071] E2EE: ensures that data is encrypted only between the sender and the receiver, and intermediate nodes cannot decrypt it;

[0072] Application scenarios: instant messaging applications, email services, and cloud storage services.

[0073] The implementation principle of this embodiment is as follows: when in use, business data is collected and stored through the business library module, the business classification module classifies the business according to the data in the business library module, the functional authority module sets the access, addition and modification permissions, the data authority module controls the access and operation scope of different positions and departments to data, the process authority module sets the operation permissions for different positions and roles in different processes, sends the permission application message through the permission application module, the OA permission approval module receives the application message, and approves it according to the settings of the functional authority module, the data authority module and the process authority module, and the department allocation module is used to authorize the department's business and functions, and the position allocation module assigns the module Or functions are authorized to positions and roles, and users inherit the corresponding permissions. The user group allocation module combines users with the same characteristics and simplifies permission allocation by granting permissions to the combination. The automatic permission allocation module automatically assigns permissions based on the approval results. The authorization module grants permissions to roles or users. When users access resources, the authentication module determines whether access is allowed based on authorization. Finally, the permission settings of roles or users are reviewed through the regular review module. The update module updates the permission settings in a timely manner according to changes in the organizational structure and security requirements. The security module encrypts data transmission, sets a firewall to protect the log recording server, and monitors file access behavior, records visitors, and access time and operations through the monitoring module.

[0074] Embodiment 2

[0075] The difference between this embodiment and the first embodiment is that the periodic review module is connected to the audit module, and the audit module can audit the log to supervise the internal employee operations, prevent internal risks, ensure compliance, meet regulatory requirements, and provide audit evidence.

[0076] Embodiment 3

[0077] The difference between this embodiment and the second embodiment is that the audit module is connected to the audit control module, and the audit control module can control the audit, including collecting and reviewing internal management systems, control systems and key business processes, conducting control audit tests, and checking the implementation of the system.

[0078] Embodiment 4

[0079] The difference between this embodiment and the first embodiment is that the OA approval module is connected to a restricted access module, which can carefully distinguish and control the access methods of different users, thereby further improving the security of authority management.

[0080] Embodiment 5

[0081] The difference between this embodiment and the first embodiment is that the automatic permission allocation module is connected to the permission refinement module, which grants only the minimum permission required to complete the task and dynamically allocates permissions according to roles or attributes.

[0082] Test example

[0083] By comparing the rights management solutions between OA approval and business systems proposed in Examples 1 to 5 with conventional rights management solutions, the experimental data are as follows:

[0084]

[0085]

[0086] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for authority management between OA approval and business systems, characterized by: The following steps are involved: S1: Prepare a management system, which includes a business library module, the business library module is connected to a business classification module, the business classification module is connected to a function authority module, the function authority module is connected to a data authority module, the data authority module is connected to a process authority module, the process authority module is connected to an OA authority approval module, the OA authority approval module is connected to an automatic authority allocation module and a authority application module, the authority application module is connected to an application record module, the automatic authority allocation module is connected to an authorization module, a process setting module and a position allocation module, the authorization module is connected to an authentication module, the authentication module is connected to a periodic review module, the periodic review module is connected to an update module, a monitoring module and a security module, the process setting module is connected to a test module, and the position allocation module is connected to a department allocation module and a user group allocation module; S2: Business data is collected and stored through the business library module. The business classification module classifies the business according to the data in the business library module. The function permission module sets the access, addition and modification permissions. The data permission module controls the access and operation scope of data for different positions and departments. The process permission module sets the operation permissions for different positions and roles in different processes. S3: The permission application module sends a permission application message, the OA permission approval module receives the application message and approves it according to the settings of the function permission module, data permission module and process permission module. The permission automatic allocation module automatically allocates permissions according to the approval results. The authorization module grants permissions to roles or users. When a user accesses a resource, the authentication module determines whether access is allowed based on the authorization. S4: Finally, the periodic audit module conducts permission review on the permission settings of roles or users. The update module promptly updates the permission settings according to organizational structure changes and security requirements. The security module encrypts data transmission, sets up a firewall to protect the log recording server, and monitors file access behavior, records visitors, access time and operations through the monitoring module.

2. According to claim 1, a method for managing rights between OA approval and business systems, characterized in that: The functional authority module includes an access unit, an adding unit and a first modifying unit, wherein the access unit is connected to the adding unit, and the adding unit is connected to the first modifying unit.

3. According to claim 2, a method for managing rights between OA approval and business systems, characterized in that: The process setting module includes a process definition unit, a rule setting unit and a second modification unit. The process definition unit is connected to the rule setting unit, and the rule setting unit is connected to the second modification unit.

4. According to claim 3, a method for managing rights between OA approval and business systems, characterized in that: The monitoring module includes an access behavior recording unit, a visitor recording unit and an operation time recording unit. The access behavior recording unit is connected to the visitor recording unit, and the visitor recording unit is connected to the operation time recording unit.

5. According to claim 4, a method for managing rights between OA approval and business systems, characterized in that: The security module comprises an encryption transmission unit, a firewall unit and a log recording unit. The encryption transmission unit is connected to the firewall unit, and the firewall unit is connected to the log recording unit.

6. A method for managing rights between OA approval and business systems according to claim 5, characterized in that: The process setting module is used to clarify the type, purpose and required tasks of the approval process, and set the approval rules, process path and authority allocation according to the needs of the enterprise. The testing module is used to perform regular testing on the automatic approval process.

7. A method for managing rights between OA approval and business systems according to claim 6, characterized in that: The department allocation module is used to authorize departmental businesses and functions, the position allocation module authorizes modules or functions to positions and roles, and users inherit corresponding permissions. The user group allocation module combines users with the same characteristics and simplifies permission allocation by granting permissions to the combination.

8. The method for managing rights between OA approval and business systems according to claim 7, characterized in that: The functional permission module is used to set access, add and modify permissions according to modules and actions. The data permission module is used to control the access and operation scope of data by different positions and departments. The process permission module is used to assign operation permissions to different positions and roles in different processes.

9. The method for managing rights between OA approval and business systems according to claim 8, characterized in that: The permission application module is used to receive a permission application message and send the application message to the OA permission approval module, and the OA permission approval module is used to approve the permission application message.

10. A method for managing rights between OA approval and business systems according to claim 9, characterized in that: The automatic permission allocation module is used to automatically allocate permissions according to the approval results, the authorization module is used to grant permissions to roles or users, and the authentication module is used to determine whether access is allowed based on authorization when a user accesses a resource.

Images