Human resource information processing system and method supporting distributed access control

Abstract

The invention relates to the technical field of information, in particular to a human resource information processing system and method supporting distributed access control, and the system comprises a source human resource information collection module, a dynamic authority fragmentation generation module, a distributed fragment storage engine and a zero-knowledge verification access control module. Wherein the multi-source human resource information acquisition module is used for extracting structured data from the heterogeneous HR subsystem in real time; the dynamic permission fragmentation generation module is used for splitting the employee permission into a plurality of mutually exclusive permission attribute fragments; the distributed fragment storage module is used for generating a fragment position index table; and the zero-knowledge verification access control module verifies the legality of the request through non-interactive zero-knowledge certification. According to the method, the problems of data islands, inaccurate authority management and privacy protection are effectively solved through multi-source data acquisition, authority fragmentation generation, distributed storage and zero-knowledge proof technologies.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a human resources information processing system and method supporting distributed access control. Background Art

[0002] With the rapid development of information technology, enterprises are using more and more systems in human resource management, such as attendance systems, payroll systems, and performance management systems. These systems usually operate independently, resulting in data silos, making it difficult to achieve unified data management and security control. In addition, as the scale of enterprises expands, how to effectively manage and control the access rights of different employees in a fine-grained manner, avoid abuse of rights, and ensure data security and privacy has become a pressing issue.

[0003] Currently, most existing human resource information management systems rely on centralized permission management. However, this approach can easily lead to performance bottlenecks and data security risks when faced with large-scale, distributed resources and user access requirements. Traditional permission management methods lack flexibility, cannot dynamically adjust employee permissions, and cannot effectively prevent permission abuse. Therefore, a human resource information processing system and method that supports distributed access control is urgently needed to address these issues. Summary of the Invention

[0004] Based on the above objectives, the present invention provides a human resources information processing system and method supporting distributed access control.

[0005] A human resources information processing system supporting distributed access control includes a multi-source human resources information acquisition module, a dynamic permission fragmentation generation module, a distributed fragmentation storage engine, and a zero-knowledge verification access control module; wherein:

[0006] Multi-source human resources information collection module: used to extract structured data from heterogeneous HR subsystems in real time and output standardized employee attribute sets;

[0007] Dynamic permission fragmentation generation module: This module receives a standardized employee attribute set and, based on a preset access policy rule base, splits the employee's permissions into multiple mutually exclusive permission attribute fragments.

[0008] Distributed shard storage module: used to distribute and store permission attribute shards to blockchain nodes in different geographical areas according to the hash consistency algorithm, and generate a shard location index table;

[0009] Zero-knowledge verification access control module: used to receive user access requests, locate relevant permission attribute fragments based on the fragment location index table, verify the legitimacy of the request through non-interactive zero-knowledge proof, and output distributed access tokens.

[0010] Optionally, the multi-source human resource information collection module includes a data collection unit, a data cleaning unit, a data mapping unit, and a standardized output unit; wherein:

[0011] Data collection unit: used to establish real-time data connections with heterogeneous HR subsystems through preset interfaces and extract structured raw employee data from each subsystem. The heterogeneous HR subsystems include the attendance subsystem, the salary subsystem, and the performance management subsystem.

[0012] Data cleaning unit: used to clean the raw data extracted from heterogeneous HR subsystems, remove invalid data, fill missing values, and unify the data format;

[0013] Data mapping unit: used to map attributes in heterogeneous systems into a unified employee attribute model based on a standardized rule base, including employee number, name, position, salary, and attendance records;

[0014] Standardized output unit: used to convert the mapped employee attribute data into a standardized employee attribute set.

[0015] Optionally, the dynamic permission fragmentation generation module includes a permission parsing unit, a permission splitting unit, a mutual exclusivity verification unit, and a permission fragment output unit; wherein:

[0016] Permission parsing unit: used to receive standardized employee attribute sets and parse employee permission information based on the preset access policy rule base to determine the employee's access scope and operation type;

[0017] Permission splitting unit: Used to split employee permissions according to resource type, operation type, and effective domain based on the analysis results, generating multiple mutually exclusive permission attribute fragments;

[0018] Mutual Exclusivity Verification Unit: used to perform mutual exclusivity verification on the split permission attribute fragments to ensure that each permission fragment is independent of each other and does not overlap;

[0019] Permission fragment output unit: used to output the verified permission attribute fragments.

[0020] Optionally, the authority parsing unit includes:

[0021] Permission identification subunit: This subunit is used to parse employee information in the standardized employee attribute set based on the preset access policy rule base and identify the various permission attributes possessed by the employee, including resource type, operation type, and applicable effective domain;

[0022] Rule matching subunit: used to match employee permission information based on specific rules in the access policy rule base;

[0023] Permission calculation subunit: used to calculate the access permission score A of an employee based on the rule matching result, and further clarify the access scope and operation type;

[0024] If A ≥ T1, the employee has the permission to access a certain resource, and the resource allows the employee to perform the specified operation;

[0025] If T2 ≤ A < T'1, the employee's access permission to the resource is restricted and can only perform some operations;

[0026] If A < T2, the employee has no right to access the resource; where T1 and T2 are preset permission score thresholds.

[0027] Optionally, the permission splitting unit includes:

[0028] Resource type splitting subunit: used to split the permissions according to the resource type based on the employee's permission information, and divide each permission attribute into several mutually exclusive permission fragments according to its resource type;

[0029] Operation type splitting subunit: used to split the permissions according to the operation type based on the employee's permission information, and split the operation type of each resource into independent permission fragments;

[0030] Effective domain splitting subunit: used to split the permissions according to the effective domain based on the employee's permission information, and split each resource operation permission into independent permission fragments within different effective domains;

[0031] Permission fragment merging subunit: used to merge the split permission fragments of resource type, operation type and effective domain according to the mutual exclusion principle, and generate multiple final mutually exclusive permission attribute fragments, ensuring that each fragment only contains a triple of single resource type, operation type and effective domain.

[0032] Optionally, the mutual exclusion verification unit includes:

[0033] Permission overlap detection subunit: used to detect the overlap of the split permission attribute fragments, and identify whether there is an overlap of permission attribute fragments in terms of resource type, operation type and effective domain;

[0034] Permission conflict analysis subunit: used to analyze the conflict situation between permission fragments according to a preset rule library, and the rule library includes:

[0035] Under the same resource type, it is not allowed for the same employee to have both viewing and modifying operation permissions;

[0036] Within the same effective domain, it is not allowed for the same employee to have both access and modification permissions to a certain resource at the same time;

[0037] Permission verification subunit: This unit verifies the mutual exclusivity of the split permission attribute fragments based on the results of permission overlap detection and permission conflict analysis, ensuring that each permission fragment is independent and mutually exclusive under the same resource type, operation type, and effective domain. If a conflict is detected, the system will automatically mark it as an invalid permission fragment.

[0038] Verification result output subunit: used to output the verified valid permission attribute fragments.

[0039] Optionally, the distributed fragment storage module includes a hash calculation unit, a hash mapping unit, a node storage unit, and a fragment location index generation unit; wherein:

[0040] Hash calculation unit: used to receive permission attribute fragments and perform hash calculation on each permission attribute fragment according to the hash consistency algorithm to generate a unique hash value;

[0041] Hash mapping unit: used to map the generated hash values ​​to blockchain nodes in different geographical regions;

[0042] Node storage unit: used to store mapped permission attribute fragments on the corresponding blockchain node;

[0043] Fragment location index generation unit: used to generate a fragment location index table based on the hash value of each permission attribute fragment and its blockchain node location.

[0044] Optionally, the zero-knowledge verification access control module includes a request receiving unit, a permission fragment location unit, a zero-knowledge proof generation and verification unit, and an access token generation unit; wherein:

[0045] Request receiving unit: used to receive user access requests and extract resource type, operation type and effective domain information in the request;

[0046] Permission fragment location unit: locates the storage location of the corresponding permission fragment in the blockchain node by searching the fragment location index table based on the resource type, operation type and effective domain information requested by the user;

[0047] Zero-knowledge proof generation and verification unit: Generates a zero-knowledge proof based on the located permission fragments and verifies its validity to confirm whether the user has legal access rights to the requested resources;

[0048] Access token generation unit: used to generate an encrypted distributed access token after verification and return it to the user.

[0049] Optionally, the zero-knowledge proof generation and verification unit includes:

[0050] Zero-knowledge proof generation subunit: Generates a zero-knowledge proof based on the located permission fragments to prove the user's legal access rights to the requested resources;

[0051] Zero-knowledge proof verification subunit: used to verify the generated zero-knowledge proof, by comparing the hash value with the verification function to confirm the validity of the user's permissions. The comparison formula is: ZKP valid =H(P)⊕V(R), where H(P) is the hash value of the permission fragment, V(R) is the verification function, and ⊕ represents the comparison operation. If the verification passes, the user permission is valid;

[0052] Access permission confirmation subunit: used to confirm whether the user has legal permission based on the verification results. If the verification is successful, a distributed access token is generated.

[0053] A method for processing human resources information supporting distributed access control is implemented by the above-mentioned human resources information processing system supporting distributed access control, and includes the following steps:

[0054] S1: Through the multi-source human resources information collection module, structured data is extracted from heterogeneous HR subsystems in real time to generate a standardized employee attribute set;

[0055] S2: The dynamic permission fragmentation generation module splits the employee permissions in the standardized employee attribute set into multiple mutually exclusive permission attribute fragments based on the preset access policy rule base. Each fragment contains a triplet of resource type, operation type, and effective domain.

[0056] S3: Through the distributed shard storage engine, the split permission attribute shards are distributed and stored to blockchain nodes in different geographical areas according to the hash consistency algorithm, and a shard location index table is generated;

[0057] S4: Receive user access requests through the zero-knowledge verification access control module, locate the relevant permission attribute fragments according to the fragment location index table, verify the legitimacy of the request through zero-knowledge proof, and output a distributed access token;

[0058] S5: Based on the result of the zero-knowledge proof verification, confirm whether the user has the requested resource access rights. If the verification is successful, generate and return an encrypted distributed access token, allowing the user to access the requested resources; if the verification fails, deny the access request.

[0059] Beneficial effects of the present invention:

[0060] This invention, through multi-source human resources information collection and dynamic authority fragmentation generation technology, realizes the efficient integration and standardization of heterogeneous subsystem data in the human resources management system, and solves the data island problem in traditional systems; by splitting employee permissions into multiple mutually exclusive permission attribute fragments and distributing them in blockchain nodes, it ensures the high availability and consistency of data, while improving the flexibility and security of authority management.

[0061] The present invention, by combining zero-knowledge proof technology, effectively solves the privacy protection problem in existing access control systems. When users request access, they can prove the legitimacy of their access rights without exposing sensitive information, ensuring the privacy and security of data. This not only improves the accuracy and security of permission control, but also enhances the scalability and responsiveness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 A schematic diagram of a human resources information processing system according to an embodiment of the present invention;

[0064] Figure 2 Schematic diagram of a method for processing human resources information according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. It is also noted that, to provide a more detailed description, the following embodiments are best and preferred embodiments, and those skilled in the art may employ alternative methods for implementing certain known technologies. Furthermore, the accompanying drawings are intended only to provide a more detailed description of the embodiments and are not intended to limit the present invention.

[0066] like Figure 1 As shown, a human resources information processing system supporting distributed access control includes a multi-source human resources information acquisition module, a dynamic permission fragmentation generation module, a distributed fragmentation storage engine, and a zero-knowledge verification access control module; wherein:

[0067] Multi-source human resources information collection module: used to extract structured data from heterogeneous HR subsystems in real time and output standardized employee attribute sets;

[0068] Dynamic permission fragmentation generation module: This module receives a standardized employee attribute set and, based on a preset access policy rule base, splits the employee's permissions into multiple mutually exclusive permission attribute fragments.

[0069] Distributed shard storage module: used to distribute and store permission attribute shards to blockchain nodes in different geographical areas according to the hash consistency algorithm, and generate a shard location index table;

[0070] Zero-knowledge verification access control module: used to receive user access requests, locate relevant permission attribute fragments based on the fragment location index table, verify the legitimacy of the request through non-interactive zero-knowledge proof, and output distributed access tokens.

[0071] The multi-source human resource information collection module includes a data collection unit, a data cleaning unit, a data mapping unit, and a standardized output unit; wherein:

[0072] Data collection unit: Used to establish real-time data connections with heterogeneous HR subsystems through preset interfaces and extract structured raw employee data from each subsystem. Heterogeneous HR subsystems include the attendance subsystem, the salary subsystem, and the performance management subsystem.

[0073] Data cleaning unit: used to clean the raw data extracted from heterogeneous HR subsystems, remove invalid data, fill missing values, and unify data formats to ensure data accuracy and consistency;

[0074] Data mapping unit: used to map attributes in heterogeneous systems into a unified employee attribute model based on a standardized rule base, including employee number, name, position, salary, and attendance records;

[0075] Standardized output unit: used to convert mapped employee attribute data into standardized employee attribute sets and output them to downstream modules for further processing or storage. This unit can effectively integrate real-time data from multiple heterogeneous HR subsystems, ensuring the uniformity and accuracy of data formats between different systems. This provides efficient and accurate basic data support for subsequent permission management and access control, improving system compatibility and data consistency.

[0076] The dynamic permission fragmentation generation module includes a permission parsing unit, a permission splitting unit, a mutual exclusivity verification unit, and a permission fragment output unit; wherein:

[0077] Permission parsing unit: used to receive standardized employee attribute sets and parse employee permission information based on the preset access policy rule base to determine the employee's access scope and operation type;

[0078] Permission Splitting Unit: Used to split an employee's permissions according to the parsing result along the dimensions of resource type, operation type, and effective scope, generating multiple mutually exclusive permission attribute fragments;

[0079] Mutual Exclusivity Verification Unit: Used to verify the mutual exclusivity of the split permission attribute fragments, ensuring that each permission fragment is independent and non-overlapping, avoiding permission overlap or conflict;

[0080] Permission Fragment Output Unit: Used to output the verified permission attribute fragments for subsequent processing and storage by the distributed fragment storage engine; Through the above technical solution, an employee's permissions can be accurately split into multiple mutually exclusive permission fragments according to the preset access policy rule library, ensuring strict division and non-overlap of permissions, thereby effectively enhancing the flexibility and security of permission management and ensuring that each permission operation complies with the preset access policy rules.

[0081] The Permission Parsing Unit includes:

[0082] Permission Identification Sub-Unit: Used to parse the employee information in the standardized employee attribute set according to the preset access policy rule library, identifying each permission attribute possessed by the employee, including resource type, operation type, and applicable effective scope;

[0083] Rule Matching Sub-Unit: Used to match the employee's permission information according to the specific rules in the access policy rule library;

[0084] The rules in the access policy rule library include but are not limited to:

[0085] Resource Access Rules, used to specify the resource types that an employee can access, such as salary sheets, attendance records, performance evaluations, etc.;

[0086] Operation Permission Rules, used to specify the operable behaviors of an employee on a specific resource, such as viewing, modifying, deleting, etc.;

[0087] Effective Scope Rules, used to specify the applicable scope of an employee's permissions, such as employees within a department, management personnel, or the entire company, etc.;

[0088] Permission Calculation Sub-Unit: Used to calculate the access permission score A of an employee based on the rule matching result, and further clarify the access scope and operation type;

[0089] If A≥T1, the employee has the permission to access a certain resource, and the resource allows the employee to perform specified operations (such as viewing, modifying, etc.);

[0090] If T2≤A<T1, the employee's access permission to the resource is restricted, and only partial operations can be performed (such as only viewing and not modifying);

[0091] If A < T2, the employee has no right to access the resource; where T1 and T2 are preset permission scoring thresholds, which are adjusted according to the requirements of the system; the calculation formula for the access permission score is: where A is the access permission score of the employee, and R i is the matching degree of the i-th access policy rule, and W i is the weight of this rule, and n is the number of policies in the rule library; through the technical solution of the above-mentioned dependent claims, the access permission score of the employee can be accurately calculated and determined based on the access policy rule library, and the access scope and operation type can be flexibly divided according to the score value. This permission determination method based on scoring improves the accuracy and flexibility of permission control, and ensures that the access permissions of different employees to different resources are reasonably and safely allocated.

[0092] The permission splitting unit includes:

[0093] Resource type splitting sub-unit: used to split the permissions according to the resource type based on the employee's permission information, and divide each permission attribute into several mutually exclusive permission fragments according to its resource type; for example, split the "payroll" resource into two independent permission fragments of "view payroll" and "modify payroll";

[0094] Operation type splitting sub-unit: used to split the permissions according to the operation type based on the employee's permission information, and split the operation type of each resource into independent permission fragments; for example, for the "modify payroll" permission, split it into two permission fragments of "modify payroll - modify" and "view payroll - view" to ensure that each operation type has an independent permission definition;

[0095] Effective domain splitting sub-unit: used to split the permissions according to the effective domain based on the employee's permission information, and split each resource operation permission into independent permission fragments within different effective domains; for example, an employee may be able to view the "payroll" within the "department", but can only view the "performance evaluation" within the "whole company" scope;

[0096] Permission fragment merging sub-unit: used to merge the permission fragments of the resource type, operation type and effective domain after splitting according to the mutually exclusive principle, and generate multiple final mutually exclusive permission attribute fragments, ensuring that each fragment only contains a triple of a single resource type, operation type and effective domain; the above sub-units can accurately split the employee permissions from multiple dimensions, including resource type, operation type and effective domain, ensuring the refinement and independence of permission attributes. This technical solution not only improves the accuracy and security of permission management, but also makes the permission division and control more flexible, and can strictly control the employee permissions according to different business requirements and access rules, avoiding permission conflicts or abuses.

[0097] The mutual exclusion verification unit includes:

[0098] The permission overlap detection sub-unit is used to perform overlap detection on the split permission attribute fragments to identify whether there is overlap in resource type, operation type, and effective domain. For example, if "View Payroll" and "Modify Payroll" are performed under the same resource type, the system will mark them as potential overlapping permissions.

[0099] Permission conflict analysis subunit: used to analyze conflicts between permission fragments based on a preset rule base, which includes:

[0100] Under the same resource type, the same employee is not allowed to have both viewing and modifying permissions;

[0101] In the same effective domain, the same employee is not allowed to have both access and modification permissions to a resource.

[0102] Permission verification subunit: This unit verifies the mutual exclusivity of the split permission attribute fragments based on the results of permission overlap detection and permission conflict analysis, ensuring that each permission fragment is independent and mutually exclusive under the same resource type, operation type, and effective domain. If a conflict is detected, the system will automatically mark it as an invalid permission fragment.

[0103] Verification result output sub-unit: used to output the verified valid permission attribute fragments for use by subsequent permission fragment storage and access control modules; through the above technical solution, it is possible to effectively detect and analyze the overlap and conflict between permission attribute fragments, ensure the mutual exclusivity of each permission fragment in terms of resource type, operation type and effective domain, and avoid overlap or conflict of permissions.

[0104] The distributed fragment storage module includes a hash calculation unit, a hash mapping unit, a node storage unit, and a fragment location index generation unit; wherein:

[0105] Hash calculation unit: used to receive permission attribute fragments and perform hash calculation on each permission attribute fragment according to the hash consistency algorithm to generate a unique hash value;

[0106] Hash mapping unit: used to map the generated hash values ​​to blockchain nodes in different geographical regions;

[0107] Node storage unit: used to store mapped permission attribute fragments on the corresponding blockchain node;

[0108] Fragment location index generation unit: used to generate a fragment location index table based on the hash value of each permission attribute fragment and its blockchain node location. The above unit can use the hash consistency algorithm to efficiently distribute and store permission attribute fragments on blockchain nodes in different geographical areas, realizing secure distributed storage of data, and ensuring the traceability and efficient access of fragment locations through the fragment location index table. This solution enhances the system's storage reliability and access speed on a global scale, while at the same time improving the security and integrity of data by leveraging the encryption and immutability of blockchain.

[0109] Table 1 Fragment location index table

[0110]

[0111] In the above table, the hash value represents the unique identifier generated by the hash consistency algorithm for each permission attribute fragment, which is used to uniquely identify a permission fragment in the distributed storage system; the blockchain node ID indicates the ID of the blockchain node that stores the permission fragment. By mapping the hash value to the blockchain node ID, the permission fragment is distributed and stored on blockchain nodes in multiple geographical locations; the storage location specifies the specific location where the permission fragment is stored in the blockchain node. The storage location consists of the block number (for example: Block_10) and the offset within the block (for example: Offset_23), ensuring that data can be quickly located within the blockchain node; the resource type specifies the resource type corresponding to the permission fragment, which is used to determine which data resources the permission fragment is associated with; the operation type defines the operation type allowed by the permission fragment. Each resource usually has different operation permissions; the effective domain specifies the effective domain to which the permission fragment applies, which is used to define the scope of application of the permission for different employees or groups.

[0112] The zero-knowledge verification access control module includes a request receiving unit, a permission fragment positioning unit, a zero-knowledge proof generation and verification unit, and an access token generation unit; wherein:

[0113] Request receiving unit: used to receive user access requests and extract resource type, operation type and effective domain information in the request;

[0114] Permission fragment location unit: locates the storage location of the corresponding permission fragment in the blockchain node by searching the fragment location index table based on the resource type, operation type and effective domain information requested by the user;

[0115] Zero-knowledge proof generation and verification unit: Generates a zero-knowledge proof based on the located permission fragments and verifies its validity to confirm whether the user has legal access rights to the requested resources;

[0116] Access token generation unit: used to generate an encrypted distributed access token after verification and return it to the user; the above technical solution ensures the legitimacy of the user request through zero-knowledge proof, and at the same time uses the fragment location index table to efficiently locate the permission fragments, thereby enhancing the security and privacy protection of the system and ensuring the efficiency and accuracy of access control.

[0117] The zero-knowledge proof generation and verification unit includes:

[0118] Zero-knowledge proof generation subunit: Generates a zero-knowledge proof based on the located permission fragments to prove the user's legal access rights to the requested resources;

[0119] Zero-knowledge proof verification subunit: used to verify the generated zero-knowledge proof, by comparing the hash value with the verification function to confirm the validity of the user's permissions. The comparison formula is: ZKP valid =H(P)⊕V(R), where H(P) is the hash value of the permission fragment, V(R) is the verification function, and ⊕ represents the comparison operation. If the verification passes, the user permission is valid;

[0120] Access permission confirmation sub-unit: used to confirm whether the user has legal permission based on the verification results. If the verification is successful, a distributed access token is generated. When generating zero-knowledge proof, the above unit only provides the legitimacy of the user's access rights to resources without exposing any sensitive information. The verification process ensures the user's access permission compliance and system security through hash calculation and comparison with the verification function, thereby effectively protecting user data privacy and ensuring the accuracy of access control.

[0121] like Figure 2 As shown, a method for processing human resources information supporting distributed access control is implemented by the above-mentioned human resources information processing system supporting distributed access control, and includes the following steps:

[0122] S1: Through the multi-source human resources information collection module, structured data is extracted from heterogeneous HR subsystems in real time to generate a standardized employee attribute set;

[0123] S2: The dynamic permission fragmentation generation module splits the employee permissions in the standardized employee attribute set into multiple mutually exclusive permission attribute fragments based on the preset access policy rule base. Each fragment contains a triplet of resource type, operation type, and effective domain.

[0124] S3: Through the distributed shard storage engine, the split permission attribute shards are distributed and stored to blockchain nodes in different geographical areas according to the hash consistency algorithm, and a shard location index table is generated;

[0125] S4: Receive user access requests through the zero-knowledge verification access control module, locate the relevant permission attribute fragments according to the fragment location index table, verify the legitimacy of the request through zero-knowledge proof, and output a distributed access token;

[0126] S5: Based on the result of the zero-knowledge proof verification, confirm whether the user has the requested resource access rights. If the verification is successful, generate and return an encrypted distributed access token, allowing the user to access the requested resources; if the verification fails, deny the access request.

[0127] The present invention encompasses any alternatives, modifications, equivalents, and solutions that fall within the spirit and scope of the present invention. To provide a thorough understanding of the present invention, specific details are described in detail below in connection with the preferred embodiments of the present invention, but those skilled in the art will be able to fully understand the present invention without these detailed descriptions. Furthermore, to avoid unnecessary confusion regarding the essence of the present invention, well-known methods, processes, procedures, components, and circuits have not been described in detail.

[0128] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A human resources information processing system supporting distributed access control, characterized in that: It includes a multi-source human resources information collection module, a dynamic permission fragmentation generation module, a distributed fragmentation storage engine, and a zero-knowledge verification access control module; among which: Multi-source human resources information collection module: used to extract structured data from heterogeneous HR subsystems in real time and output standardized employee attribute sets; Dynamic permission fragmentation generation module: This module receives a standardized employee attribute set and, based on a preset access policy rule base, splits the employee's permissions into multiple mutually exclusive permission attribute fragments. Distributed shard storage module: used to distribute and store permission attribute shards to blockchain nodes in different geographical areas according to the hash consistency algorithm, and generate a shard location index table; Zero-knowledge verification access control module: used to receive user access requests, locate relevant permission attribute fragments based on the fragment location index table, verify the legitimacy of the request through non-interactive zero-knowledge proof, and output distributed access tokens.

2. A human resources information processing system supporting distributed access control according to claim 1, characterized in that: The multi-source human resources information collection module includes a data collection unit, a data cleaning unit, a data mapping unit and a standardized output unit; wherein: Data collection unit: used to establish real-time data connections with heterogeneous HR subsystems through preset interfaces and extract structured raw employee data from each subsystem. The heterogeneous HR subsystems include the attendance subsystem, the salary subsystem, and the performance management subsystem. Data cleaning unit: used to clean the raw data extracted from heterogeneous HR subsystems, remove invalid data, fill missing values, and unify the data format; Data mapping unit: used to map attributes in heterogeneous systems into a unified employee attribute model based on a standardized rule base, including employee number, name, position, salary, and attendance records; Standardized output unit: used to convert the mapped employee attribute data into a standardized employee attribute set.

3. A human resources information processing system supporting distributed access control according to claim 1, characterized in that: The dynamic permission fragmentation generation module includes a permission parsing unit, a permission splitting unit, a mutual exclusivity verification unit, and a permission fragment output unit; wherein: Permission parsing unit: used to receive standardized employee attribute sets and parse employee permission information based on the preset access policy rule base to determine the employee's access scope and operation type; Permission splitting unit: Used to split employee permissions according to resource type, operation type, and effective domain based on the analysis results, generating multiple mutually exclusive permission attribute fragments; Mutual Exclusivity Verification Unit: used to perform mutual exclusivity verification on the split permission attribute fragments to ensure that each permission fragment is independent of each other and does not overlap; Permission fragment output unit: used to output the verified permission attribute fragments.

4. A human resources information processing system supporting distributed access control according to claim 3, characterized in that: The authority parsing unit includes: Permission identification subunit: This subunit is used to parse employee information in the standardized employee attribute set based on the preset access policy rule base and identify the various permission attributes possessed by the employee, including resource type, operation type, and applicable effective domain; Rule matching subunit: used to match employee permission information based on specific rules in the access policy rule base; Permission calculation subunit: used to calculate the employee's access permission score A based on the rule matching results, and then clarify the access scope and operation type; If A ≥ T1, the employee has the permission to access a certain resource, and this resource allows the employee to perform the specified operation; If T2 ≤ A < T1, the employee's access permission to the resource is restricted and can only perform some operations; If A < T2, the employee has no right to access the resource; where T1 and T2 are preset permission score thresholds.

5. A human resources information processing system supporting distributed access control according to claim 4, characterized in that: The permission splitting unit includes: Resource type splitting sub-unit: used to split the permissions according to the resource type based on the employee's permission information, and divide each permission attribute into several mutually exclusive permission fragments according to its resource type; Operation type splitting sub-unit: used to split the permissions according to the operation type based on the employee's permission information, and split the operation type of each resource into independent permission fragments; Effective domain splitting sub-unit: used to split the permissions according to the effective domain based on the employee's permission information, and split each resource operation permission into independent permission fragments within different effective domains; Permission fragment merging sub-unit: used to merge the split permission fragments of resource type, operation type and effective domain according to the mutual exclusion principle to generate multiple final mutually exclusive permission attribute fragments, ensuring that each fragment only contains a triple of a single resource type, operation type and effective domain.

6. A human resources information processing system supporting distributed access control according to claim 5, characterized in that: The mutual exclusion verification unit includes: Permission overlap detection sub-unit: used to detect the overlap of the split permission attribute fragments, and identify whether there is an overlap in resource type, operation type and effective domain of the permission attribute fragments; Permission conflict analysis sub-unit: used to analyze the conflict situation between permission fragments according to the preset rule library, and the rule library includes: Under the same resource type, it is not allowed for the same employee to have both viewing and modifying operation permissions; Within the same effective domain, it is not allowed for the same employee to have both access and modification permissions to a certain resource at the same time; Permission verification sub-unit: used to verify the mutual exclusion of the split permission attribute fragments according to the results of permission overlap detection and permission conflict analysis, ensuring that each permission fragment is independent and mutually exclusive under the same resource type, operation type and effective domain. If a conflict is detected, the system will automatically mark it as an invalid permission fragment; Verification result output sub-unit: used to output the verified valid permission attribute fragments.

7. A human resources information processing system supporting distributed access control according to claim 1, characterized in that: The distributed fragment storage module includes a hash calculation unit, a hash mapping unit, a node storage unit and a fragment location index generation unit; where: Hash calculation unit: used to receive the permission attribute fragments and perform hash calculation on each permission attribute fragment according to the hash consistency algorithm to generate a unique hash value; Hash mapping unit: used to map the generated hash values to blockchain nodes in different geographical regions; Node storage unit: used to store the mapped permission attribute fragments on the corresponding blockchain nodes; Fragment location index generation unit: used to generate a fragment location index table according to the hash value of each permission attribute fragment and its location in the blockchain node.

8. The human resources information processing system supporting distributed access control according to claim 1, characterized in that: The zero-knowledge verification access control module includes a request receiving unit, a permission fragment location unit, a zero-knowledge proof generation and verification unit and an access token generation unit; where: Request receiving unit: used to receive user access requests and extract resource type, operation type and effective domain information in the request; Permission fragment location unit: locates the storage location of the corresponding permission fragment in the blockchain node by searching the fragment location index table based on the resource type, operation type and effective domain information requested by the user; Zero-knowledge proof generation and verification unit: Generates a zero-knowledge proof based on the located permission fragments and verifies its validity to confirm whether the user has legal access rights to the requested resources; Access token generation unit: used to generate an encrypted distributed access token after verification and return it to the user.

9. A human resources information processing system supporting distributed access control according to claim 8, characterized in that: The zero-knowledge proof generation and verification unit includes: Zero-knowledge proof generation subunit: Generates a zero-knowledge proof based on the located permission fragments to prove the user's legal access rights to the requested resources; Zero-knowledge proof verification subunit: used to verify the generated zero-knowledge proof, by comparing the hash value with the verification function to confirm the validity of the user's permissions. The comparison formula is: ZKP valid =H(P)⊕V(R), where H(P) is the hash value of the permission fragment, V(R) is the verification function, and ⊕ represents the comparison operation. If the verification passes, the user permission is valid; Access permission confirmation subunit: used to confirm whether the user has legal permission based on the verification results. If the verification is successful, a distributed access token is generated.

10. A method for processing human resources information supporting distributed access control, implemented by a human resources information processing system supporting distributed access control according to any one of claims 1 to 9, characterized in that: The following steps are involved: S1: Through the multi-source human resources information collection module, structured data is extracted from heterogeneous HR subsystems in real time to generate a standardized employee attribute set; S2: The dynamic permission fragmentation generation module splits the employee permissions in the standardized employee attribute set into multiple mutually exclusive permission attribute fragments based on the preset access policy rule base. Each fragment contains a triplet of resource type, operation type, and effective domain. S3: Through the distributed shard storage engine, the split permission attribute shards are distributed and stored to blockchain nodes in different geographical areas according to the hash consistency algorithm, and a shard location index table is generated; S4: Receive user access requests through the zero-knowledge verification access control module, locate the relevant permission attribute fragments according to the fragment location index table, verify the legitimacy of the request through zero-knowledge proof, and output a distributed access token; S5: Based on the result of the zero-knowledge proof verification, confirm whether the user has the requested resource access rights. If the verification is successful, generate and return an encrypted distributed access token, allowing the user to access the requested resources; If verification fails, the access request is denied.

Images