Data authority control method and system

Abstract

The invention discloses a data permission control method and system, belongs to the technical field of digital systems, and aims to solve the technical problems that in an existing scheme, the operation and maintenance cost is high, and data permissions cannot be flexibly configured according to scenes. Comprising the following steps: selecting a menu item which needs to define data permission in a menu, and adding a data permission dimension field in menu configuration; setting a role instance under the role, and defining a data permission range for the role instance; selecting a user needing to configure a role, distributing the role for the user, selecting a specific instance under the role, and appointing an accessible data range through the instance of the role; and according to the function accessed by the user and the role instance corresponding to the current function owned by the user, returning data that the user is authorized to the user.

Description

Technical Field

[0001] The present invention relates to the technical field of digital systems, and in particular to a data authority control method and system. Background Art

[0002] There are two core concepts in the field of digital systems: functional permissions and data permissions. Functional permissions: define the boundaries of system functions that users can access, usually implemented based on the RBAC model. Through the role-menu mapping mechanism, hierarchical control of user function visibility is achieved, which is the foundation of the permission system. Data permissions: control the granularity of data that users can access within the functional boundaries. Its essence is access control achieved through dynamic data filtering. The typical implementation method is database query condition injection. Existing permission control methods include permission control based on role-menu binding and permission control based on user-role-scope.

[0003] Permission control based on role-menu binding adopts a classic permission management approach, implementing permission control by binding menus to permission dimensions and associating roles with menu instances. This allows for precise permission management down to the menu level, allowing for flexible configuration of different permission dimensions for each menu, resulting in good versatility. However, this can lead to the "role explosion" problem. For example, in a regional management scenario, while the business only requires the "regional manager" role concept, in practice, a separate role instance must be created for each region. Furthermore, this architecture places a significant burden on system operations and maintenance.

[0004] User-role-scope-based permission control adopts a permission management model that binds users to roles and data scopes. The core concept of this solution is to allow users to directly associate data permission scopes, rather than indirectly controlling them through roles. While this reduces the number of roles, it suffers from significant flexibility limitations. Because the data permission dimension is directly tied to the user, all functional modules must share the same set of data filtering rules. In real-world business, different modules often require different permission dimensions: the sales module may require control by region, while the product module requires control by category. This solution cannot meet these multi-dimensional permission requirements, resulting in insufficient business adaptability. More specifically, if the system specifies that the user's data permission dimension is "region," even product modules that require control by "category" will be forced to use the region dimension for filtering. This one-size-fits-all permission control approach severely restricts the need for refined permission management in complex business scenarios.

[0005] The high operation and maintenance costs of the existing solutions and the inability to flexibly configure data permissions according to scenarios are technical problems that need to be solved. Summary of the Invention

[0006] The technical task of the present invention is to address the above shortcomings and provide a data permission control method and system to solve the technical problems of high operation and maintenance costs and the inability to flexibly configure data permissions according to scenarios in existing solutions.

[0007] In a first aspect, the present invention provides a data authority control method, which is applied to a business system including a menu management interface, a role management interface, a user management interface, and a user login interface, and comprises the following steps:

[0008] Menu definition data permission dimension: Enter the menu management interface, select the menu item for which data permission needs to be defined, and add the data permission dimension field in the menu configuration to form and store the menu configuration information;

[0009] Role setting role instance: Enter the role management interface, set the role instance under the role, and define the data permission range for the role instance, form the role instance configuration information and store the role instance configuration information;

[0010] User role instance configuration: Enter the user management interface, select the user for whom a role needs to be configured, assign the role to the user, and select a specific instance under the role. The accessible data range is specified through the role instance to form and store the user role configuration information.

[0011] Data permission application: When a user accesses the business system based on the user login interface, the user's data permissions are managed based on the menu configuration information, role instance information, and user role configuration information according to the function the user accesses and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

[0012] As a preferred embodiment, in the process of defining the data permission dimension of the menu, a mapping relationship between the menu items and the data permission dimension fields is established, and the menu configuration information includes the menu items for which data permission needs to be defined, the data permission dimension fields, and the mapping relationship between the menu items and the data permission dimension fields;

[0013] During the role instance setting process, a mapping relationship among the role, role instance, and data permission range is established. The role instance configuration information includes the role, role instance, data permission range of the role instance, and the mapping relationship among the role, role instance, and data permission range.

[0014] When a user configures a role instance, a mapping relationship between the user and the role instance is established. The user role configuration information includes the user who needs to configure the role, the role assigned to the user, the instance under the role, and the mapping relationship between the user and the role instance.

[0015] Preferably, the data permission application includes the following steps:

[0016] Users access the business system based on the user login interface and initiate function access requests;

[0017] Identify the menu items that the user accesses based on the function access request;

[0018] Obtain the corresponding menu configuration information based on the menu item and determine the data permission dimension field;

[0019] Query the user's role instance based on the data permission dimension field;

[0020] Get the data permission scope based on the user's role instance;

[0021] Returns authorized data to the user based on the data permission scope.

[0022] Preferably, the menu configuration information, role instance configuration information and user role configuration information are all stored in a database configured by the business system;

[0023] When returning authorized data to the user based on the data permission scope, based on the data permission scope, inject data permission filtering conditions, and query data from the database configured in the business system based on the data permission filtering conditions.

[0024] In a second aspect, the present invention provides a data authority control system, which is applied to a business system including a menu management interface, a role management interface, a user management interface, and a user login interface. The data authority control system includes a menu definition data authority dimension module, a role setting role instance module, a user configuration role instance module, and a data authority application module.

[0025] The menu definition data permission dimension module is used to perform the following operations: enter the menu management interface, select the menu item for which data permission needs to be defined in the menu, and add the data permission dimension field in the menu configuration to form the menu configuration information and store the menu configuration information;

[0026] The role instance module is used to perform the following operations: enter the role management interface, set up a role instance under the role, define the data permission range for the role instance, form the role instance configuration information, and store the role instance configuration information;

[0027] The user role instance configuration module is used to perform the following operations: enter the user management interface, select the user for whom a role needs to be configured, assign the role to the user, select the specific instance under the role, specify the accessible data range through the role instance, form the user role configuration information, and store the user role configuration information;

[0028] The data permission application module is used to perform the following: when a user accesses the business system based on the user login interface, the user's data permission is managed based on the menu configuration information, role instance information and user role configuration information according to the function accessed by the user and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

[0029] As a preferred embodiment, in the process of defining the data permission dimension of the menu, the menu definition data permission dimension module is used to establish a mapping relationship between the menu items and the data permission dimension fields, and the menu configuration information includes the menu items for which data permission needs to be defined, the data permission dimension fields, and the mapping relationship between the menu items and the data permission dimension fields;

[0030] In the process of role setting role instance, the role setting role instance module is used to establish a mapping relationship between the role, role instance and data permission range. The role instance configuration information includes the role, role instance, data permission range of the role instance and the mapping relationship between the role, role instance and data permission range;

[0031] In the user configuration role instance, the user configuration role instance module is used to establish a mapping relationship between users and role instances. The user role configuration information includes the user who needs to configure the role, the role assigned to the user, the instance under the role, and the mapping relationship between the user and the role instance.

[0032] Preferably, the data authority application module is used to perform the following operations:

[0033] Users access the business system based on the user login interface and initiate function access requests;

[0034] Identify the menu items that the user accesses based on the function access request;

[0035] Obtain the corresponding menu configuration information based on the menu item and determine the data permission dimension field;

[0036] Query the user's role instance based on the data permission dimension field;

[0037] Get the data permission scope based on the user's role instance;

[0038] Returns authorized data to the user based on the data permission scope.

[0039] Preferably, the menu configuration information, role instance configuration information and user role configuration information are all stored in a database configured by the business system;

[0040] When returning authorized data to the user based on the data permission scope, the data permission application module is used to inject data permission filtering conditions based on the data permission scope and query data from the database configured in the business system based on the data permission filtering conditions.

[0041] The data authority control method and system of the present invention have the following advantages:

[0042] 1. Achieve precise matching between functional permissions and data permissions. Functional permissions define the management and control dimensions of data permissions, achieving different dimensions for different functions.

[0043] 2. Supports flexible configuration of multiple roles without interfering with each other. Roles are associated with functional permissions, eliminating the need to configure roles with duplicate functional permissions for data permissions.

[0044] 3. Intelligently apply the corresponding data range by automatically identifying the menu-attributed role. The user's data permission management rules can be obtained through the role instances corresponding to the functions accessed by the user and the current functions the user has. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] The present invention will be further described below with reference to the accompanying drawings.

[0047] Figure 1 This is a diagram showing an application example of a data authority control method in Example 1. DETAILED DESCRIPTION

[0048] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments given are not intended to limit the present invention. Unless there is a conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0049] The embodiments of the present invention provide a data permission control method and system for solving the technical problems of high operation and maintenance costs and inability to flexibly configure data permissions according to scenarios in existing solutions.

[0050] Example 1:

[0051] The present invention provides a data permission control method, which is applied to a business system including a menu management interface, a role management interface, a user management interface and a user login interface, and includes four steps: menu definition of data permission dimensions, role setting role instances, user configuration of role instances and data permission application.

[0052] Step S100: Menu defines data permission dimension: Enter the menu management interface, select the menu item for which data permission needs to be defined in the menu, and add the data permission dimension field in the menu configuration to form menu configuration information and store the menu configuration information.

[0053] In the process of defining the data permission dimension of the menu in this embodiment, a mapping relationship between menu items and data permission dimension fields is established. The menu configuration information includes the menu items for which data permissions need to be defined, the data permission dimension fields, and the mapping relationship between the menu items and the data permission dimension fields.

[0054] Step S200: Role setting role instance: Enter the role management interface, set the role instance under the role, and define the data permission range for the role instance, form the role instance configuration information and store the role instance configuration information.

[0055] In the process of role setting role instance in this embodiment, a mapping relationship between role, role instance and data authority scope is established. The role instance configuration information includes role, role instance, data authority scope of role instance and mapping relationship between role, role instance and data authority scope.

[0056] Step S300: User configures role instance: Enter the user management interface, select the user who needs to configure the role, assign the role to the user, and select the specific instance under the role. The accessible data range is specified through the role instance to form user role configuration information and store the user role configuration information.

[0057] In this embodiment, when users configure role instances, a mapping relationship between users and role instances is established. The user role configuration information includes the user who needs to configure a role, the role assigned to the user, the instance under the role, and the mapping relationship between the user and the role instance.

[0058] Step S400 Data permission application: When a user accesses the business system based on the user login interface, the user's data permission is managed based on the menu configuration information, role instance information and user role configuration information according to the function accessed by the user and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

[0059] The specific implementation of data permission application includes the following operations:

[0060] (1) The user accesses the business system based on the user login interface and initiates a function access request;

[0061] (2) identifying the menu item accessed by the user based on the function access request;

[0062] (3) Obtain the corresponding menu configuration information according to the menu item and determine the data permission dimension field;

[0063] (4) Query the user's role instance based on the data permission dimension field;

[0064] (5) Obtain data permission scope based on the user's role instance;

[0065] (6) Return authorized data to the user based on the data permission scope.

[0066] Among them, menu configuration information, role instance configuration information, and user role configuration information are all stored in the database configured by the business system. When returning authorized data to the user based on the data permission range, based on the data permission range, the data permission filter conditions are injected, and the data is queried from the database configured by the business system based on the data permission filter conditions.

[0067] Based on the method disclosed in this embodiment, Figure 1 As shown in the following scenario, the system sets up two roles: Regional Manager and Product Line Manager. The Regional Manager role is assigned functional permissions for the Sales Order menu, while the Product Line Manager role is assigned functional permissions for the Product Delisting and Posting menu. The Sales Order menu is bound to the data permission dimension of Region, while the Product Delisting and Posting menu is bound to the data permission dimension of Category.

[0068] Set up role instances such as "Hefei City" and "Huangshan City" under the "Regional Manager" role, and set up role instances such as "Learning Machine" and "Phone Watch" under the "Product Line Management" role.

[0069] By assigning Zhang San the "Hefei" role instance under the "Regional Manager" role, Zhang San can access the Hefei region data in the "Sales Order" function. Similarly, by assigning Zhang San the "Learning Machine" instance under the "Product Line Manager" role, Zhang San can access the learning machine category data in the "Product Add / Disable" function.

[0070] Example 2:

[0071] The present invention provides a data authority control system, which is applied to a business system including a menu management interface, a role management interface, a user management interface and a user login interface. The data authority control system includes a menu definition data authority dimension module, a role setting role instance module, a user configuration role instance module and a data authority application module.

[0072] The menu definition data permission dimension module is used to perform the following: enter the menu management interface, select the menu item for which data permission needs to be defined in the menu, and add the data permission dimension field in the menu configuration to form the menu configuration information and store the menu configuration information.

[0073] Among them, in the process of menu definition data permission dimension, the menu definition data permission dimension module is used to establish a mapping relationship between menu items and data permission dimension fields. The menu configuration information includes menu items that need to define data permissions, data permission dimension fields, and the mapping relationship between menu items and data permission dimension fields.

[0074] The role setting role instance module is used to perform the following: enter the role management interface, set the role instance under the role, and define the data permission range for the role instance, form the role instance configuration information and store the role instance configuration information.

[0075] Among them, in the process of role setting role instance, the role setting role instance module is used to establish the mapping relationship between role, role instance and data permission range, and the role instance configuration information includes role, role instance, data permission range of role instance and the mapping relationship between role, role instance and data permission range.

[0076] The user configuration role instance module is used to perform the following: enter the user management interface, select the user who needs to configure the role, assign the role to the user, and select the specific instance under the role, specify the accessible data range through the role instance, form the user role configuration information and store the user role configuration information.

[0077] Among them, in the user configuration role instance, the user configuration role instance module is used to establish a mapping relationship between users and role instances. The user role configuration information includes the user who needs to configure the role, the role assigned by the user, the instance under the role, and the mapping relationship between the user and the role instance.

[0078] The data permission application module is used to perform the following: when a user accesses the business system based on the user login interface, the user's data permission is managed based on the menu configuration information, role instance information and user role configuration information according to the function accessed by the user and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

[0079] As a specific implementation of the data permission application module, this module is used to perform the following operations:

[0080] (1) The user accesses the business system based on the user login interface and initiates a function access request;

[0081] (2) identifying the menu item accessed by the user based on the function access request;

[0082] (3) Obtain the corresponding menu configuration information according to the menu item and determine the data permission dimension field;

[0083] (4) Query the user's role instance based on the data permission dimension field;

[0084] (5) Obtain data permission scope based on the user's role instance;

[0085] (6) Return authorized data to the user based on the data permission scope.

[0086] Menu configuration information, role instance configuration information, and user role configuration information are all stored in the database configured by the business system; when returning authorized data to the user based on the data permission range, the data permission application module is used to inject data permission filtering conditions based on the data permission range, and query data from the database configured by the business system based on the data permission filtering conditions.

[0087] The system of this embodiment can execute the method disclosed in Example 1 to implement data authority control.

[0088] The data permission control method and system provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A data authority control method, characterized in that: Applicable to business systems including menu management interface, role management interface, user management interface and user login interface, including the following steps: Menu definition data permission dimension: Enter the menu management interface, select the menu item for which data permission needs to be defined, and add the data permission dimension field in the menu configuration to form and store the menu configuration information; Role setting role instance: Enter the role management interface, set the role instance under the role, and define the data permission range for the role instance, form the role instance configuration information and store the role instance configuration information; User role instance configuration: Enter the user management interface, select the user for whom a role needs to be configured, assign the role to the user, and select a specific instance under the role. The accessible data range is specified through the role instance to form and store the user role configuration information. Data permission application: When a user accesses the business system based on the user login interface, the user's data permissions are managed based on the menu configuration information, role instance information, and user role configuration information according to the function the user accesses and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

2. The data authority control method according to claim 1, characterized in that: When defining data permission dimensions for a menu, a mapping relationship between menu items and data permission dimension fields is established. The menu configuration information includes the menu items for which data permission needs to be defined, the data permission dimension fields, and the mapping relationship between the menu items and the data permission dimension fields. During the role instance setting process, a mapping relationship among the role, role instance, and data permission range is established. The role instance configuration information includes the role, role instance, data permission range of the role instance, and the mapping relationship among the role, role instance, and data permission range. When a user configures a role instance, a mapping relationship between the user and the role instance is established. The user role configuration information includes the user who needs to configure the role, the role assigned to the user, the instance under the role, and the mapping relationship between the user and the role instance.

3. The data authority control method according to claim 1, characterized in that: The data permission application includes the following steps: Users access the business system based on the user login interface and initiate function access requests; Identify the menu items that the user accesses based on the function access request; Obtain the corresponding menu configuration information based on the menu item and determine the data permission dimension field; Query the user's role instance based on the data permission dimension field; Get the data permission scope based on the user's role instance; Returns authorized data to the user based on the data permission scope.

4. The data authority control method according to claim 3, characterized in that: Menu configuration information, role instance configuration information, and user role configuration information are all stored in the database configured by the business system; When returning authorized data to the user based on the data permission scope, based on the data permission scope, inject data permission filtering conditions, and query data from the database configured in the business system based on the data permission filtering conditions.

5. A data authority control system, characterized in that: Applied to a business system including a menu management interface, a role management interface, a user management interface, and a user login interface, the data authority control system includes a menu definition data authority dimension module, a role setting role instance module, a user configuration role instance module, and a data authority application module; The menu definition data permission dimension module is used to perform the following operations: enter the menu management interface, select the menu item for which data permission needs to be defined in the menu, and add the data permission dimension field in the menu configuration to form the menu configuration information and store the menu configuration information; The role instance module is used to perform the following operations: enter the role management interface, set up a role instance under the role, define the data permission range for the role instance, form the role instance configuration information, and store the role instance configuration information; The user role instance configuration module is used to perform the following operations: enter the user management interface, select the user for whom a role needs to be configured, assign the role to the user, select the specific instance under the role, specify the accessible data range through the role instance, form the user role configuration information, and store the user role configuration information; The data permission application module is used to perform the following: when a user accesses the business system based on the user login interface, the user's data permission is managed based on the menu configuration information, role instance information and user role configuration information according to the function accessed by the user and the role instance corresponding to the current function the user has, and the data of the user's authorized permissions is returned to the user.

6. The data authority control system according to claim 5, characterized in that: During the menu definition data permission dimension process, the menu definition data permission dimension module is used to establish a mapping relationship between menu items and data permission dimension fields. The menu configuration information includes the menu items for which data permissions need to be defined, the data permission dimension fields, and the mapping relationship between the menu items and the data permission dimension fields. In the process of role setting role instance, the role setting role instance module is used to establish a mapping relationship between the role, role instance and data permission range. The role instance configuration information includes the role, role instance, data permission range of the role instance and the mapping relationship between the role, role instance and data permission range; In the user configuration role instance, the user configuration role instance module is used to establish a mapping relationship between users and role instances. The user role configuration information includes the user who needs to configure the role, the role assigned to the user, the instance under the role, and the mapping relationship between the user and the role instance.

7. The data authority control system according to claim 5, characterized in that: The data permission application module is used to perform the following operations: Users access the business system based on the user login interface and initiate function access requests; Identify the menu items that the user accesses based on the function access request; Obtain the corresponding menu configuration information based on the menu item and determine the data permission dimension field; Query the user's role instance based on the data permission dimension field; Get the data permission scope based on the user's role instance; Returns authorized data to the user based on the data permission scope.

8. The data authority control system according to claim 5, characterized in that: Menu configuration information, role instance configuration information, and user role configuration information are all stored in the database configured by the business system; When returning authorized data to the user based on the data permission scope, the data permission application module is used to inject data permission filtering conditions based on the data permission scope and query data from the database configured in the business system based on the data permission filtering conditions.

Images