A data authority control method, device and equipment, and a storage medium

Abstract

Embodiments of the present application disclose a data authority control method, device and equipment and a storage medium. The method comprises: when a user login event is detected, obtaining a logged-in user and a logged-in system corresponding to the user login event, and determining a system role of the logged-in user in the logged-in system; obtaining a data authority control factor associated with the system role, and determining browsable data of the logged-in user under a current function of the logged-in system according to the data authority control factor, and displaying each browsable data; wherein the data authority control factor comprises a fixed factor and a variable factor having a control effect on data authority, the fixed factor comprises a factor having a control effect under multiple system functions of the logged-in system, and the variable factor comprises a factor having a control effect under the current function, and the current function comprises a function applied by the logged-in user among the multiple system functions. The technical solution of the embodiments of the present application can control data authority from multiple dimensions.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of data authority control, and in particular to a data authority control method, device, equipment and storage medium. BACKGROUND

[0002] At present, most information systems control data authority in the aspect of adopting the traditional role-based access control (RBAC) model, which assigns data authority to a role, and a user obtains the data authority of the role by becoming the role.

[0003] In the process of implementing the present application, the inventor found that the prior art has the following technical problems: the granularity of data authority control is relatively rough, and the user experience is poor. SUMMARY

[0004] Embodiments of the present application provide a data authority control method, device, equipment and storage medium to achieve the effect of controlling data authority from multiple dimensions.

[0005] In a first aspect, embodiments of the present application provide a data authority control method, which can include:

[0006] Upon detecting a user login event, an already logged-in user and an already logged-in system corresponding to the user login event are obtained, and a system role of the already logged-in user in the already logged-in system is determined;

[0007] A data authority control factor associated with the system role is obtained, and browsable data of the already logged-in user under a current function of the already logged-in system is determined according to the data authority control factor, and each browsable data is displayed;

[0008] The data authority control factor includes a fixed factor and a variable factor that have a control effect on data authority, the fixed factor includes a factor that has a control effect under multiple system functions of the already logged-in system, and the variable factor includes a factor that has a control effect under the current function, and the current function includes a function applied by the already logged-in user among the multiple system functions.

[0009] In a second aspect, embodiments of the present application further provide a data authority control device, which can include:

[0010] A system role determination module is configured to, upon detecting a user login event, obtain an already logged-in user and an already logged-in system corresponding to the user login event, and determine a system role of the already logged-in user in the already logged-in system;

[0011] The browsable data display module is configured to acquire a data permission control factor associated with the system role, and determine browsable data of the logged-in user under a current function in the logged-in system according to the data permission control factor, and display each of the browsable data.

[0012] The data permission control factor includes a fixed factor and a variable factor having a control effect on the data permission, the fixed factor includes a factor having a control effect under multiple system functions of the logged-in system, and the variable factor includes a factor having a control effect under the current function, and the current function includes a function applied by the logged-in user from the multiple system functions.

[0013] In a third aspect, an embodiment of the present application further provides a data permission control device, which can include:

[0014] one or more processors; a memory configured to store one or more programs;

[0015] when the one or more programs are executed by the one or more processors, the one or more processors implement the data permission control method provided by any of the embodiments of the present application.

[0016] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium having stored thereon a computer program, which is executed by a processor to implement the data permission control method provided by any of the embodiments of the present application.

[0017]

[0018] The technical scheme of the embodiment of the present application is that, by acquiring the logged-in user and the logged-in system corresponding to the detected user login event, the system role of the logged-in user in the logged-in system is determined; then, the data permission control factor including the fixed factor and the variable factor having a control effect on the data permission associated with the system role is acquired, and the browsable data of the logged-in user under the current function of the logged-in system is determined according to the data permission control factor, and each browsable data is displayed, thereby controlling the browsable data that the logged-in user can browse under the current function. The above technical scheme, by pre-associating the system role with the fixed factor and the variable factor, since the fixed factor is a factor having a control effect on the data permission in multiple system functions of the logged-in system, thereby ensuring effective control of the browsable data of the logged-in user under multiple system functions; at the same time, since the variable factor includes a factor having a control effect on the data permission under the current function applied by the logged-in user in multiple system functions, thereby the data permission under the same system role can be refined and changed by configuring the variable factor, further ensuring the control of the browsable data of the logged-in user under the current function, the fixed factor and the variable factor cooperate with each other, without excessively refining the system role, expanding the dimension of data permission control, and achieving the effect of controlling the data permission from multiple dimensions and further refining the granularity of data permission control. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a flowchart of a data permission control method in the embodiment one of the present application;

[0020] Figure 2 is a flowchart of a data permission control method in the embodiment two of the present application;

[0021] Figure 3 is a schematic diagram of an optional example of a data permission control method in the embodiment two of the present application;

[0022] Figure 4 is a schematic diagram of another optional example of a data permission control method in the embodiment two of the present application;

[0023] Figure 5 is a structural block diagram of a data permission control device in the embodiment three of the present application;

[0024] Figure 6 is a structural schematic diagram of a data permission control equipment in the embodiment four of the present application. DETAILED DESCRIPTION

[0025] The application will be described in further detail below with reference to the drawings and embodiments. It is to be understood that the specific embodiments described herein are intended to be illustrative only and not limiting of the application. It is also to be understood that the terminology used herein is for the purpose of describing the specific embodiments only and is not intended to be limiting.

[0026] Before introducing the embodiments of the application, the application scenarios of the embodiments of the application are exemplarily described: the existing RBAC model can associate roles with menus, thereby realizing data permission control at the menu level based on the roles. However, when the data under a menu needs to be isolated in terms of permissions, that is, the data that can be browsed by users who can browse to the same menu is different, at this time, roles need to be refined to achieve the purpose of refining the granularity of data permissions. However, the creation of too many roles is not conducive to the management work of the permission administrator. Exemplarily, taking a certain data reporting system as an example, assuming that there are N reports under a certain menu of the data reporting system, any two of the N reports cannot be browsed by the same user, at this time, the roles need to be associated with the reports, N different roles are created, and each role is given the permission to browse the data under one of the N reports, at this time, the permission administrator needs to manage N roles under the menu. Obviously, the number of roles and the granularity of data permissions are difficult to effectively balance.

[0027] Embodiment one

[0028] Figure 1 is a flowchart of a data permission control method provided in the first embodiment of the application. The embodiment can be applicable to the case of controlling data permissions from multiple dimensions, and is particularly applicable to the case of controlling data permissions by associating system roles with fixed factors and variable factors that have a control effect on data permissions. The method can be executed by a data permission control device provided in the embodiments of the application, the device can be realized by software and / or hardware, and the device can be integrated on a data permission control equipment, which can be various user terminals or servers.

[0029] Referring to Figure 1 , the method of the embodiment of the application specifically includes the following steps:

[0030] S110, when a user login event is detected, an already logged-in user corresponding to the user login event and an already logged-in system are acquired, and a system role of the already logged-in user in the already logged-in system is determined.

[0031] The user login event can be an event that a user (i.e., a logged-in user) logs in to a system (i.e., a logged-in system), and thus the logged-in user and the logged-in system can be obtained according to the detected user login event. Since the logged-in user has been assigned a certain system role in the logged-in system in advance, the corresponding system role can be obtained after the logged-in user and the logged-in system are obtained.

[0032] In S120, a data permission control factor associated with the system role is obtained, and browsable data of the logged-in user under a current function of the logged-in system is determined according to the data permission control factor, and each browsable data is displayed. The data permission control factor includes a fixed factor and a variable factor that have a control effect on data permission. The fixed factor includes a factor that has a control effect under multiple system functions of the logged-in system. The variable factor includes a factor that has a control effect under the current function. The current function includes a function that is applied by the logged-in user from among multiple system functions.

[0033] The data permission control factor can be a factor for controlling data permission, specifically, a permission for controlling data (i.e., browsable data) that the logged-in user assigned with the system role associated with the data permission control factor can browse. The data permission control factor can also be a permission for controlling certain operations such as adding, deleting, modifying, and searching, etc. performed by the logged-in user on the browsable data, and the like, which are not limited herein. Therefore, the browsable data of the logged-in user under the current function of the logged-in system can be determined according to the obtained data permission control factor. The current function can be a function that is applied by the logged-in user from among multiple system functions of the logged-in system. The system function can be a certain business function that can be implemented by the logged-in system, specifically, a business function that can be implemented by a certain system menu in the logged-in system, such as a data acquisition function, a data reporting function, and a data compliance checking function in a data reporting system. The current function can be a function of a corresponding system menu triggered by the logged-in user. The browsable data is displayed so that the logged-in user assigned with the system role can browse the browsable data on the logged-in system. Taking the logged-in system as a WeChat system, the system menu can be a circle of friends, a scan, and the like.

[0034] It should be noted that the data authority control factor can include a fixed factor and a variable factor having a control effect on the data authority. Specifically, the fixed factor can be a factor having a control effect under multiple system functions of the logged-in system, i.e., an authority influencing factor or an authentication factor playing a role in multiple system functions. Since the system function can also be understood as a business scenario, the fixed factor can also be understood as an authority influencing factor or an authentication factor unchanged under multiple business scenarios. The fixed factor can be set according to a specific application scenario, such as a report of a browsable data source in a data reporting system, a board of a browsable data source in a certain forum system, etc., which is not specifically limited here. The variable factor can be a factor having a control effect on the data authority under the current function, which can be determined according to the actual needs of the data authority control under the current function, i.e., the variable factor can be an authority influencing factor or an authentication factor changing with different business scenarios. For example, in a data reporting system, the browsable data recorded in the report can include multiple fields, such as the source business system, the generated timestamp, etc., and the variable factor can be certain fields in the multiple fields determined according to the business significance of the current function. In actual application, the number of variable factors can be one, two or more, which is related to the business significance of the current function, which is not specifically limited here. In other words, the dimensions of the data authority can be controlled by flexible configuration of the number and content of the variable factors, so that the control dimensions of the data authority are flexible and can meet various data authority control needs, and the granularity of the data authority is more precise.

[0035] The technical scheme of the embodiment of the present application determines the system role of the logged-in user in the logged-in system through obtaining the logged-in user and the logged-in system corresponding to the detected user login event; further, obtains the data permission control factors including fixed factors and variable factors having a control effect on data permission associated with the system role, and determines the browsable data of the logged-in user under the current function of the logged-in system according to the data permission control factors, and displays each browsable data, thereby controlling the browsable data that the logged-in user can browse under the current function applied by the logged-in user. The above technical scheme pre-associates the system role with the fixed factors and the variable factors. Since the fixed factors have a control effect on data permission in multiple system functions of the logged-in system, the effective control of the browsable data of the logged-in user under multiple system functions is ensured. At the same time, since the variable factors include factors having a control effect on data permission under the current function applied by the logged-in user in multiple system functions, the data permission under the same system role can be refined and changed by configuring the variable factors, thereby further ensuring the control of the browsable data of the logged-in user under the current function. The fixed factors and the variable factors cooperate with each other, expand the dimension of data permission control without excessively refining the system role, and achieve the effect of controlling data permission from multiple dimensions and further refining the granularity of data permission control.

[0036] An optional technical solution, before the data permission control factor associated with the system role is acquired, the above-mentioned data permission control method can further include: acquiring a system menu associated with the system role, and displaying each system menu; after detecting a function trigger operation, determining a current menu on which the function trigger operation acts, wherein the current menu is a menu for implementing the current function in each system menu; and correspondingly, displaying each browsable data can include: displaying each browsable data under the current menu. Wherein, the system menu can be a menu that can be browsed by a logged-in user who has been assigned a system role on a logged-in system. For example, if a role is set for data reporting, the corresponding system menu can be a data reporting menu; if a role is set for checking data compliance, the corresponding system menu can be a data compliance checking menu; and so on, which is not limited here. After the logged-in user logs in to the logged-in system, the system menu can be displayed so that the logged-in user can browse these system menus. The function trigger operation can be an operation for applying a system function corresponding to a certain system menu on the system menu. The system menu on which the function trigger operation acts is called the current menu, which can include a menu for implementing the current function described above. Therefore, when displaying each browsable data, it can be displayed under the current menu, so that the logged-in user can browse the browsable data that he has the right to browse under the current menu after triggering the current menu. As can be seen from the above, after associating the system role with the system menu and the data permission control factor, the minimum permission of the system role can be limited to the system menu level to meet the isolation requirements of various data permissions, that is, without over-refining the system role, the granularity of data permission control is effectively refined.

[0037] In view of the application scenarios that the embodiments of the present application can involve, optionally, the logged-in system can be a data reporting system, the fixed factor can include a report of a browsable data source, the browsable data recorded in the report includes a plurality of fields, and the variable factor can include a target field in each field. For example, major banks often need to report regulatory data to regulatory agencies such as the China Banking and Insurance Regulatory Commission and the People's Bank of China. When reporting data, the regulatory data is usually classified and sorted based on the theme, and the classified and sorted regulatory data is reported to the regulatory agencies in the form of a report. Since the data reporting process can involve data acquisition services, data compliance checking services, data reporting services, and the like, and these services all involve reports, the report can be used as a fixed factor of the data reporting system. Further, the specific factors that need to be considered in different services can be different, such as the business system of the data source that needs to be considered in the data acquisition service, the timestamp when the data is generated that needs to be considered in the data compliance checking service, and the like. The business system, the timestamp, and the like can be a certain field in a plurality of fields in each piece of data, and thus the target field in each field that is related to the specific service (i.e., the current function) can be used as a variable factor. In practical applications, optionally, the above business system can be a financial management system, a deposit system, and the like, which are not limited herein.

[0038] In addition to the above data reporting system, the data permission control in the remaining application scenarios can also be implemented by using the data permission control method described in the embodiments of the present application. For example, a forum system can include a plurality of boards, such as a sports board, a life board, a technology board, and the like. Posts published under each board can have a plurality of states, such as a to-be-reviewed state, a published state (i.e., a state after passing the review and being published), a deleted state, and the like. On this basis, assume that role 1 is an auditor of the sports board and the life board, and thus can browse the to-be-reviewed and published posts under the sports board and the life board. Role 2 is a board owner of the life board and the technology board, and thus can browse the published and deleted posts under the life board and the technology board. Accordingly, for the case where the current function is a post management function, the board can be used as a fixed factor because the board is involved in the display interface setting function, the post publishing function, the post management function, and the like. At the same time, the state of the post can be used as a variable factor because the state of the post is a specific reference factor in the post management function.

[0039] For example, for a game system, during the game design process, an equipment designer (role 1) and an animation effect designer (role 2) can be involved. The main work of role 1 is to determine the influence of game equipment on game characters when the game skills of game characters are fixed. The main work of role 2 is to determine the influence of various animation effects on game characters when the game skills of game characters are fixed. It can be seen that in the equipment design function and the animation effect design function, the game skill is a fixed authentication factor, which can be used as a fixed factor. In the equipment design function, the game equipment is its unique authentication factor, so when the current function is the equipment design function, the game equipment owned by a game character can be used as a variable factor. Similarly, when the current function is the animation effect design function, the animation effect owned by a game character can be used as a variable factor.

[0040] Embodiment Two

[0041] Figure 2 is a flowchart of a data permission control method provided in Embodiment Two of the application. In this embodiment, the data permission control factor includes a variable factor. The data permission control factor associated with the system role can be obtained by obtaining a pre-configured dictionary set, wherein the dictionary set records at least one candidate dictionary, and each candidate dictionary includes a candidate role and a candidate factor. The target dictionary in which the candidate role corresponding to the system role is located is determined from each candidate dictionary, and the candidate factor recorded in the target dictionary is used as the variable factor associated with the system role. The explanations of the same or corresponding terms in the above embodiments are not repeated.

[0042] Referring to Figure 2 The method of this embodiment can specifically include the following steps:

[0043] S210, when a user login event is detected, an already logged-in user and an already logged-in system corresponding to the user login event are obtained, and the system role of the already logged-in user in the already logged-in system is determined.

[0044] S220, a fixed factor associated with the system role is obtained, wherein the fixed factor is a factor that has a control effect on data permission under multiple system functions of the already logged-in system.

[0045] S230, a pre-configured dictionary set is obtained, wherein the dictionary set records at least one candidate dictionary, and each candidate dictionary includes a candidate role and a candidate factor.

[0046] The dictionary set can be a set preconfigured to record at least one candidate dictionary, and in actual application, each candidate dictionary can include a candidate role and a candidate factor, which can be represented in the form of <candidate role, candidate factor>. It should be noted that in each candidate dictionary, the number of candidate factors can be one, two or more, that is, the number of candidate factors can be configured to control the data authority in multiple dimensions.

[0047] In S240, a target dictionary in which a candidate role corresponding to the system role is located is determined from each candidate dictionary, and a candidate factor recorded in the target dictionary is taken as a variable factor associated with the system role, wherein the variable factor is a factor having a control effect under the current function, and the current function includes a function applied by the logged-in user among a plurality of system functions.

[0048] Since each candidate dictionary recorded in the dictionary set can represent the corresponding relationship between the candidate role and the candidate factor, the candidate factor can be taken as a variable factor associated with the candidate role, after the dictionary set is obtained, a target dictionary in which a candidate role corresponding to the system role is located can be determined from each candidate dictionary recorded in the dictionary set, that is, the target dictionary can be a candidate dictionary in which the candidate role matches the system role among the candidate dictionaries, and then the candidate factor in the target dictionary is taken as a variable factor associated with the system role.

[0049] In S250, browsable data of the logged-in user under the current function of the logged-in system is determined according to the fixed factor and the variable factor, and each browsable data is displayed.

[0050] The technical scheme of the embodiment of the application, by obtaining a dictionary set preconfigured to record at least one candidate dictionary, since each candidate dictionary includes a candidate role and a candidate factor that can be taken as a variable factor associated with the candidate role, a target dictionary in which a candidate role corresponding to the system role is located can be determined from each candidate dictionary recorded in the dictionary set, and a candidate factor recorded in the target dictionary is taken as a variable factor associated with the system role. The above technical scheme, since each candidate dictionary can be configured according to the actual data authority control requirement, when the variable factor is determined from the dictionary set, the flexibility of the data authority control can be improved, and the granularity of the data authority control can be refined.

[0051] On this basis, an optional technical solution, in order to further refine the granularity of data permission control, in addition to the dynamic configuration of the number of variable factors, can also be represented by enumeration value candidate factors, which can achieve the purpose of multi-dimensional control of data permissions through dynamic configuration of enumeration value grouping. Combined with the data reporting system that may be involved in the embodiments of the present application, the data permission control can be based on the field enumeration value set in the report under the current function, thereby achieving the effect of data permission control at the field enumeration value set level. Moreover, the higher degree of configuration means that the variable factors can be adjusted flexibly at any time to follow the actual data permission control requirements, and have higher universality. On this basis, combined with the application scenarios that may be involved in the embodiments of the present application, in the data reporting system, each candidate dictionary can be represented by <candidate role, enumeration value of target field distinguishing data permissions in the report>.

[0052] Another optional technical solution, the above-mentioned data permission control method can also include: when receiving a data permission change instruction, obtaining a to-be-changed role and a to-be-changed factor corresponding to the data permission change instruction; determining whether the candidate role corresponding to the to-be-changed role is recorded in the dictionary set; if yes, changing the candidate factors in the candidate dictionary where the candidate role corresponding to the to-be-changed role is located based on the to-be-changed factor; otherwise, adding the to-be-changed role and the to-be-changed factor to the dictionary set as a candidate dictionary. Among them, the data permission change instruction can be an instruction for changing the variable factors associated with the to-be-changed role. If the to-be-changed role is a candidate role recorded in the dictionary set, at this time, the candidate factors associated with the candidate role can be changed based on the to-be-changed factor, thereby achieving the effect of assigning or recycling data permissions for the candidate role according to new data permission control requirements; otherwise, the to-be-changed role and the to-be-changed factor can be added to the dictionary set, thereby achieving the effect of configuring permissions in the dictionary set according to new data permission control requirements.

[0053] On the basis of any of the preceding technical solutions, optionally, the enumeration value set of the fixed factor is written in the data authority control code, and the data authority control method further comprises: when the data authority configuration instruction is received, obtaining a to-be-configured role and a to-be-configured value corresponding to the data authority configuration instruction, wherein the to-be-configured value is an enumeration value in the enumeration value set; and associating the to-be-configured role with the to-be-configured value. The enumeration value in the enumeration value set can represent a selectable value of the fixed factor, and each enumeration value has a respective physical meaning. For example, in a data reporting system, the enumeration value can represent a report, in a forum system, the enumeration value can represent a forum, and in a game system, the enumeration value can represent a game skill. Since the fixed factor is fixed in each system function, the enumeration value set of the fixed factor can be fixed in the data authority control code, that is, the fixed factor is fixed as a data authentication factor in the logged-in system from the coding. Further, the data authority configuration instruction can be an instruction for configuring the fixed factor of the to-be-configured role based on the to-be-configured value, and the to-be-configured value can be at least one of the enumeration values in the enumeration value set. Associating the to-be-configured role with the to-be-configured value achieves the effect of configuring the to-be-configured role to access the browsable data.

[0054] It should be noted that the system role, the candidate role, the to-be-changed role, and the to-be-configured role in the above description are all roles in nature, and different names are used here only to distinguish the roles in different situations. Similarly, the variable factor, the candidate factor, and the to-be-changed factor are all factors that change with different business scenarios, and the fixed factor and the to-be-configured factor are both factors that do not change in multiple business scenarios. Here, different names are used only to distinguish the factors in different situations.

[0055] To better understand the specific implementation process of the above steps, the data authority control method of the present embodiment will be exemplarily described below with reference to a data reporting system. The data authority control method described above can also be referred to as a two-factor data authority control method based on a system role, wherein the two factors are the fixed factor and the variable factor. The specific example scenarios are described below with reference to Table 1:

[0056] 1. For two groups of users users1 and users2, user1 is a user in users1, and user2 is a user in users2. Each user under users1 has a role role1, and each user under users2 has a role role2, which is reflected in the user table, the role table, and the user-role relationship table.

[0057] 2, role1 has data access to reports1, role2 has data access to reports2, which is reflected in the role-reports set relationship table.

[0058] 3, assume that table is a report in the data reporting system, such as the employee table, agency information table, etc., table contains a field reportld used to identify the data source of the report (i.e. fixed factors) and a field sysld used to identify the data source of the business system (i.e. variable factors).

[0059] 4, role1 has data access to data with reportld in reports1 set, data source sys1, sys2 and sys3, role2 has data access to data with reportld in reports2 set, data source sys3, sys4 and sys5.

[0060] 5, reports1 and reports2 are subsets of the reportld enumeration value set, {sys1, sys2, sys3, sys4, sys5} are subsets of the sysld enumeration value set.

[0061] At this time, the data that users1 can browse (i.e. browsable data) can be expressed as: select * from table where reportld in reports1 and sysld in (sys1, sys2, sys3), similarly, the data that users2 can browse can be expressed as: select * from table where reportld in reports2 and sysld in (sys3, sys4, sys5), see the simple diagram Figure 3 .

[0062] Table 1 data access control table

[0063]

[0064]

[0065] According to the above example, the configuration process between the role and the data access is as follows, see Figure 4 :

[0066] Step 1: determine the fixed factors and variable factors.

[0067] Step 2: solidify the fixed factors as data authentication factors for the data reporting system from the coding.

[0068] Step 3: configuring the association relationship between the role and the fixed factor through the system permission configuration function.

[0069] Step 4: configuring the association relationship between the role and the enumeration value of the variable factor in the enumeration form in the dictionary set.

[0070] Step 5: converting the data permission of the role into sql (i.e., into code) according to the association relationship between the role and the fixed factor and the variable factor, and determining the data permission possessed by the role from the data description language level.

[0071] Embodiment Three

[0072] Figure 5 A structural block diagram of a data permission control device provided for Embodiment Three of the present application is shown in FIG. 3. The device is used to execute the data permission control method provided by any of the above embodiments. The device and the data permission control method of each of the above embodiments belong to the same inventive concept. Details not described in the embodiment of the data permission control device can be referred to the above embodiments of the data permission control method. As shown in FIG. 3, the device can specifically include a system role determination module 310 and a browsable data display module 320. Among them, Figure 5

[0073] The system role determination module 310 is configured to, when detecting a user login event, acquire a logged-in user and a logged-in system corresponding to the user login event, and determine a system role of the logged-in user in the logged-in system.

[0074] The browsable data display module 320 is configured to acquire a data permission control factor associated with the system role, and determine browsable data of the logged-in user under a current function of the logged-in system according to the data permission control factor, and display each of the browsable data.

[0075] Among them, the data permission control factor includes a fixed factor and a variable factor having a control effect on the data permission, the fixed factor includes a factor having a control effect under a plurality of system functions of the logged-in system, and the variable factor includes a factor having a control effect under the current function, and the current function includes a function applied by the logged-in user among the plurality of system functions.

[0076] Optionally, when the data permission control factor includes the variable factor, the browsable data display module 320 can include:

[0077] The dictionary set acquisition unit is configured to acquire a pre-configured dictionary set, wherein the dictionary set records at least one candidate dictionary, and each candidate dictionary includes a candidate role and a candidate factor.

[0078] ​The variable factor determining unit is configured to determine a target dictionary in which a candidate role corresponding to the system role is located from each candidate dictionary, and take a candidate factor recorded in the target dictionary as a variable factor associated with the system role.

[0079] On this basis, the candidate factor is represented by an enumeration value.

[0080] Optionally, the data permission control device can further include:

[0081] The data to be changed acquisition module is configured to acquire a role to be changed and a factor to be changed corresponding to the data permission change instruction when the data permission change instruction is received.

[0082] The candidate role determining module is configured to determine whether a candidate role corresponding to the role to be changed is recorded in the dictionary set.

[0083] The candidate factor changing module is configured to change a candidate factor in a candidate dictionary in which the candidate role corresponding to the role to be changed is located based on the factor to be changed if the candidate role corresponding to the role to be changed is recorded in the dictionary set.

[0084] The candidate dictionary adding module is configured to add the role to be changed and the factor to be changed as a candidate dictionary to the dictionary set if the candidate role corresponding to the role to be changed is not recorded in the dictionary set.

[0085] Optionally, the enumeration value set of the fixed factor is written in the data permission control code, and the data permission control device can further include:

[0086] The data to be configured acquisition module is configured to acquire a role to be configured and a value to be configured corresponding to the data permission configuration instruction when the data permission configuration instruction is received, wherein the value to be configured is an enumeration value in the enumeration value set.

[0087] The data to be configured association module is configured to associate the role to be configured and the value to be configured.

[0088] Optionally, the data permission control device can further include:

[0089] The system menu display module is configured to acquire a system menu associated with the system role and display each system menu before acquiring the data permission control factor associated with the system role.

[0090] The current menu determining module is configured to determine a current menu on which the function triggering operation acts after detecting the function triggering operation, wherein the current menu is a menu for implementing the current function in each system menu.

[0091] Correspondingly, the browsable data display module 320 can include:

[0092] The browsable data display unit is configured to display each browsable data under the current menu.

[0093] Optionally, the logged-in system comprises a data reporting system in which the logged-in user logs in, the fixed factor comprises a report of a browsable data source, and the browsable data recorded in the report comprises a plurality of fields, and the variable factor comprises a target field in the fields.

[0094] The data permission control device provided in the third embodiment of the present application acquires the logged-in user and the logged-in system corresponding to the detected user login event through the system role determination module, and determines the system role of the logged-in user in the logged-in system. Further, the data permission control device acquires the data permission control factor comprising the fixed factor and the variable factor associated with the system role and having a control effect on data permission through the browsable data display module, and determines the browsable data of the logged-in user under the current function of the logged-in system according to the data permission control factor, and displays each browsable data. In this way, the browsable data that can be browsed by the logged-in user under the current function applied by the logged-in user can be controlled. The above device pre-associates the system role with the fixed factor and the variable factor. Since the fixed factor has a control effect on data permission in multiple system functions of the logged-in system, the effective control of the browsable data of the logged-in user under multiple system functions is ensured. At the same time, since the variable factor comprises a factor having a control effect on data permission under the current function applied by the logged-in user in multiple system functions, the data permission under the same system role can be refined and changed by configuring the variable factor, and the control of the browsable data of the logged-in user under the current function is further ensured. The fixed factor and the variable factor cooperate with each other, expand the dimension of data permission control without excessively refining the system role, and achieve the effect of controlling data permission from multiple dimensions and further refining the granularity of data permission control.

[0095] The data permission control device provided in the embodiments of the present application can execute the data permission control method provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0096] It should be noted that in the above embodiments of the data permission control device, each unit and module included is only divided according to the function logic, but is not limited to the above division, as long as the corresponding function can be realized. In addition, the specific names of each functional unit are only for convenient mutual differentiation, and do not limit the protection scope of the present application.

[0097] Embodiment Four

[0098] Figure 6 The structural schematic diagram of a data permission control device provided in the fourth embodiment of the present application is shown in FIG. 4. Figure 6As shown, the device includes a memory 410, a processor 420, an input device 430, and an output device 440. The number of processors 420 in the device can be one or more, Figure 6 The memory 410, the processor 420, the input device 430, and the output device 440 in the device can be connected by a bus or other means, Figure 6 For example, the memory 410, the processor 420, the input device 430, and the output device 440 in the device are connected by the bus 450.

[0099] The memory 410 can be used to store software programs, computer executable programs, and modules, such as program instructions / modules corresponding to the data permission control method in the embodiments of the present application (for example, the system role determination module 310 and the browsable data display module 320 in the data permission control device). The processor 420 executes the software programs, instructions, and modules stored in the memory 410 to perform various functions and data processing of the device, that is, to implement the data permission control method described above.

[0100] The memory 410 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created according to the use of the device, etc. In addition, the memory 410 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some examples, the memory 410 can further include a memory remotely arranged with respect to the processor 420, which can be connected to the device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0101] The input device 430 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the device. The output device 440 can include a display device such as a display screen.

[0102] Embodiment five

[0103] Embodiment five of the present application provides a storage medium containing computer executable instructions, which when executed by a computer processor, are used to perform a data permission control method, the method comprising:

[0104] When a user login event is detected, an already logged-in user and an already logged-in system corresponding to the user login event are obtained, and a system role of the already logged-in user in the already logged-in system is determined;

[0105] The data permission control factor associated with the system role is acquired, the browsable data of the logged-in user under the current function of the logged-in system is determined according to the data permission control factor, and each browsable data is displayed.

[0106] The data permission control factor includes a fixed factor and a variable factor, the fixed factor includes a factor having a control effect under multiple system functions of the logged-in system, and the variable factor includes a factor having a control effect under the current function.

[0107] Of course, the storage medium provided by the embodiment of the present application includes computer executable instructions, and the computer executable instructions are not limited to the method operations described above, and can also perform related operations in the data permission control method provided by any embodiment of the present application.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. According to such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk or an optical disk, etc., including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present application.

[0109] Note that the above is only the preferred embodiment of the present application and the technical principle applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and those skilled in the art can make various obvious changes, readjustments and substitutions without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A data authority control method, characterized by, The method comprises the following steps: Upon detecting a user login event, obtaining a logged-in user and a logged-in system corresponding to the user login event, and determining a system role of the logged-in user in the logged-in system, wherein the system role is a role pre-assigned to the logged-in user on the logged-in system; obtaining a data authority control factor associated with the system role, and determining browsable data of the logged-in user under a current function of the logged-in system according to the data authority control factor, and displaying each of the browsable data; wherein the data authority control factor comprises a fixed factor and a variable factor having a control effect on data authority, the fixed factor comprises a factor having the control effect under multiple system functions of the logged-in system, and the variable factor comprises a factor having the control effect under the current function, the variable factor being determined according to actual requirements of data authority control under the current function, and the current function comprising a function of the multiple system functions applied by the logged-in user; the logged-in system comprises a data reporting system logged in by the logged-in user, the fixed factor comprises a report of a source of the browsable data, the browsable data recorded in the report comprises multiple fields, and the variable factor comprises a target field related to the current function in each of the fields.

2. The method of claim 1, wherein, When the data authority control factor comprises the variable factor, the obtaining of the data authority control factor associated with the system role comprises: obtaining a dictionary set pre-configured, wherein at least one candidate dictionary is recorded in the dictionary set, and each of the candidate dictionaries comprises a candidate role and a candidate factor; determining a target dictionary in which the candidate role corresponding to the system role is located from each of the candidate dictionaries, and taking the candidate factor recorded in the target dictionary as the variable factor associated with the system role.

3. The method of claim 2, wherein, The candidate factor is represented by an enumeration value.

4. The method of claim 2, wherein, The method further comprises: Upon receiving a data authority change instruction, obtaining a to-be-changed role and a to-be-changed factor corresponding to the data authority change instruction; determining whether the candidate role corresponding to the to-be-changed role is recorded in the dictionary set; if yes, changing the candidate factor in the candidate dictionary in which the candidate role corresponding to the to-be-changed role is located based on the to-be-changed factor; otherwise, adding the to-be-changed role and the to-be-changed factor as a candidate dictionary to the dictionary set.

5. The method of claim 1, wherein, The enumeration value set of the fixed factor is written in a data authority control code, and the method further comprises: Upon receiving a data authority configuration instruction, obtaining a to-be-configured role and a to-be-configured numerical value corresponding to the data authority configuration instruction, wherein the to-be-configured numerical value is an enumeration value in the enumeration value set; associating the to-be-configured role with the to-be-configured numerical value.

6. The method of claim 1, wherein, Before the obtaining of the data authority control factor associated with the system role, the method further comprises: obtaining a system menu associated with the system role, and displaying each of the system menus; After detecting the function trigger operation, a current menu on which the function trigger operation acts is determined, wherein the current menu is a menu for implementing the current function in each of the system menus; Correspondingly, the displaying of each of the browsable data comprises: displaying each of the browsable data under the current menu.

7. A data authority control apparatus, characterized by comprising: Comprise: A system role determination module is configured to, when a user login event is detected, acquire a logged-in user and a logged-in system corresponding to the user login event, and determine a system role of the logged-in user in the logged-in system, wherein the system role is a role pre-assigned to the logged-in user on the logged-in system; A browsable data display module is configured to acquire a data permission control factor associated with the system role, determine browsable data of the logged-in user under a current function of the logged-in system according to the data permission control factor, and display each of the browsable data. The data permission control factor comprises a fixed factor and a variable factor having a control effect on data permission, the fixed factor comprises a factor having the control effect under a plurality of system functions of the logged-in system, and the variable factor comprises a factor having the control effect under the current function, the variable factor is determined according to actual needs of data permission control under the current function, and the current function comprises a function of the plurality of system functions applied by the logged-in user. The logged-in system comprises a data reporting system logged in by the logged-in user, the fixed factor comprises a report of a source of the browsable data, the browsable data recorded in the report comprises a plurality of fields, and the variable factor comprises a target field related to the current function in each of the fields.

8. A data authority control device, characterized by, Comprise: One or more processors; Memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data permission control method according to any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the data permission control method according to any one of claims 1-6.

Images