Business system authority management method, device, electronic device and storage medium

Abstract

The present application provides a business system authority management method, device, electronic device and storage medium, which relates to the field of office automation technology. The method includes: creating a role for each business system connected to the server to obtain role information, wherein the role information includes a role identity number and a role identification code; configuring at least one basic authority data of the business system according to the menu of the business system or the function provided by the business system, wherein one basic authority data corresponds to one authority in the server, associating the role with at least one basic authority data, and classifying the authority of the business system based on the basic authority data and the role; upon receiving a process application initiated by a user, changing the basic authority data of the business system according to the business system selected in the process application and the authority to be changed. The method can solve the problem of high dependence on operation and maintenance personnel in the approval of business system authority, which leads to waste of human resources.

Description

Technical Field

[0001] The present application relates to the field of office automation, and more specifically, to a business system authority management method, device, electronic device and storage medium. Background Art

[0002] The development of office systematization has enabled information security management to penetrate into various enterprises. Therefore, a reasonable OA approval system and permission management system are needed to ensure the security of office information. At present, most business process systems have not realized the dynamic management of processes and process forms, resulting in strong coupling management between processes and business systems. Every time new permissions are added, they need to be coordinated with the approval service, and the permission process is too redundant. When different types of permissions appear, a new process needs to be added. Therefore, there is a high dependence on operation and maintenance personnel, resulting in a waste of human resources. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a business system authority management method, device, electronic device and storage medium to solve the current problem of high dependence on operation and maintenance personnel in business system authority approval, which leads to waste of human resources.

[0004] In a first aspect, an embodiment of the present application provides a business system rights management method, including:

[0005] Creating a role for each business system connected to the server to obtain role information, wherein the role information includes a role identification number and a role identification code;

[0006] According to the menu of the business system or the function provided by the business system, configure at least one basic permission data of the business system, one basic permission data corresponds to a permission in the server, associate the role with at least one basic permission data, and classify the permissions of the business system based on the basic permission data and the role;

[0007] When a process application initiated by a user is received, the permission basic data of the business system is changed according to the business system selected in the process application and the permission to be changed.

[0008] In the above implementation process, the implementation method of configuring corresponding roles for each business system is adopted. Users can be associated with basic permissions and the basic permissions can be divided to uniformly manage all business systems connected to the server. Based on the correspondence between roles and business systems, the basic data of business system permissions can be managed in a scoped manner, thereby reducing dependence on operation and maintenance personnel and saving system operating costs.

[0009] Optionally, before creating a role for each business system connected to the server, the method further includes:

[0010] Acquire data information of the business system to register the business system, and provide a system identifier and a system key for the business system;

[0011] When receiving a call request from the business system to call the application program interface of the server, the business system is authenticated based on the system identifier and the system key, and the call request is approved when the authentication is successful.

[0012] In the above implementation process, the zero-trust system architecture rebuilds the trust foundation of access control based on identity authentication and authorization, ensuring that the user's identity is trustworthy and the communication link is trustworthy, and can perform refined access control on the user list of permission applications, thereby improving the security of permission management.

[0013] Optionally, before configuring at least one basic permission data of the business system according to the menu and function of the business system, the method further includes:

[0014] Dividing the permission granularity according to the menu level of the business system or dividing the permission granularity according to the functions provided by the business system, the permission granularity indicates the degree of refinement of the permission basic data;

[0015] The permission basic data configured in the business system is determined based on the permission granularity.

[0016] In the above implementation process, the basic permission data can be specifically divided according to the menu level and function of the actual business system. For different business systems, the amount of basic permission data configured and the level of detail of the query can be taken into account, thereby improving the efficiency of business system permission management and saving time costs.

[0017] Optionally, the step of changing the basic authority data of the business system according to the business system selected in the process application and the authority to be changed includes:

[0018] Based on the process application, all roles in the business system are displayed;

[0019] Receive a role selection instruction and an operation execution instruction input by a user, wherein the operation execution instruction includes a permission activation instruction and a permission revocation instruction;

[0020] Based on the role selection instruction, a configured role is selected and the permission basic data associated with the role is displayed, and based on the permission activation instruction or the permission revocation instruction, additional permission basic data is configured for the role or the permission basic data corresponding to the revoked permission is deleted.

[0021] In the above implementation process, the basic data of business system permissions can be automatically changed according to the process application and operation instructions submitted by the user, which can improve the efficiency of permission management and the stability of the system. Based on automated permission management, programmatic transaction processing processes can also replace manual maintenance, thereby reducing operation and maintenance costs.

[0022] Optionally, after configuring additional permission basic data for the role based on the permission activation instruction or the permission revocation instruction or deleting the permission basic data corresponding to the revoked permission, the method further includes:

[0023] Push the basic data of newly added or cancelled permissions to the message queue;

[0024] The permissions of the business system are synchronized and logged based on the permission basic data in the message queue.

[0025] In the above implementation process, the basic data of business system permissions is modified by using message queues, and concurrent data processing reduces processing time, which can improve operational efficiency and enhance the timeliness of business system permission changes. By recording permission applications in logs, process review is facilitated.

[0026] Optionally, the role information further includes a role name, and the basic authority data of changing the business system according to the business system selected in the process application and the authority to be changed includes:

[0027] Query all roles of the target business system based on the role name;

[0028] A role configuration instruction of a user is received, each role of the target business system is retrieved to obtain a target role, and at least one basic permission is configured for the target role based on the role configuration instruction.

[0029] In the above implementation process, automated permission management can be achieved. By configuring the roles and permissions of the business system, the permissions of each role in the business system can be accurately reflected when applying for permission processes, making permission management more organized. When users submit process applications for changing permissions, they can also quickly query the roles that need to change permissions and the corresponding permissions that need to be changed, thereby improving permission management efficiency.

[0030] After changing the permission basic data of the business system according to the business system selected in the process application and the permission to be changed, the method further includes:

[0031] Obtain the user's contact information and send the processing progress of the process application to the user.

[0032] In a second aspect, an embodiment of the present application provides a business system rights management device, including:

[0033] A role creation module, used to create a role for each business system connected to the server to obtain role information, wherein the role information includes a role identification number and a role identification code;

[0034] A configuration module, configured to configure at least one basic permission data of the business system according to a menu of the business system or a function provided by the business system, wherein one basic permission data corresponds to one permission in the server, associate the role with at least one basic permission data, and classify the permissions of the business system based on the basic permission data and the role;

[0035] The authority management module is used to change the authority basic data of the business system according to the business system selected in the process application and the authority to be changed when receiving a process application initiated by a user.

[0036] In the above implementation process, the implementation method of configuring corresponding roles for each business system is adopted. Users can be associated with basic permissions and the basic permissions can be divided to uniformly manage all business systems connected to the server. Based on the correspondence between roles and business systems, the basic data of business system permissions can be managed in a scoped manner, thereby reducing dependence on operation and maintenance personnel and saving system operating costs.

[0037] Optionally, the business system authority management device may also include a business system access module, which is used to obtain data information of the business system to register the business system and provide a system identifier and a system key for the business system; when receiving a call request from the business system to call the application program interface of the server, the business system is authenticated based on the system identifier and the system key, and when the authentication is passed, the call request is approved.

[0038] In the above implementation process, the zero-trust system architecture rebuilds the trust foundation of access control based on identity authentication and authorization, ensuring that the user's identity is trustworthy and the communication link is trustworthy, and can perform refined access control on the user list of permission applications, thereby improving the security of permission management.

[0039] Optionally, the business system permission management device may also include a granularity division module, which is used to divide the permission granularity according to the menu hierarchy of the business system or divide the permission granularity according to the functions provided by the business system, the permission granularity represents the degree of refinement of the permission basic data; and the permission basic data configured for the business system is determined based on the permission granularity.

[0040] In the above implementation process, the basic permission data can be specifically divided according to the menu level and function of the actual business system. For different business systems, the amount of basic permission data configured and the level of detail of the query can be taken into account, thereby improving the efficiency of business system permission management and saving time costs.

[0041] Optionally, the permission management module can be specifically used to: display all roles in the business system based on the process application; receive role selection instructions and operation execution instructions input by the user, the operation execution instructions including permission activation instructions and permission revocation instructions; select a configured role based on the role selection instructions and display the permission basic data associated with the role, and configure additional permission basic data for the role or delete the permission basic data corresponding to the revoked permission based on the permission activation instructions or the permission revocation instructions.

[0042] In the above implementation process, the basic data of business system permissions can be automatically changed according to the process application and operation instructions submitted by the user, which can improve the efficiency of permission management and the stability of the system. Based on automated permission management, programmatic transaction processing processes can also replace manual maintenance, thereby reducing operation and maintenance costs.

[0043] Optionally, the business system authority management device may further include an authority synchronization module, which is used to push newly added or cancelled authority basic data to a message queue; synchronize the authority of the business system based on the authority basic data in the message queue and record logs.

[0044] In the above implementation process, the basic data of business system permissions is modified by using message queues, and concurrent data processing reduces processing time, which can improve operational efficiency and enhance the timeliness of business system permission changes. By recording permission applications in logs, process review is facilitated.

[0045] Optionally, the role information also includes a role name, and the permission management module can be specifically used to: query all roles of the target business system based on the role name; receive a user's role configuration instruction, retrieve each role of the target business system to obtain a target role, and configure at least one basic permission for the target role based on the role configuration instruction.

[0046] In the above implementation process, automated permission management can be achieved. By configuring the roles and permissions of the business system, the permissions of each role in the business system can be accurately reflected when applying for permission processes, making permission management more organized. When users submit process applications for changing permissions, they can also quickly query the roles that need to change permissions and the corresponding permissions that need to be changed, thereby improving permission management efficiency.

[0047] Optionally, the business system rights management device may further include a message sending module, which is used to obtain the user's contact information and send the processing progress of the process application to the user.

[0048] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores program instructions, and when the processor reads and runs the program instructions, it executes the steps in any of the above implementation methods.

[0049] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the steps in any of the above-mentioned implementation methods are executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of the steps of the business system rights management method provided in an embodiment of the present application;

[0052] Figure 2 A schematic diagram of steps for connecting a business system to a server provided in an embodiment of the present application;

[0053] Figure 3 A schematic diagram of the steps for changing the basic data of business system permissions provided in an embodiment of the present application;

[0054] Figure 4 A schematic diagram of steps for synchronizing permissions of a business system provided in an embodiment of the present application;

[0055] Figure 5 A schematic diagram of the operation process of OA rights management provided in an embodiment of the present application;

[0056] Figure 6A schematic diagram of a business system rights management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram may represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented by a dedicated hardware-based system that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions. In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part.

[0058] During the research, the applicant found that the current routine operation process for employees to apply for business permissions is to first submit an OA approval process application. After the process is approved, the operation and maintenance personnel of the relevant system will make corresponding changes to the applicant's permissions based on the content of the application and the results of the approval. However, this traditional processing method has many problems and risks. Since most business systems have not realized the dynamic management of processes and process forms, new processes need to be developed, which leads to high dependence on operation and maintenance personnel and waste of human and time resources.

[0059] Based on this, the present application embodiment provides a business system rights management method to realize automated rights management, thereby reducing the dependence on operation and maintenance personnel and saving system operation costs. Figure 1 , Figure 1 A schematic diagram of the steps of the business system rights management method provided in an embodiment of the present application, the method may include the following steps:

[0060] In step S12, a role is created for each business system connected to the server to obtain role information, wherein the role information includes a role identity number and a role identification code.

[0061] Among them, the server can be the authority center that manages all business system permissions. The role identity document (ID) is the data that is automatically incremented in the server. Each role ID is unique, and business systems are distinguished by different roles. The role identification code can be the abbreviation of the business system with access, which is used to query the role, and each role identification code is also unique. Specifically, the role information can also include the role name, the system to which the role belongs, and the role status. The role name can be named according to the actual business logic of the business system. The system to which the role belongs is the name of the business system corresponding to the role. The role status can determine the activation status of the role.

[0062] In step S13, at least one basic permission data of the business system is configured according to the menu of the business system or the function provided by the business system, one basic permission data corresponds to a permission in the server, the role is associated with at least one basic permission data, and the business system is classified according to the basic permission data and the role.

[0063] Among them, a business system has multiple menu levels and can provide multiple functions, so a role can be configured with multiple basic permissions, and each permission can be distinguished by ID. The step of configuring permissions can be to add corresponding basic permissions to the role by matching the permission ID and the role ID, or to delete the matching relationship between the permission ID and the role ID to cancel the basic permissions corresponding to the role.

[0064] In step S14, when a process application initiated by a user is received, the permission basic data of the business system is changed according to the business system selected in the process application and the permission to be changed.

[0065] It can be seen that the embodiment of the present application adopts an implementation method of configuring corresponding roles for each business system, which can associate users with basic permissions and thus divide the basic permissions, so as to uniformly manage all business systems connected to the server. Based on the correspondence between roles and business systems, the basic data of business system permissions can be managed in a scoped manner, thereby reducing dependence on operation and maintenance personnel and saving system operating costs.

[0066] Optionally, before step S11, the business system to be managed needs to be connected to the server. Figure 2 , Figure 2 A schematic diagram of steps for connecting a business system to a server is provided in an embodiment of the present application. The steps may include the following:

[0067] In step S111, data information of the business system is obtained to register the business system, and a system identifier and a system key are provided for the business system.

[0068] The system ID is a unique code for the business system, which can be used for classified management of the business system. The system key is information paired with the system ID for encryption, decryption or integrity verification of the system ID.

[0069] In step S112, when receiving a call request from the business system to call the application program interface of the server, the business system is authenticated based on the system identifier and the system key, and when the authentication is successful, the call request is approved.

[0070] Exemplarily, an encrypted system identifier and system key of a business system can be received, and the system identifier can be decrypted based on the system key, and a query can be made in the database to see whether the decrypted system identifier is recorded, thereby determining whether the business system can access the authority center; or the system identifier can be verified to be complete based on the system key, thereby determining whether the business system can access the authority center.

[0071] Among them, the authority center provides a unified data registration interface, and adds new business system access based on the provided application programming interface (API). When any system wants to call the server's API, it needs to provide a system logo and system key for system authentication in order to access the server.

[0072] It can be seen that the embodiment of the present application is based on a zero-trust system architecture and thus rebuilds the trust basis of access control based on identity authentication and authorization, ensuring that the user's identity is trustworthy and the communication link is trustworthy, and can perform refined access control on the user list of permission applications, thereby improving the security of permission management.

[0073] In an optional embodiment, for step S12, the degree of division and refinement of the business system functions may be determined based on the authority granularity. Before configuring at least one authority basic data of the business system according to the menu and function of the business system, the method may further include:

[0074] The permission granularity is divided according to the menu level of the business system or according to the functions provided by the business system, and the permission granularity represents the degree of refinement of the permission basic data; the permission basic data configured for the business system is determined based on the permission granularity.

[0075] Granularity refers to the level of refinement of permissions stored in the data unit of the permission database. The smaller the granularity, the higher the refinement. There can be a parent-child relationship between permissions. For example, the permission to change data can include three sub-permissions: adding data, modifying data, and deleting data. Therefore, the permission granularity of the business system can be determined based on the number of business system menu levels and the refinement of the functions provided.

[0076] It can be seen that the embodiment of the present application can specifically divide the basic permission data according to the menu level and function of the actual business system. For different business systems, the size of the configuration permission basic data and the level of detail of the query can be taken into account, thereby improving the efficiency of business system permission management and saving time costs.

[0077] Optionally, for step S14, the present application embodiment also provides a method for changing the basic data of the business system authority, please refer to Figure 3 , Figure 3 A schematic diagram of a step for changing basic data of business system permissions provided in an embodiment of the present application may include the following steps:

[0078] In step S141, all roles in the business system are displayed based on the process application.

[0079] Specifically, users can submit process applications to the permission center on a fixed application page according to their needs. All data related to permissions in the page can be obtained through the query interface provided by the permission center. When the user's process application is received, all roles under the business system will be displayed on the page based on the business system selected by the user, and when the user selects a role, the basic permissions associated with the role will be displayed.

[0080] In step S142, a role selection instruction and an operation execution instruction input by a user are received, wherein the operation execution instruction includes a permission activation instruction and a permission revocation instruction.

[0081] Among them, the user can select permissions and operations to be performed on the permissions on the page, such as entering a permission activation instruction to activate a permission that is not included in the permissions of the current role, or entering a permission revocation instruction to revoke a permission that already exists in the permissions of the current role.

[0082] In step S143, a configured role is selected based on the role selection instruction and the permission basic data associated with the role is displayed, and additional permission basic data is configured for the role based on the permission activation instruction or the permission revocation instruction or the permission basic data corresponding to the revoked permission is deleted.

[0083] Among them, the permission application record may include the following information: business system identification, used to record the activated business system; role identification, used to record the role of changing permissions; permission list, used to record the activated basic permission list; applicant ID, permission effective time and permission expiration time.

[0084] Specifically, after the user submits a permission application, it will be reviewed and approved. The corresponding interface provided by the permission center will be called based on the approval result and permission application type to configure additional permission basic data for the role or delete the permission basic data corresponding to the revoked permission, thereby activating or revoking the corresponding permission of the role.

[0085] It can be seen that in the embodiment of the present application, the basic data of business system permissions can be automatically changed according to the process application and operation instructions submitted by the user, which can improve the efficiency of permission management and the stability of the system. Based on automated permission management, programmatic transaction processing processes can also replace manual maintenance, thereby reducing operation and maintenance costs.

[0086] In an optional embodiment, for step S143, the present application embodiment also provides a method for implementing permission synchronization for the business system, please refer to Figure 4 , Figure 4 A schematic diagram of a step for synchronizing permissions of a business system provided in an embodiment of the present application may include:

[0087] In step S41, the newly added or cancelled permission basic data is pushed to the message queue.

[0088] In step S42, the permissions of the business system are synchronized and logged based on the permission basic data in the message queue.

[0089] Among them, the message queue can be RabbitMQ, RocketMQ, ActiveMQ, Kafka, ZeroMQ, MetaMq. In practice, the permission change operation needs to be approved and the result does not need to be obtained immediately. However, the concurrency of the permission change operation needs to be controlled to avoid failure of calling the interface. Therefore, the message queue can be used to process messages concurrently.

[0090] It can be seen that the message queue method is used in the embodiment of the present application to modify the basic data of business system permissions, and concurrent data processing reduces processing time, which can improve operating efficiency and enhance the timeliness of business system permission changes. By recording permission applications in logs, process review is facilitated.

[0091] Further, for step S14, the step of changing the basic authority data of the business system according to the business system selected in the process application and the authority to be changed may include:

[0092] All roles of the target business system are queried based on the role name; a role configuration instruction of a user is received, each role of the target business system is retrieved to obtain a target role, and at least one basic permission is configured for the target role based on the role configuration instruction.

[0093] For example, when a user submits an application to change the process of permissions, the permission center can display all roles under the business system selected by the user. The user can search based on the role name. When the user selects a role, the permission center displays the basic permissions associated with the role to the user. The user can select the permissions that need to be changed and the operations they want to perform, such as enabling data change permissions for the role and revoking the access rights of a role.

[0094] It can be seen that through the permission management method provided in the embodiment of the present application, automated permission management can be achieved. By configuring the roles and permissions of the business system, the permissions of each role in the business system can be accurately reflected when applying for permission processes, which can make permission management more organized. When users submit process applications for changing permissions, they can also quickly query the roles that need to change permissions and the corresponding permissions that need to be changed, which can improve the efficiency of permission management.

[0095] For example, see Figure 5 , Figure 5 A schematic diagram of the operational process of OA authority management provided in an embodiment of the present application.

[0096] Among them, users can submit role permission process applications in the fixed page provided by the permission center. For the specific steps of submitting process applications, please refer to the above content and will not be repeated here. When the permission center receives the process application submitted by the user, the OA approval system and the permission center are interfaced to approve the process application. The OA approval system sends the approval data and approval results to the permission center. The permission center determines whether to modify the role's permissions based on the approval results. When it is determined that the role's permissions are to be modified, it modifies them based on the approval data and pushes the modified permission basic information to the message queue synchronously. The business system can obtain the changed permission data from the message queue for permission synchronization, thereby completing the permission management steps.

[0097] In an optional embodiment, after completing step S14, the method may further include obtaining the user's contact information and sending the processing progress of the process application to the user.

[0098] Among them, the user's contact information can be obtained through the process application submitted by the user. The user's contact information can be a telephone number or email address. The processing result of the process application can be notified to the user via text message or email, or by sending an in-site message to the user.

[0099] Based on the same inventive concept, the present application embodiment also provides a business system authority management device 60, please refer to Figure 6 , Figure 6 A schematic diagram of a business system rights management device provided in an embodiment of the present application, the device may include:

[0100] The role creation module 61 is used to create a role for each business system connected to the server to obtain role information, wherein the role information includes a role identity number and a role identification code.

[0101] Configuration module 62 is used to configure at least one basic permission data of the business system according to the menu of the business system or the function provided by the business system, one basic permission data corresponds to a permission in the server, associate the role with at least one basic permission data, and classify the permissions of the business system based on the basic permission data and the role.

[0102] The authority management module 63 is used to change the authority basic data of the business system according to the business system selected in the process application and the authority to be changed when receiving the process application initiated by the user.

[0103] Optionally, the business system authority management device 60 may also include a business system access module, which is used to obtain data information of the business system to register the business system and provide a system identifier and a system key for the business system; when receiving a call request from the business system to call the application interface of the server, the business system is authenticated based on the system identifier and the system key, and when the authentication is passed, the call request is approved.

[0104] Optionally, the business system permission management device 60 may also include a granularity division module, which is used to divide the permission granularity according to the menu hierarchy of the business system or divide the permission granularity according to the functions provided by the business system, and the permission granularity indicates the degree of refinement of the permission basic data; the permission basic data configured for the business system is determined based on the permission granularity.

[0105] Optionally, the permission management module 63 can be specifically used to: display all roles in the business system based on the process application; receive role selection instructions and operation execution instructions input by the user, the operation execution instructions including permission activation instructions and permission revocation instructions; select a configured role based on the role selection instructions and display the permission basic data associated with the role, and configure additional permission basic data for the role or delete the permission basic data corresponding to the revoked permission based on the permission activation instructions or the permission revocation instructions.

[0106] Optionally, the business system authority management device 60 may further include an authority synchronization module, which is used to push newly added or cancelled authority basic data to a message queue; synchronize the authority of the business system based on the authority basic data in the message queue and record logs.

[0107] Optionally, the role information also includes a role name, and the permission management module 63 can be specifically used to: query all roles of the target business system based on the role name; receive a user's role configuration instruction, retrieve each role of the target business system to obtain a target role, and configure at least one basic permission for the target role based on the role configuration instruction.

[0108] Optionally, the business system authority management device 60 may further include a message sending module, which is used to obtain the user's contact information and send the processing progress of the process application to the user.

[0109] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein program instructions are stored in the memory, and when the processor reads and runs the program instructions, the steps in any of the above implementation methods are executed.

[0110] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the steps in any of the above implementation methods are executed.

[0111] The computer-readable storage medium may be a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or any other medium that can store program codes. The storage medium is used to store the program, and the processor executes the program after receiving the execution instruction. The method executed by the electronic terminal of the process definition disclosed in any embodiment of the present invention can be applied to the processor or implemented by the processor.

[0112] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0113] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0115] Alternatively, the present invention may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the present invention may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part.

[0116] The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0117] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0118] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A business system rights management method, characterized in that: include: Acquire data information of the business system to register the business system, and provide a system identifier and a system key for the business system; Upon receiving a call request from the business system to call an application program interface of a server, authenticating the business system based on the system identifier and the system key, and approving the call request when the authentication passes; Creating a role for each business system connected to the server to obtain role information, wherein the role information includes a role identification number, a role identification code and a role name; According to the menu of the business system or the function provided by the business system, configure at least one basic permission data of the business system, one basic permission data corresponds to a permission in the server, associate the role with at least one basic permission data, and classify the permissions of the business system based on the basic permission data and the role; When receiving a process application initiated by a user, modifying the permission basic data of the business system according to the business system selected in the process application and the permission to be modified; The step of changing the permission basic data of the business system according to the business system selected in the process application and the permission to be changed comprises: querying all roles of the target business system based on the role name; A role configuration instruction of a user is received, each role of the target business system is retrieved to obtain a target role, and at least one basic permission is configured for the target role based on the role configuration instruction.

2. The method according to claim 1, characterized in that Before configuring at least one basic authority data of the business system according to the menu and function of the business system, the method further includes: Dividing the permission granularity according to the menu level of the business system or dividing the permission granularity according to the functions provided by the business system, the permission granularity indicating the degree of refinement of the permission basic data; The permission basic data configured for the business system is determined based on the permission granularity.

3. The method according to claim 1, characterized in that The step of changing the basic authority data of the business system according to the business system selected in the process application and the authority to be changed includes: Based on the process application, all roles in the business system are displayed; Receiving a role selection instruction and an operation execution instruction input by a user, wherein the operation execution instruction includes a permission activation instruction and a permission revocation instruction; Based on the role selection instruction, a configured role is selected and the permission basic data associated with the role is displayed, and based on the permission activation instruction or the permission revocation instruction, additional permission basic data is configured for the role or the permission basic data corresponding to the revoked permission is deleted.

4. The method according to claim 3, characterized in that After configuring additional permission basic data for the role based on the permission activation instruction or the permission revocation instruction or deleting the permission basic data corresponding to the revoked permission, the method further includes: Push the basic data of newly added or cancelled permissions to the message queue; The permissions of the business system are synchronized and logged based on the permission basic data in the message queue.

5. The method according to any one of claims 1 to 4, characterized in that: After changing the permission basic data of the business system according to the business system selected in the process application and the permission to be changed, the method further includes: Obtain the user's contact information and send the processing progress of the process application to the user.

6. A business system rights management device, characterized in that: include: The business system authority management device is used to obtain data information of the business system to register the business system and provide a system identifier and a system key for the business system; Upon receiving a call request from the business system to call an application program interface of a server, authenticating the business system based on the system identifier and the system key, and approving the call request when the authentication passes; A role creation module, used to create a role for each business system connected to the server to obtain role information, wherein the role information includes a role identification number, a role identification code and a role name; The authority management module is used to change the authority basic data of the business system according to the business system selected in the process application and the authority to be changed when receiving the process application initiated by the user; A configuration module, configured to configure at least one basic permission data of the business system according to a menu of the business system or a function provided by the business system, wherein one basic permission data corresponds to one permission in the server, associate the role with at least one basic permission data, and classify the permissions of the business system based on the basic permission data and the role; The step of changing the permission basic data of the business system according to the business system selected in the process application and the permission to be changed comprises: querying all roles of the target business system based on the role name; A role configuration instruction of a user is received, each role of the target business system is retrieved to obtain a target role, and at least one basic permission is configured for the target role based on the role configuration instruction.

7. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory stores program instructions, and when the processor runs the program instructions, the steps in the method according to any one of claims 1 to 5 are executed.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the steps in the method according to any one of claims 1 to 5 are executed.

Images