Business granularity-based enterprise data permission control method and system

Abstract

The application discloses a kind of enterprise data authority control methods and systems based on business granularity, it is related to enterprise expense management technical field, including the following steps: each field in original data set is allocated authority bit, and the authority bit of original data set is determined according to the authority bit of each field;The visible range and authorized personnel range of the business granularity corresponding to each field are obtained, and the authority configuration database table associated with original data set is constructed according to visible range and authorized personnel range;The database query clause corresponding to each business granularity is determined according to the authority bit of each field and the authority bit of original data set, and the authority data query is carried out according to authority configuration database table and each database query clause.The enterprise of the application can flexibly set fixed authority bit for different business granularity in service end, can be visible according to business authorization data line, not only realizes the flexibility of data line authorization in the case where guaranteeing data security, but also improves the management efficiency of enterprise reimbursement data.

Description

Technical Field

[0001] The present application relates to the technical field of enterprise expense management, and in particular to a method and system for enterprise data authority control based on business granularity. Background Art

[0002] Corporate reimbursement systems are generally associated with extremely important financial data, so there will be extremely strict control over data permissions. However, most reimbursement systems in existing technologies control the visibility of an entire set of data through permission settings at the function entrance or account permission settings. The permission control is not flexible enough and cannot meet the actual demand of only opening up part of the data permissions to a certain group of people. Summary of the Invention

[0003] The present application provides a business granularity-based enterprise data authority control method, which aims to solve the problem of insufficient flexibility in data authority control of enterprise reimbursement systems in the prior art.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] The present application provides a method for controlling enterprise data permissions based on business granularity, comprising the following steps:

[0006] Allocating a permission bit for each field in the original data set, and determining the permission bit of the original data set according to the permission bit of each field;

[0007] Obtaining the visible scope and authorized personnel scope of each field corresponding to the business granularity, and constructing a permission configuration database table associated with the original data set based on the visible scope and authorized personnel scope;

[0008] The database query clause corresponding to each business granularity is determined according to the permission bit of each field and the permission bit of the original data set, and permission data query is performed according to the permission configuration database table and each database query clause.

[0009] Preferably, the method further comprises: pre-configuring permission bits of all service granularities.

[0010] Preferably, all business granularities include departments, organizations, personnel, budget organizations, and accounting items.

[0011] Preferably, allocating a permission bit to each field in the original data set and determining the permission bit of the original data set according to the permission bit of each field includes:

[0012] Allocate permission bits for each field in the original data set according to pre-configured service granularity permission bits, wherein the fields correspond one to one with the service granularity;

[0013] A left shift operation is performed on the permission bits of each of the fields, and the operation results are added and converted into decimal numbers to obtain the permission bits of the original data set.

[0014] Preferably, the authority configuration database table includes any one or more of an authority organization configuration table, an authority department configuration table, an authority personnel configuration table, and an authority budget organization configuration table, as well as an authority configuration record table and an authority configuration authorized personnel table.

[0015] Preferably, determining the database query clause corresponding to each business granularity according to the permission bit of each field and the permission bit of the original data set, and performing permission data query according to the permission configuration database table and each database query clause, includes:

[0016] Performing an AND operation on the permission bit of the original data set table and the left shift operation result of each field permission bit, and determining whether the result of the AND operation is greater than 0;

[0017] When the result of the AND operation is greater than 0, the database dynamic filtering query clauses of the business granularity corresponding to each field in the original data set are filtered out from the preset business granularity database dynamic filtering query clauses;

[0018] The authority configuration database table is filtered using each of the database dynamic filtering query clauses to determine the authority data.

[0019] Preferably, the determining of authority data includes:

[0020] Upon receiving a data query instruction, extracting a target data set code in the data query instruction;

[0021] Find all permission bits associated with the target data set according to the target data set code;

[0022] Determine the database dynamic filtering query clause corresponding to the business granularity of each field in the target data set according to all associated permission bits, and splice it into the database query condition;

[0023] Execute the spliced ​​database query statement to obtain the query result.

[0024] An enterprise data authority control system based on business granularity, comprising:

[0025] an allocation module, configured to allocate a permission bit to each field in the original data set, and determine the permission bit of the original data set according to the permission bit of each field;

[0026] A construction module is used to obtain the visible scope and authorized personnel scope of each field corresponding to the business granularity, and to construct a permission configuration database table associated with the original data set based on the visible scope and authorized personnel scope;

[0027] The query module is used to determine the database query clause corresponding to each business granularity according to the permission bit of each field and the permission bit of the original data set, and perform permission data query according to the permission configuration database table and each database query clause.

[0028] An electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a business granularity-based enterprise data permission control method as described in any one of the above.

[0029] A computer-readable storage medium storing a computer program, wherein the computer program enables a computer to implement any one of the above-mentioned enterprise data authority control methods based on business granularity when executed.

[0030] The present invention has the following beneficial effects:

[0031] By setting fixed permission bits for different business granularities on the server side, the applicant enterprise can flexibly authorize the visibility of data rows based on the business. This not only achieves the flexibility of data row authorization while ensuring data security, but also improves the management efficiency of the enterprise's reimbursement data. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0033] Figure 1 This is a flow chart of a business granularity-based enterprise data authority control method of the present application;

[0034] Figure 2 This is a schematic diagram of an enterprise data rights control system based on business granularity in this application;

[0035] Figure 3 This is a schematic diagram of an electronic device that implements a business granularity-based enterprise data authority control method in this application. DETAILED DESCRIPTION

[0036] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0037] The terms "first", "second", etc. in the claims and specification of this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. This is merely a way of distinguishing when describing objects with the same properties in the embodiments of this application. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product or apparatus that includes a series of units is not necessarily limited to those units, but may include other units not expressly listed or inherent to these processes, methods, products or apparatuses.

[0038] like Figure 1 As shown, a method for controlling enterprise data permissions based on business granularity includes the following steps:

[0039] S110, allocating a permission bit to each field in the original data set, and determining the permission bit of the original data set according to the permission bit of each field;

[0040] S120: Obtain the visible scope and authorized personnel scope of each field at a business granularity, and construct a permission configuration database table associated with the original data set based on the visible scope and authorized personnel scope;

[0041] S130. Determine a database query clause corresponding to each of the business granularities according to the permission bits of each of the fields and the permission bits of the original data set, and perform permission data query according to the permission configuration database table and each of the database query clauses.

[0042] The commonality of each business granularity in the enterprise reimbursement system is extracted, such as organization permission bit 0, department permission bit 1, personnel permission bit 2, budget organization permission bit 3, and accounting item permission bit 4, and fixed permission bits are granted to different business granularities during initialization of the reimbursement system, i.e., organization permission bit 0, department permission bit 1, personnel permission bit 2, budget organization permission bit 3, and accounting item permission bit 4. Meanwhile, the permission configuration database empty tables are constructed, such as the permission configuration authorized personnel table, the permission organization configuration table, the permission department configuration table, the permission personnel configuration table, the permission budget organization configuration table, and the permission configuration record table, and the permission main table, i.e., the permission configuration record table, is associated with the other five tables through serial numbers, wherein the primary keys of the six tables are serial numbers, the authorized employees in the permission configuration authorized personnel table, and the personnel in the permission personnel configuration table, which represent authorized employees who can view the data of which employees, and the SQL logic of each business granularity is configured, i.e., the corresponding dynamic filtering query clause, exists clause, is written for each business granularity using standard database SQL language. When the system receives a new data set, i.e., an original data set, the business granularity contained in the data set, i.e., its field, is determined, and each field in the data set is assigned a corresponding permission bit according to the pre-set business granularity permission bit, and the permission bit of the data set is calculated according to the permission bit of each field. Then, the user can configure the visible range and authorized personnel range of each field corresponding to the business granularity according to the specific business needs on the client side, and the server fills the pre-constructed permission configuration database empty table according to the visible range and authorized personnel range to obtain the permission configuration database table associated with the original data set, and determines the query clause in the preset business granularity dynamic filtering query clause that matches the original data set according to the permission bit of each field and the permission bit of the original data set to facilitate subsequent permission data query.

[0043] Specifically, upon receiving a data query instruction, the target data set encoding in the data query instruction is extracted;

[0044] All permission bits associated with the target data set are found according to the target data set encoding;

[0045] The database dynamic filtering query clause of each field corresponding to the business granularity in the target data set is determined according to all associated permission bits, and is spliced into the database query condition;

[0046] The spliced database query statement is executed to obtain the query result.

[0047] When an employee initiates a data query instruction containing the target dataset code on the client, the target dataset here is equivalent to the original dataset mentioned above. The server will first extract the target dataset code from the received query instruction, query the permission bits of the original dataset from the dataset table based on the data table code, and then determine all business granularity permission bits associated with the target dataset. Based on the business granularity permission bits and the target dataset permission bits, the target dynamic filtering query clause—the exists clause—can be found. Finally, the dynamic filtering query clause corresponding to the business granularity of the query employee's permission is spliced ​​into the query SQL conditional statement used to obtain the detailed data in the target dataset and executed. That is, the target dataset table and its associated permission configuration database table are filtered through the final database query statement to obtain the detailed row data for which the querying employee has permission. In this embodiment, the enterprise can flexibly authorize the visibility of data rows based on business, which not only ensures data security but also improves the enterprise's management efficiency.

[0048] For example, let's control permissions on a dataset named Budget Details (dataset code: data_1). This dataset contains only two fields: Department and Budget Organization. This means the business granularity of this dataset only includes Department and Budget Organization. Based on business needs, Zhang 1 and Zhang 2 should see all data with departments A and B as budget organizations, while Li 1 and Li 2 should see data with departments D1 and D2 and budget organization A as departments. Table 1 shows the Budget Details dataset.

[0049] Table 1 Budget details dataset

[0050] department Budget Organization Budget value D1 A 100 D1 C 200 D2 A 200 D2 B 150 D2 C 50 D3 A 300

[0051] According to the preset business granularity permission bit configuration rules, the department's permission bit is 1 and the budget organization's permission bit is 3. Therefore, according to (1<<1)+(1<<3), the permission bit of the dataset can be calculated to be 10. The dataset table and dataset permission field mapping table are filled in respectively, as shown in Table 2 and Table 3.

[0052] Table 2 Dataset table

[0053] Dataset name Dataset encoding Dataset permission bits Budget Details data_1 10

[0054] Table 3 Dataset permission field mapping table

[0055] Dataset encoding Organization Field Department field Person field Budget Organization Field Accounting item field data_1 department Budget Organization

[0056] At the same time, the server-side database also includes five database configuration tables, namely the permission configuration authorization personnel table, the permission organization configuration table, the permission department configuration table, the permission personnel configuration table, and the permission budget organization configuration table. These five tables are associated with the permission master table and the permission configuration record table through serial numbers. Among them, these six tables already exist when the system is initialized. Except for the permission master table, namely the permission configuration record table and the permission configuration authorization personnel table, which are required for each permission control, other tables will be screened according to business needs. The fields in the permission configuration record table include serial number, data set code, organization configuration, department configuration, personnel configuration, budget organization configuration and accounting item configuration. The permission configuration authorization personnel table includes two fields, serial number and personnel code. The permission organization configuration includes two fields, serial number and organization. The permission part configuration table includes two fields, serial number and department. The permission personnel configuration table includes two fields, serial number and personnel. The permission budget organization configuration table includes two fields, serial number and budget organization. The permission accounting item configuration table includes serial number and accounting item Configuration table. In this embodiment, only four tables are needed, namely, the permission configuration authorization personnel table, the permission department configuration table, the permission budget organization configuration table, and the permission configuration record table. In order to filter out unnecessary data, the business granularity supported by the dataset will be judged based on the permission bit of the dataset. The judgment logic is: (dataset permission bit & (1<<business granularity permission bit))>0. When the result is true, it means support, and false means unsupport. In this embodiment, the permission bit of the budget detail dataset is 10. When the organization is judged (10&(1<<0))>0, the result is false; when the department is judged (10&(1<<1))>0, the result is true; when the personnel is judged (10&(1<<2))>0, the result is false; when the budget organization is judged (10&(1<<3))>0, the result is true; when the accounting item is judged (10&(1<<4))>0, the result is false; therefore, the budget detail dataset only supports business granularity authorization for departments and budget organizations.

[0057] According to the business needs of this embodiment, the final authority configuration record table is generated as shown in Table 4, the authority configuration authorized personnel table is shown in Table 5, the authority department configuration table is shown in Table 6, and the authority budget organization configuration table is shown in Table 7.

[0058] Table 4 Permission configuration record table

[0059] Serial number Dataset encoding Organization Configuration Department Configuration Staffing Budget organization configuration Accounting item configuration 1 data_1 ALL SOME 2 data_1 SOME SOME

[0060] Table 5 Authorization personnel table for authority configuration

[0061] Permission configuration record number Personnel Code 1 Zhang 1 1 Zhang 2 2 Li 1 2 Li 2

[0062] Table 6 Authority department configuration table

[0063] Permission configuration record number department 2 D1 2 D2

[0064] Table 7 Authority budget organization configuration table

[0065] Permission configuration record number Budget Organization 1 A 1 B 2 A

[0066] When an employee sends a data query instruction on the client to perform a data query, in this embodiment, taking Zhang 1, Zhang 2, Li 1, and Li 2 performing data queries as examples, the server first extracts the code of the original data set from the received data query instruction, queries the permission bits of the original data set from the data set table based on the data table code, and then determines all business granularity permission bits associated with the target data set. Finally, based on the business granularity permission bits and the target data set permission bits, the target dynamic filtering query clause—the exists clause—is found. Before performing permission control, the server has written a dynamic filtering query clause—the exists clause—for each business granularity for which permission bits are configured using standard database SQL language. The details are as follows:

[0067] 1. Organization: and exists(select * from permission configuration record table ra join permission configuration authorized personnel table raa on ra.serial number = raa.permission configuration record serial number left join permission organization configuration table rd on ra.serial number = rd.permission configuration record serial number where ra.dataset code = #{dataset code} and raa.personnel code = #{query personnel code} and(ra.organization configuration = 'ALL' or rd.organization = ${organization field of the main table}));

[0068] 2. Department: and exists(select * from permission configuration record table ra join permission configuration authorized personnel table raa on ra.serial number = raa.permission configuration record serial number left join permission department configuration table rd on ra.serial number = rd.permission configuration record serial number where ra.dataset code = #{dataset code} and raa.personnel code = #{query personnel code} and (ra.department configuration = 'ALL' or rd.department = ${department field of the main table}));

[0069] 3. Personnel: and exists(select * from permission configuration record table ra join permission configuration authorized personnel table raa on ra.serial number = raa.permission configuration record serial number left join permission personnel configuration table rd on ra.serial number = rd.permission configuration record serial number where ra.dataset code = #{dataset code} and raa.personnel code = #{query personnel code} and(ra.personnel configuration = 'ALL' or rd.personnel = ${personnel field of the main table}));

[0070] 4. Budget organization: and exists(select * from permission configuration record table ra join permission configuration authorized personnel table raa on ra.serial number = raa.permission configuration record serial number left join permission budget organization configuration table rd on ra.serial number = rd.permission configuration record serial number where ra.dataset code = #{dataset code} and raa.personnel code = #{query personnel code} and(ra.budget organization configuration = 'ALL' or rd.budget organization = ${budget organization field of the master table}));

[0071] 5. Accounting item: AND exists(SELECT * FROM permission configuration record table RA JOIN permission configuration authorized personnel table RAA ON RA.SEQ=RAA.Permission configuration record sequence number LEFT JOIN permission accounting item configuration table RD ON RA.SEQ=RD.Permission configuration record sequence number WHERE RA.Data set code=

[0072] #{Dataset code}andraa.Personnel code = #{Query personnel code}and(ra.Accounting item configuration = 'ALL' or rd.Accounting item = ${Accounting item field of the main table})).

[0073] This example only involves two business granularities: department and budget organization. Therefore, the final exists clause is:

[0074] 1. and exists(select * from permission configuration record table ra join permission configuration authorized personnel table raa on ra.serial number = raa.permission configuration record serial number left join permission department configuration table rd on ra.serial number = rd.permission configuration record serial number where ra.dataset code = #{dataset code} and raa.personnel code = #{query personnel code} and (ra.department configuration = 'ALL' or rd.organization = ${department field of the main table}));

[0075] 2. AND EXISTS (SELECT * FROM PERMISSION CONFIGURATION RECORD TABLE RA JOIN PERMISSION CONFIGURATION AUTHORIZED PERSONNEL TABLE RAA ON RA.SEQUENCE NUMBER = RAA.PERMISSION CONFIGURATION RECORD NUMBER LEFT JOIN PERMISSION BUDGET org CONFIGURATION TABLE RD ON RA.SEQUENCE NUMBER = RD.PERMISSION CONFIGURATION RECORD NUMBER WHERE RA.DATASET CODE = #{DATASET CODE} AND RA.PERSONNEL CODE = #{QUERY PERSONNEL CODE} AND (RA.BUFFETCH ORGANIZATION CONFIGURATION = 'ALL' OR RD.BUFFETCH ORGANIZATION = ${BUFFETCH ORGANIZATION FIELD OF MAIN TABLE})).

[0076] The query SQL statement for obtaining detailed data is spliced ​​with the above two exists clauses and executed. That is, the spliced ​​database query statement is used to query and filter the budget detail data set, the authority configuration record table, the authority configuration authorization personnel table, the authority department configuration table, and the authority budget organization configuration table, so as to obtain the row detail data of the queried employee with authority. In this embodiment, the data finally queried by Zhang 1 and Zhang 2 are the same, as shown in Table 8, and the data finally queried by Li 1 and Li 2 are the same, as shown in Table 9.

[0077] Table 8 Sheet 1 and Sheet 2 can view data

[0078] department Budget Organization Budget value D1 A 100 D2 A 200 D2 B 150 D3 A 300

[0079] Table 9 Li 1 and Li 2 can view data

[0080] department Budget Organization Budget value D1 A 100 D2 A 200

[0081] In this embodiment, enterprises can flexibly authorize the visibility of data rows based on business, that is, set fixed permission bits for different business granularities on the server side, and create empty tables such as the permission configuration authorization personnel table, permission organization configuration table, and permission department configuration table. At the same time, configure and save the exists clause corresponding to each business granularity based on the information in these tables. When a new data set needs to be subject to permission control, first assign permission bits to each field in the new data set, then perform authorization configuration, and finally perform data screening according to query instructions. This not only achieves the flexibility of data row authorization while ensuring data security, but also improves the management efficiency of enterprise reimbursement data.

[0082] like Figure 2 As shown, an enterprise data authority control system based on business granularity includes an allocation module, a construction module and a query module, wherein:

[0083] The allocation module is configured to allocate a permission bit to each field in the original data set, and determine the permission bit of the original data set according to the permission bit of each field;

[0084] The construction module is configured to acquire a visible range and an authorized personnel range of each field corresponding to a service granularity, and construct a permission configuration database table associated with the original data set according to the visible range and the authorized personnel range.

[0085] The query module is configured to determine a database query sub-clause corresponding to each service granularity according to a permission bit of each field and a permission bit of the original data set, and perform permission data query according to the permission configuration database table and each database query sub-clause.

[0086] As shown in Figure 3 An electronic device includes a memory 301 and a processor 302, the memory 301 is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 302 to implement the above-mentioned enterprise data permission control method based on service granularity.

[0087] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the electronic device described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0088] A computer readable storage medium storing a computer program, the computer program causes a computer to execute to implement the above-mentioned enterprise data permission control method based on service granularity.

[0089] For example, the computer program can be divided into one or more modules / units, one or more modules / units are stored in the memory 301 and executed by the processor 302, and the I / O interface transmission of data is completed by the input interface 305 and the output interface 306, to complete the present application, one or more modules / units can be a series of computer program instruction segments that can complete a specific function, which is used to describe the execution process of the computer program in the computer device.

[0090] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server and the like. The computer device can include, but is not limited to, the memory 301, the processor 302, those skilled in the art can understand that the embodiment is only an example of the computer device, and does not constitute a limitation on the computer device, and can include more or less components, or combine certain components, or different components, for example, the computer device can also include an inputter 307, a network access device, a bus and the like.

[0091] The processor 302 may be a central processing unit (CPU), other general-purpose processors 302, digital signal processors 302 (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 302 may be a microprocessor 302 or any conventional processor 302.

[0092] The memory 301 can be an internal storage unit of the computer device, such as a hard disk or memory of the computer device. The memory 301 can also be an external storage device of the computer device, such as a plug-in hard disk equipped with the computer device, a smart memory card (SMC), a secure digital (SD) card, a flash card, etc. Furthermore, the memory 301 can also include both an internal storage unit of the computer device and an external storage device. The memory 301 is used to store computer programs and other programs and data required by the computer device. The memory 301 can also be used to temporarily store data in the output device 308. The aforementioned storage media include various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM) 303, a random access memory (RAM) 304, a disk, or an optical disk.

[0093] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed by the present invention shall be covered by the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for controlling enterprise data rights based on business granularity, characterized in that: The following steps are involved: Allocating a permission bit for each field in the original data set, and determining the permission bit of the original data set according to the permission bit of each field; Obtaining the visible scope and authorized personnel scope of each field corresponding to the business granularity, and constructing a permission configuration database table associated with the original data set based on the visible scope and authorized personnel scope; Determining a database query clause corresponding to each of the business granularities according to the permission bits of each of the fields and the permission bits of the original data set, and performing permission data query according to the permission configuration database table and each of the database query clauses; Among them, the field permission bit is used to represent the unique number of the business dimension represented by the business granularity in the permission control system; the dataset permission bit is used to represent the field permissions that the dataset needs to control at the business granularity.

2. The enterprise data authority control method based on business granularity according to claim 1 is characterized in that: The method further includes: pre-configuring permission bits of all service granularities.

3. The enterprise data authority control method based on business granularity according to claim 2 is characterized in that: All business granularities include departments, organizations, personnel, budget organizations, and accounting items.

4. The enterprise data authority control method based on business granularity according to claim 2 is characterized in that: The allocating a permission bit to each field in the original data set and determining the permission bit of the original data set according to the permission bit of each field includes: Allocate permission bits for each field in the original data set according to pre-configured service granularity permission bits, wherein the fields correspond one to one with the service granularity; A left shift operation is performed on the permission bits of each of the fields, and the operation results are added and converted into decimal numbers to obtain the permission bits of the original data set.

5. The enterprise data authority control method based on business granularity according to claim 1 is characterized in that: The authority configuration database table includes any one or more of an authority organization configuration table, an authority department configuration table, an authority personnel configuration table, and an authority budget organization configuration table, as well as an authority configuration record table and an authority configuration authorized personnel table.

6. The enterprise data authority control method based on business granularity according to claim 4 is characterized in that: The determining of the database query clause corresponding to each of the business granularities according to the permission bits of each of the fields and the permission bits of the original data set, and performing permission data query according to the permission configuration database table and each of the database query clauses, includes: Performing an AND operation on the permission bit of the original data set table and the left shift operation result of each field permission bit, and determining whether the result of the AND operation is greater than 0; When the result of the AND operation is greater than 0, the database dynamic filtering query clauses of the business granularity corresponding to each field in the original data set are filtered out from the preset business granularity database dynamic filtering query clauses; The authority configuration database table is filtered using each of the database dynamic filtering query clauses to determine the authority data.

7. The enterprise data authority control method based on business granularity according to claim 6 is characterized in that: The determination of authority data includes: Upon receiving a data query instruction, extracting a target data set code in the data query instruction; Find all permission bits associated with the target data set according to the target data set code; Determine the database dynamic filtering query clause corresponding to the business granularity of each field in the target data set according to all associated permission bits, and splice it into the database query condition; Execute the spliced ​​database query statement to obtain the query result.

8. An enterprise data authority control system based on business granularity, characterized in that: include: an allocation module, configured to allocate a permission bit to each field in the original data set, and determine the permission bit of the original data set according to the permission bit of each field; A construction module is used to obtain the visible scope and authorized personnel scope of each field corresponding to the business granularity, and to construct a permission configuration database table associated with the original data set based on the visible scope and authorized personnel scope; A query module, configured to determine a database query clause corresponding to each of the business granularities based on the permission bits of each of the fields and the permission bits of the original data set, and perform permission data query based on the permission configuration database table and each of the database query clauses; The field permission bit is used to indicate the unique number of the business dimension represented by the business granularity in the permission control system; The dataset permission bit is used to indicate the field permissions that need to be controlled at the business granularity of the dataset.

9. An electronic device, characterized in that: It includes a memory and a processor, the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement an enterprise data permission control method based on business granularity as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables a computer to implement a method for controlling enterprise data rights based on business granularity according to any one of claims 1 to 7 when executed.

Images