Bi data visibility rights management system

Abstract

The application relates to a BI data visibility permission management system and an application method thereof. A set of permission filtering conditions related to user identities and attributes is defined on a data set to distinguish the visibility of the same data by different users, so that different users can see different data contents on the same data source, business data safety is ensured, different users can share the data source and the report, and the development amount of the BI system data source and the report is greatly reduced. Macro definition of user attributes is introduced in the judgment condition, so that batch authorization of a user group with a certain label can be flexibly realized, and flexibility of data distribution and batch operation according to users or user groups can be realized.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data visualization, and particularly relates to a BI data visibility permission management method, a BI data visibility permission management system and an electronic device. BACKGROUND

[0002] BI system, also called data analysis system.

[0003] BI system can convert the existing data in an enterprise into knowledge, and help the enterprise make wise business decisions. When the BI system processes enterprise data, the data can come from the order, inventory, transaction account, customer and supplier of the enterprise business system, and various data from the industry and competitors of the enterprise and other external environment of the enterprise.

[0004] In the data visualization processing, the BI system in the prior art allocates the visible data to the user, and this method has the following two disadvantages:

[0005] On the one hand, in the case that most of the data are non-sensitive data, a large amount of repeated configuration work is needed to open these data to a user, and the user permission is defined through the "inhibit visibility" perspective, so as to simplify the configuration operation;

[0006] On the other hand, only according to the user or user group to allocate the data lacks the flexibility of batch operation. SUMMARY

[0007] In order to solve the above problems, the present application provides a BI data visibility permission management method, a BI data visibility permission management system and an electronic device.

[0008] In one aspect of the present application, a BI data visibility permission management method is provided, comprising the following steps:

[0009] Building a permission filtering condition and configuring it on a data set;

[0010] In the permission filtering condition, the user attribute of the data set is associated with the permission filtering condition, so as to distinguish the visibility of the same data on the data set by different users;

[0011] When the user queries the data set, input the query information, and according to the input query information, obtain the user group to which the user belongs;

[0012] According to the permission filtering condition, query the data associated with the user attribute of the user group and return to the user.

[0013] As an optional embodiment of the present application, optionally, the permission filtering condition comprises:

[0014] a row condition for setting a visible permission rule of the row data, and judging that the row data meeting the row condition is visible to the first user;

[0015] a column condition for setting an invisible permission rule of the column data, and judging that the column data meeting the column condition is invisible to the second user.

[0016] As an optional embodiment of the present application, the construction of the permission filter condition comprises:

[0017] the and / or-not combination of the permission filter condition is completed through a UI, and a corresponding condition tree is obtained through recursive splicing;

[0018] and,

[0019] the user attribute in the permission filter condition is replaced by writing a SQL program;

[0020] the replaced user attribute and the condition tree are merged into a condition tree, and returned to a background administrator.

[0021] As an optional embodiment of the present application, the association of the user attribute of the data set with the permission filter condition in the permission filter condition comprises:

[0022] the macro definition of the user attribute is set as user / user group;

[0023] the macro definition of the user attribute is introduced into the permission filter condition, comprising:

[0024] the macro definition of the user attribute is introduced into the row condition;

[0025] the macro definition of the user attribute is introduced into the column condition;

[0026] when the user attribute of a user group meets the macro definition of the user attribute, the user group meeting the macro definition of the user attribute is authorized in batches through the row condition or the column condition.

[0027] As an optional embodiment of the present application, when the macro definition of the user attribute is introduced, it further comprises:

[0028] a parent user group and a child user group in a hierarchical upper and lower permission are constructed;

[0029] the child user group inherits the data visible or invisible permission of the parent user group in the row condition or the column condition.

[0030] As an optional implementation of the present application, the user attribute of the data set is associated with the permission filter condition in the permission filter condition.

[0031] The permission filter condition configured for each data set is collected.

[0032] Each permission filter condition is encapsulated into a corresponding permission template, and the permission template is stored in a permission template center.

[0033] In another aspect of the present application, a BI data visibility permission management system for implementing the BI data visibility permission management method is provided, comprising:

[0034] A permission filter construction module for constructing a permission filter condition and configuring the permission filter condition on a data set;

[0035] A user association module for associating the user attribute of the data set with the permission filter condition in the permission filter condition, so as to distinguish the visibility of the same data on the data set by different users;

[0036] A query module for inputting query information when a user queries the data set, and obtaining the user group to which the user belongs according to the input query information;

[0037] A return module for querying the data associated with the user attribute of the user group according to the permission filter condition and returning the data to the user.

[0038] As an optional implementation of the present application, the system further comprises:

[0039] An encapsulation module for encapsulating each permission filter condition into a corresponding permission template, and sending the permission template to a permission template center;

[0040] A permission template center for storing the permission template.

[0041] In another aspect of the present application, an electronic device is also provided, comprising:

[0042] A processor;

[0043] A memory for storing processor executable instructions;

[0044] Wherein, the processor is configured to implement the BI data visibility permission management method when executing the executable instructions.

[0045] Technical effects of the present application:

[0046] The application realizes that different users see different data contents on the same data source, that is, guarantees business data security, and realizes sharing of data source and report by different users, and greatly reduces development amount of BI system data source and report. By introducing macro definition of user attribute in judgment condition, batch authorization of user group with a certain label can be realized flexibly, and flexibility of data distribution and batch operation according to user or user group is realized.

[0047] Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present disclosure and serve to explain the principles of the present disclosure.

[0049] Figure 1 An implementation flowchart of the present application is shown;

[0050] Figure 2 An application permission configuration page of the present application is shown;

[0051] Figure 3 A page for creating permission filtering rules by SQL of the present application is shown;

[0052] Figure 4 A page for creating permission filtering rules by UI page of the present application is shown;

[0053] Figure 5 A user query data logic diagram of the present application is shown;

[0054] Figure 6 A permission inheritance logic diagram of the present application is shown;

[0055] Figure 7 A permission template storage diagram of the present application is shown;

[0056] Figure 8 An application diagram of the electronic device of the present application is shown. DETAILED DESCRIPTION

[0057] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numbers in the drawings represent the same or similar elements. Although various aspects of the embodiments are shown in the drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

[0058] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0059] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0060] Example 1

[0061] like Figure 1 As shown, this application proposes a BI data visibility permission management method, including the following steps:

[0062] S1. Construct permission filtering conditions and configure them on the dataset;

[0063] S2. In the permission filtering conditions, the user attributes of the dataset are associated with the permission filtering conditions to distinguish the visibility of different users to the same data on the dataset.

[0064] S3. When a user queries the dataset, the user enters query information, and the user group to which the user belongs is obtained based on the entered query information;

[0065] S4. Based on the permission filtering conditions, query the data associated with the user attributes of the user group and return it to the user.

[0066] This solution mainly introduces macro definitions of user attributes into the judgment conditions, which can flexibly realize batch authorization for user groups with a certain tag.

[0067] Specifically, by defining a set of permission filtering conditions related to user identity and attributes on the dataset, the visibility of the same data to different users can be differentiated. This allows different users to see different data content on the same data source, ensuring business data security and enabling different users to share data sources and reports, significantly reducing the development workload of data sources and reports in the BI system. By introducing macro definitions of user attributes into the decision conditions, batch authorization for user groups with a certain tag can be flexibly implemented.

[0068] The following description will be provided in conjunction with the attached diagram of the access control system.

[0069] As an optional implementation of this application, the permission filtering conditions may optionally include:

[0070] Row condition, used to set the visible permission rule of row data, to determine which row data meeting the row condition is visible to the first user;

[0071] Column condition, used to set the invisible permission rule of column data, to determine which column data meeting the column condition is invisible to the second user.

[0072] As shown in Figure 2 The permission filter condition is divided into row condition and column condition. The row condition is which rows meeting the condition are visible to the user; on the contrary, the column condition is which columns meeting the condition are invisible to the user.

[0073] For example, there are "order ID", "order date", "order channel", "order amount", "actual payment amount" and "discount amount" and other information on the order details table. A user can be set to invisible to "actual payment amount" and "discount amount", that is, the remaining information is visible.

[0074] For another example, for the national region sales table, there is a "region" field in the table and all the data of all regions in the country are collected. For the sales managers of each region of the company, they should only have the permission to view the data of the region they are responsible for. It can be determined that the user can view the row data by determining whether the [region] attribute of the user contains the content of the "region" field of the current row.

[0075] In this embodiment, the determination condition of the visibility or invisibility of the data of the row and column can be arranged according to the requirements of the row and column. According to the row condition or the column condition, the visible and invisible permission configuration of different data is realized.

[0076] As an optional embodiment of the present application, the construction method of the permission filter condition comprises:

[0077] The and / or-not combination of the permission filter condition is completed through the UI, and the corresponding condition tree is obtained by recursive splicing;

[0078] and,

[0079] The user attribute in the permission filter condition is replaced by writing SQL program;

[0080] The replaced user attribute and the condition tree are merged into a condition tree, and returned to the background administrator.

[0081] As shown in Figure 3As shown, by the way of editing formula through SQL, the user (technician) can complete the and or not combination of the permission filtering condition through the UI, and replace the user attribute in the condition in combination with the way of writing SQL. In the figure, [CURRENT_USER. Region] is the [Region] attribute representing the current user, which can be referenced in the judgment condition. By judging the inclusion relation or whether equal of the attribute to a field on the data row, it is determined whether the current query hits the data row.

[0082] As shown in FIG. 1, the system supports the combination of and, or and not of the filtering condition through the UI, and the construction of the permission filtering condition through the free mode of writing SQL. Figure 4 As shown in FIG. 1, the system supports the combination of and, or and not of the filtering condition through the UI, and the construction of the permission filtering condition through the free mode of writing SQL.

[0083] The construction of the permission filtering condition is completed through the way of checking the configuration through the UI. Multiple conditions can be combined into complex judgment logic through and, or and not logical operators. The permission filtering condition is divided into row condition and column condition, which can be set respectively or simultaneously. By introducing the macro definition of the user attribute in the judgment condition, the batch authorization of the user group with a certain label can be flexibly realized.

[0084] As an optional embodiment of the present application, the user attribute of the data set is associated with the permission filtering condition in the permission filtering condition, including:

[0085] Setting the macro definition of the user attribute: user / user group;

[0086] In the permission filtering condition, the macro definition of the user attribute is introduced, including:

[0087] In the row condition, the macro definition of the user attribute is introduced;

[0088] In the column condition, the macro definition of the user attribute is introduced;

[0089] When the user attribute of the user group meets the macro definition of the user attribute, the batch authorization operation of the user group meeting the macro definition of the user attribute is realized through the row condition or the column condition.

[0090] By introducing the macro definition of the user attribute in the judgment condition, the batch authorization of the user group with a certain label can be flexibly realized.

[0091] In combination with the accompanying drawings, Figure 2 As shown in FIG. 1, the macro definition of the user attribute: associated user / user group is introduced in the row condition and the column condition.

[0092] When setting the row or column conditions, corresponding permission conditions and "invisibility permissions" can be set for associated users / user groups, such as... Figure 2 In the column permissions settings, there is a setting for invisible permissions for associated users / user groups. This is specifically achieved by configuring the "Invisible Fields" option within the invisible permissions settings. When filtering user attribute permissions, the system determines whether the query matches a specific row of data by checking if the attribute contains or is equal to a certain field in that row.

[0093] like Figure 5 As shown, after setting the macro definition for importing user groups, data can be queried based on the set permission filtering conditions, the user-input query information can be retrieved, the user group mentioned by the user can be obtained from the query information, all permission settings on the dataset can be retrieved, and related queries can be performed to obtain the row rules or column rules associated with the user group. The query is then performed according to the condition tree and the corresponding data is returned. For example, the query logic is based on row conditions.

[0094] This solution also sets rules for parent-child permissions.

[0095] As an optional implementation of this application, when introducing the macro definition of the user attribute, it may also include:

[0096] Create parent and child user groups with hierarchical access permissions;

[0097] Set the child user group to inherit the data visibility or invisibility permissions of the parent user group in the row condition or the column condition.

[0098] like Figure 6 As shown, the visibility of a user to a dataset column is determined by the rule of "visible unless prohibited". Subgroups inherit prohibited items from their parent groups, while users inherit visible items from their groups.

[0099] It mainly includes the inheritance of row permissions in the horizontal direction and the inheritance of column permissions in the vertical direction.

[0100] In a vertically arranged group, user groups represent parent and child user groups from top to bottom. Child user groups inherit the "disabled" columns from their parent user groups. Therefore, the invisible columns of a child user group are the union of the prohibited content of all parent user groups and the user's own prohibited content. In a horizontally arranged group, user groups represent multiple user groups to which a user belongs. For a user, their invisible columns are the intersection of the prohibited content of all user groups, and then the union of the prohibited content of the user's own group and the user's own prohibited content.

[0101] As an optional implementation of the present application, the user attribute of the data set is associated with the permission filter condition in the permission filter condition, and the method further comprises:

[0102] Collecting the permission filter condition configured for each data set;

[0103] Packaging each permission filter condition into a corresponding permission template, and storing the permission template in a permission template center.

[0104] As shown in Figure 7 The permission filter condition can be stored as a template, and multiple data sets can be configured to share the same permission filter condition by sharing the template.

[0105] The permission template is an encapsulation of the above-described row-column permission configuration independent of the data set, and its significance is that a group of row-column permission configurations can be reused by different data sets to achieve rapid development.

[0106] The creation of the permission template and the setting on the data set are the same, and the difference lies in that the field name is manually input rather than selected from the data. After the permission template is created, it is stored in the permission template center, and multiple data sets can simultaneously refer to the same template.

[0107] Obviously, those skilled in the art should understand that all or part of the processes in the above embodiments can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium. The program can include the processes of the above-mentioned embodiments when executed. Those skilled in the art can understand that all or part of the processes in the above embodiments can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium. The program can include the processes of the above-mentioned embodiments when executed. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0108] Embodiment 2

[0109] Based on the implementation principle of embodiment 1, in another aspect of the present application, a BI data visibility permission management system for implementing the BI data visibility permission management method is provided, comprising:

[0110] a permission filter construction module, configured to construct permission filter conditions and configure the permission filter conditions on the data set;

[0111] a user association module, configured to associate user attributes of the data set with the permission filter conditions in the permission filter conditions, so as to distinguish the visibility of the same data on the data set by different users;

[0112] a query module, configured to input query information when a user queries the data set, and acquire a user group to which the user belongs according to the input query information;

[0113] a return module, configured to query data associated with user attributes of the user group according to the permission filter conditions and return the data to the user.

[0114] As an optional embodiment of the present application, optionally, the present application further comprises:

[0115] a packaging module, configured to package each of the permission filter conditions into a corresponding permission template, and send the permission template to a permission template center;

[0116] a permission template center, configured to store the permission template.

[0117] The modules or steps of the present application described above can be realized by a general computing device, which can be centralized on a single computing device or distributed on a network composed of multiple computing devices. Optionally, the modules or steps can be realized by program codes executable by a computing device, so that the modules or steps can be stored in a storage device and executed by the computing device, or the modules or steps can be respectively manufactured into individual integrated circuit modules, or multiple modules or steps among them can be manufactured into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.

[0118] Embodiment 3

[0119] As shown in Figure 8 Further, another aspect of the present application further provides an electronic device, comprising:

[0120] a processor;

[0121] a memory for storing processor-executable instructions;

[0122] wherein the processor is configured to implement the BI data visibility permission management method when executing the executable instructions.

[0123] The electronic device according to the embodiments of the present disclosure comprises a processor and a memory for storing processor-executable instructions. Wherein the processor is configured to implement the BI data visibility permission management method when executing the executable instructions.

[0124] It should be pointed out here that the number of processors can be one or more. Meanwhile, the electronic device in the embodiments of the present disclosure can also include input devices and output devices. Among them, the processor, the memory, the input device and the output device can be connected through the bus, or can be connected through other ways, which is not limited here.

[0125] The memory, as a computer readable storage medium, can be used to store software programs, computer executable programs and various modules, such as programs or modules corresponding to the BI data visibility permission management method of the embodiments of the present disclosure. The processor executes the software programs or modules stored in the memory, thereby performing various function applications and data processing of the electronic device.

[0126] The input device can be used to receive input numbers or signals. Among them, the signal can be a key signal related to the user settings and function control of the device / terminal / server. The output device can include display devices such as display screens.

[0127] The above has described the embodiments of the present disclosure, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes are obvious to those skilled in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, practical application or technical improvement to the technology in the market, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. A method for managing BI data visibility permissions, characterized in that, Includes the following steps: Construct permission filtering conditions and configure them on the dataset. The permission filtering conditions include: Row conditions are used to set the visibility permission rules for row data, and to determine whether row data that meets the row conditions is visible to the first user. Column conditions are used to set the visibility permission rules for column data, determining that column data that meets the column conditions is not visible to the second user; In the permission filtering conditions, user attributes of the dataset are associated with the permission filtering conditions to distinguish the visibility of the same data on the dataset for different users. This allows different users to see different data content on the same data source, enabling different users to share data sources and reports, including: Macros that define user attributes: associated user / user group; The permission filtering conditions include macro definitions for the user attributes, including: In the row condition, a macro definition of the user attribute is introduced; In the column conditions, a macro definition of the user attribute is introduced; When the user attributes of a user group meet the macro definition of the user attributes, batch authorization operations are performed on the user group that meets the macro definition of the user attributes through the row conditions and / or the column conditions. Specifically: when setting the row conditions and / or the column conditions, corresponding permission conditions and / or invisible permissions are set for the associated users / user groups. Specifically, invisible permissions are set by configuring the invisible field in the invisible permissions. When filtering user attribute permissions, the inclusion relationship or equality of the attribute with a certain field on the data row is judged to determine whether the current query hits the data of that row. When a user queries the dataset, the user enters query information, and based on the entered query information, the user group to which the user belongs is obtained, and all permission settings on the dataset are obtained. Related queries are performed to obtain the row rules or column rules associated with the user group, and the query is performed according to the condition tree and the corresponding data is returned. Based on the permission filtering conditions, query the data associated with the user attributes of the user group and return it to the user.

2. The BI data visibility permission management method according to claim 1, characterized in that, The method for constructing the permission filtering conditions includes: The user interface is used to perform AND, OR, and NOT combinations of the permission filtering conditions, and the corresponding condition tree is obtained by recursively concatenating them. as well as, By writing an SQL program, the user attributes in the permission filtering conditions are replaced; Merge the replaced user attributes and condition trees into a single condition tree and return it to the backend administrator.

3. The BI data visibility permission management method according to claim 1, characterized in that, When introducing the macro definition of the aforementioned user attribute, it also includes: Create parent and child user groups with hierarchical access permissions; Set the child user group to inherit the data visibility or invisibility permissions of the parent user group in the row condition or the column condition.

4. The BI data visibility permission management method according to claim 1, characterized in that, In the permission filtering conditions, after associating the user attributes of the dataset with the permission filtering conditions, the following is also included: Collect the permission filtering conditions configured for each of the datasets; Each of the permission filtering conditions is encapsulated into a corresponding permission template, and the permission template is stored in the permission template center.

5. A BI data visibility permission management system that implements the BI data visibility permission management method according to any one of claims 1-4, characterized in that, include: The permission filtering module is used to build permission filtering conditions and configure them on the dataset. The user association module is used to associate the user attributes of the dataset with the permission filtering conditions in the permission filtering conditions, so as to distinguish the visibility of different users to the same data on the dataset. The query module is used to input query information when a user queries the dataset, and to obtain the user group to which the user belongs based on the input query information; The return module is used to query data associated with the user attributes of the user group based on the permission filtering conditions and return it to the user.

6. The BI data visibility permission management system according to claim 5, characterized in that, Also includes: The encapsulation module is used to encapsulate each of the permission filtering conditions into a corresponding permission template, and send the permission template to the permission template center; The permission template center is used to store the permission templates.

7. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to implement the BI data visibility permission management method according to any one of claims 1-4 when executing the executable instructions.

Images