A method, system, device and storage medium for data authority management

Abstract

The application provides a data authority management method, system, device and storage medium, the method comprises the following steps: configuring global data authority and function data authority; configuring global data authority or function data authority for each function, and configuring corresponding function and data authority inheritance authority for each post; in response to acquiring data authority in a function and the function being configured with global data authority, searching for all posts assigned with the function and acquiring global data authority on all the posts; in response to acquiring data authority in a function and the function being configured with function data authority, searching for all posts assigned with the function and determining whether to acquire global data authority or function data authority on the post according to whether the data authority is associated with global data authority and the data authority inheritance authority. The application can flexibly set user authority, is suitable for the case that the authority configuration scene is multiple and the configuration is complex, and can realize the configuration of authority at the minimum cost.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a method, system, device, and storage medium for data access control. Background Technology

[0002] Many mainstream access control systems are based on the RBAC (Role-Based Access Control) model. Assigning resource permissions to roles means that for the same resource, if users have different permissions in different modules, a new permission resource needs to be created. This means that permission configuration can only be done based on the granularity of the permission resource itself, and cannot be determined by the user configuring permissions. This places higher demands on access control within the system, and how to develop a stable and flexible model to meet the diverse permission management needs of users is a problem worthy of research. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a method, system, electronic device, and computer-readable storage medium for data permission management. This invention divides permissions into two types: global data permissions and functional data permissions. The combination of global data permissions and functional data permissions can solve the problem of different levels of granularity in permission control for users in different positions. It can provide flexible user permission settings and is particularly suitable for large group enterprises with many permission configuration scenarios and complex configurations. It can achieve permission configuration with minimal implementation cost.

[0004] To achieve the above objectives, one aspect of this invention provides a method for data permission management, comprising the following steps: configuring global data permissions and functional data permissions; configuring global data permissions or functional data permissions for each function, and configuring corresponding functional and data permission inheritance permissions for each position; in response to obtaining data permissions within a function and the function being configured with global data permissions, searching all positions assigned to the function, and obtaining global data permissions on all positions; and in response to obtaining data permissions within a function and the function being configured with functional data permissions, searching all positions assigned to the function, and determining whether to obtain global data permissions or functional data permissions on the position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0005] In some implementations, the steps of configuring global data permissions and functional data permissions include: configuring a resource table, permission value column, and permission allocation display column for global data permissions; and configuring a resource table, permission value column, permission allocation display column, scope of application of functions, whether associated with global permissions, and association relationship column with global permissions for functional data permissions.

[0006] In some implementations, the step of configuring corresponding functions and data permissions for each position includes: configuring the function scope, global permissions, and whether data permissions for each position inherit global permissions.

[0007] In some implementations, the step of configuring corresponding functions and data permission inheritance permissions for each position includes: in response to multiple functions with the same data permissions being assigned to the same position, configuring function data permission inheritance business organization permissions on the same position, or configuring data permissions separately for each function.

[0008] In some implementations, the steps of configuring the functional scope, global permissions, and data permissions of each position and whether they inherit global permissions include: dividing positions into general organizational positions and single organizational positions; in response to assigning users to general organizational positions, specifying the applicable business organization scope of the users, and writing the correspondence between general organizational positions, users, and business organizations into a correspondence table of positions, business organizations, and users; in response to assigning users to single organizational positions, writing the correspondence between single organizational positions and users into a correspondence table of positions, business organizations, and users, thus completing the user's permission configuration.

[0009] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a specific job based on whether data permissions are associated with global data permissions and the data permission inheritance permissions includes: in response to data permissions being associated with global data permissions, determining whether to obtain global data permissions or functional data permissions for a specific job based on the data permission inheritance permissions; in response to data permissions not being associated with global data permissions, directly obtaining functional data permissions for a specific job.

[0010] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a position based on the data permission inheritance permissions includes: obtaining global data permissions for the position in response to the position having set functional data permission inheritance global data permissions; and obtaining functional data permissions for the position in response to the position not having set functional data permission inheritance global data permissions.

[0011] In another aspect, this invention provides a data permission management system, comprising: a configuration module for configuring global data permissions and functional data permissions; a permission module for configuring global data permissions or functional data permissions for each function, and configuring corresponding functional and data permission inheritance permissions for each position; a first execution module for, in response to obtaining data permissions within a function and the function being configured with global data permissions, searching all positions assigned to the function, and obtaining global data permissions on all positions; and a second execution module for, in response to obtaining data permissions within a function and the function being configured with functional data permissions, searching all positions assigned to the function, and determining whether to obtain global data permissions or functional data permissions on the position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0012] In another aspect of the present invention, an electronic device is provided, comprising: at least one processor; and a memory storing computer instructions executable on the processor, the instructions, when executed by the processor, implementing the steps of the method described above.

[0013] In another aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps.

[0014] The present invention has the following beneficial technical effects: by dividing permissions into two types, global data permissions and functional data permissions, the combination of global data permissions and functional data permissions can solve the problem of different levels of coarseness and fineness of permission control for users in different positions, and can provide flexible user permission settings. It is particularly suitable for large group enterprises with many permission configuration scenarios and complex configurations, and can realize permission configuration with minimal implementation cost. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic diagram illustrating an embodiment of the data access control method provided by the present invention;

[0017] Figure 2 A flowchart for obtaining data permissions provided by the present invention;

[0018] Figure 3A schematic diagram of an embodiment of the data access control system provided by the present invention;

[0019] Figure 4 A schematic diagram of the hardware structure of an embodiment of the electronic device for data access control provided by the present invention;

[0020] Figure 5 A schematic diagram illustrating an embodiment of a computer storage medium for data access control provided by the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0022] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities or parameters with the same name but different names. It is clear that "first" and "second" are only for the convenience of expression and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0023] In a first aspect, an embodiment of a data access control method is proposed. Figure 1 The diagram shown is an embodiment of the data access control method provided by the present invention.

[0024] like Figure 1 As shown, the embodiments of the present invention include the following steps:

[0025] S1. Configure global data permissions and functional data permissions;

[0026] S2. Configure global data permissions or functional data permissions for each function, and configure corresponding functional and data permission inheritance permissions for each position;

[0027] S3. In response to obtaining data permissions within a function and the function being configured with global data permissions, locate all positions assigned to the function and obtain the global data permissions for all positions; and

[0028] S4. In response to obtaining data permissions within a function and the function being configured with function data permissions, search all positions that have been assigned the function, and determine whether to obtain global data permissions or function data permissions for a position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0029] Figure 2 The flowchart for obtaining data permissions provided by this invention, in conjunction with Figure 2 The embodiments of the present invention will be described.

[0030] Configure global data permissions and functional data permissions.

[0031] In some implementations, the steps of configuring global data permissions and functional data permissions include: configuring a resource table, permission value column, and permission allocation display column for global data permissions; and configuring a resource table, permission value column, permission allocation display column, scope of application of functions, whether associated with global permissions, and association relationship column with global permissions for functional data permissions.

[0032] Define global permission resource object information: resource table, permission value column, and permission allocation display column. The resource table describes the resources that data permissions need to control; the permission value column describes the associated columns of the resource table that are permissions; the permission allocation display column describes the data content columns that are visible to the user when global data permissions are assigned.

[0033] Define the resource object information for functional permissions: resource table, permission value column, permission allocation display column, scope of application, whether it is associated with global permissions, and the column indicating its association with global permissions. The resource table describes the resources that the data permissions control; the permission value column describes the associated columns in the resource table that represent permissions; the permission allocation display column describes the data content visible to the user when global data permissions are assigned; the scope of application describes the functions that the data permissions can apply to; whether it is associated with global permissions describes whether it is associated with global data permissions during allocation; the column indicating its association with global permissions describes the column in the resource table whose value matches the value of the global data permission if it is associated with global data permissions during allocation.

[0034] Configure global data permissions or functional data permissions for each function, and configure corresponding functional and data permission inheritance permissions for each position.

[0035] In some implementations, the step of configuring corresponding functional and data permission inheritance permissions for each position includes: configuring the functional scope, global permissions, and whether data permissions inherit from global permissions for each position. The functional scope describes the scope of job responsibilities, representing the accessible functions; global permissions describe the scope of resources accessible to the position; whether data permissions inherit from global data permissions describes the functional data permissions associated with global data permissions, which can be used directly or configured separately.

[0036] In some implementations, the step of configuring corresponding functions and data permission inheritance permissions for each position includes: in response to multiple functions with the same data permissions being assigned to the same position, configuring function data permission inheritance business organization permissions on the same position, or configuring data permissions separately for each function.

[0037] In some implementations, the steps of configuring the functional scope, global permissions, and data permissions of each position and whether they inherit global permissions include: dividing positions into general organizational positions and single organizational positions; in response to assigning users to general organizational positions, specifying the applicable business organization scope of the users, and writing the correspondence between general organizational positions, users, and business organizations into a correspondence table of positions, business organizations, and users; in response to assigning users to single organizational positions, writing the correspondence between single organizational positions and users into a correspondence table of positions, business organizations, and users, thus completing the user's permission configuration.

[0038] Coarse-grained permission partitioning scenarios: There are few job roles, multiple functions are concentrated in one role, functions use global data permissions, or the role is directly configured with "function data permissions automatically inherit business organization permissions".

[0039] Fine-grained permission partitioning scenario: There are many job roles, and functions with the same data permissions are grouped together into one job role. Job roles can be configured to "automatically inherit business organization permissions for function data permissions," or data permissions can be configured individually for each function within a single job role.

[0040] In response to obtaining data permissions within a function and the function being configured with global data permissions, all positions that have been assigned to the function are located, and the global data permissions for all positions are obtained.

[0041] In response to the requirement to obtain data permissions within a function and the function being configured with function data permissions, all positions assigned to the function are located, and the system determines whether to obtain global data permissions or function data permissions for a position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0042] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a specific job based on whether data permissions are associated with global data permissions and the data permission inheritance permissions includes: in response to data permissions being associated with global data permissions, determining whether to obtain global data permissions or functional data permissions for a specific job based on the data permission inheritance permissions; in response to data permissions not being associated with global data permissions, directly obtaining functional data permissions for a specific job.

[0043] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a position based on the data permission inheritance permissions includes: obtaining global data permissions for the position in response to the position having set functional data permission inheritance global data permissions; and obtaining functional data permissions for the position in response to the position not having set functional data permission inheritance global data permissions.

[0044] If the function is configured to use global data permissions, then search for all positions that have been assigned the corresponding function by user to obtain the global data permissions. If the function is configured to use function data permissions, then confirm whether the data permissions are associated with the global data permissions: if they are associated, search for all positions that have been assigned the corresponding function; if the position has "function data permissions inherit global data permissions" set, then directly obtain the global data permissions of the position; if the position has not set "function data permissions inherit global data permissions", then obtain the function data permissions of the position; if they are not associated, directly obtain the function data permissions of the positions that have been assigned the corresponding function.

[0045] It should be noted that the steps in each embodiment of the above-mentioned data access control method can be interleaved, substituted, added, or deleted. Therefore, these reasonable permutations and combinations of the data access control method should also fall within the protection scope of this invention, and the protection scope of this invention should not be limited to the embodiments.

[0046] Based on the above objectives, a second aspect of the present invention provides a data access control system. For example... Figure 3 As shown, system 200 includes the following modules: a configuration module for configuring global data permissions and functional data permissions; a permission module for configuring global data permissions or functional data permissions for each function, and configuring corresponding functional and data permission inheritance permissions for each position; a first execution module for, in response to obtaining data permissions within a function and the function being configured with global data permissions, searching for all positions assigned to the function, and obtaining global data permissions on all positions; and a second execution module for, in response to obtaining data permissions within a function and the function being configured with functional data permissions, searching for all positions assigned to the function, and determining whether to obtain global data permissions or functional data permissions on the position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0047] In some implementations, the configuration module is also used to: configure the resource table, permission value column, and permission allocation display column for global data permissions; and configure the resource table, permission value column, permission allocation display column, function scope, whether it is associated with global permissions, and the association relationship column with global permissions for functional data permissions.

[0048] In some implementations, the permission module is also used to: configure the functional scope, global permissions, and whether data permissions for each position inherit from global permissions.

[0049] In some implementations, the permission module is also used to: in response to multiple functions with the same data permissions being assigned to the same position, configure the function data permissions to inherit the business organization permissions on the same position, or configure data permissions separately for each function.

[0050] In some implementations, the permission module is further configured to: divide positions into general organizational positions and single organizational positions; in response to assigning users to general organizational positions, specify the applicable business organization scope of the users, and write the correspondence between general organizational positions, users, and business organizations into a correspondence table of positions, business organizations, and users; in response to assigning users to single organizational positions, write the correspondence between single organizational positions and users into a correspondence table of positions, business organizations, and users, thereby completing the user's permission configuration.

[0051] In some implementations, the second execution module is further configured to: in response to the association between data permissions and global data permissions, determine whether to obtain global data permissions or functional data permissions for a specific job based on the data permission inheritance permissions; and in response to the fact that data permissions and global data permissions are not associated, directly obtain functional data permissions for a specific job.

[0052] In some implementations, the second execution module is further configured to: acquire global data permissions on the job if the job has set functional data permissions to inherit global data permissions; and acquire functional data permissions on the job if the job has not set functional data permissions to inherit global data permissions.

[0053] Based on the above objectives, a third aspect of the present invention provides an electronic device, comprising: at least one processor; and a memory storing computer instructions executable on the processor, the instructions being executed by the processor to perform the following steps: S1, configuring global data permissions and functional data permissions; S2, configuring global data permissions or functional data permissions for each function, and configuring corresponding functional and data permission inheritance permissions for each job position; S3, in response to obtaining data permissions within a function and the function being configured with global data permissions, searching all jobs assigned to the function, and obtaining global data permissions on all jobs; and S4, in response to obtaining data permissions within a function and the function being configured with functional data permissions, searching all jobs assigned to the function, and determining whether to obtain global data permissions or functional data permissions on the job position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions.

[0054] In some implementations, the steps of configuring global data permissions and functional data permissions include: configuring a resource table, permission value column, and permission allocation display column for global data permissions; and configuring a resource table, permission value column, permission allocation display column, scope of application of functions, whether associated with global permissions, and association relationship column with global permissions for functional data permissions.

[0055] In some implementations, the step of configuring corresponding functions and data permissions for each position includes: configuring the function scope, global permissions, and whether data permissions for each position inherit global permissions.

[0056] In some implementations, the step of configuring corresponding functions and data permission inheritance permissions for each position includes: in response to multiple functions with the same data permissions being assigned to the same position, configuring function data permission inheritance business organization permissions on the same position, or configuring data permissions separately for each function.

[0057] In some implementations, the steps of configuring the functional scope, global permissions, and data permissions of each position and whether they inherit global permissions include: dividing positions into general organizational positions and single organizational positions; in response to assigning users to general organizational positions, specifying the applicable business organization scope of the users, and writing the correspondence between general organizational positions, users, and business organizations into a correspondence table of positions, business organizations, and users; in response to assigning users to single organizational positions, writing the correspondence between single organizational positions and users into a correspondence table of positions, business organizations, and users, thus completing the user's permission configuration.

[0058] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a specific job based on whether data permissions are associated with global data permissions and the data permission inheritance permissions includes: in response to data permissions being associated with global data permissions, determining whether to obtain global data permissions or functional data permissions for a specific job based on the data permission inheritance permissions; in response to data permissions not being associated with global data permissions, directly obtaining functional data permissions for a specific job.

[0059] In some implementations, the step of determining whether to obtain global data permissions or functional data permissions for a position based on the data permission inheritance permissions includes: obtaining global data permissions for the position in response to the position having set functional data permission inheritance global data permissions; and obtaining functional data permissions for the position in response to the position not having set functional data permission inheritance global data permissions.

[0060] like Figure 4 The diagram shown is a hardware structure schematic of an embodiment of the electronic device for data access control provided by the present invention.

[0061] For example Figure 4 Taking the device shown as an example, the device includes a processor 301 and a memory 302.

[0062] Processor 301 and memory 302 can be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0063] The memory 302, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions / modules corresponding to the data access control method in this embodiment. The processor 301 executes various server functions and data processing by running the non-volatile software programs, instructions, and modules stored in the memory 302, thereby implementing the data access control method.

[0064] The memory 302 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by usage according to data access control methods. Furthermore, the memory 302 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 302 may optionally include memory remotely located relative to the processor 301, and these remote memories can be connected to the local module via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0065] One or more data access control methods are stored in memory 302. When executed by processor 301, the data access control method in any of the above method embodiments is executed.

[0066] Any embodiment of an electronic device that performs the above-described data access control method can achieve the same or similar effects as any of the aforementioned method embodiments.

[0067] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs a method for data access control.

[0068] like Figure 5 The diagram shown is a schematic representation of an embodiment of the computer storage medium for data access control provided by the present invention. Figure 5 Taking the computer storage medium shown as an example, the computer-readable storage medium 401 stores a computer program 402 that, when executed by a processor, performs the above method.

[0069] Finally, it should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program for the data access control method can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The storage medium for the program can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. The above computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

[0070] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0071] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0072] The embodiment numbers disclosed in the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0073] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0074] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for data access control, characterized in that, Includes the following steps: Configure global data permissions and functional data permissions; Configure global data permissions or functional data permissions for each function, and configure corresponding functional and data permission inheritance permissions for each position; In response to obtaining data permissions within a function and the function being configured with global data permissions, find all positions that have been assigned the function and obtain the global data permissions for all positions. as well as In response to the requirement to obtain data permissions within a function and the function being configured with function data permissions, all positions that have been assigned to the function are located, and the determination is made based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions to obtain global data permissions or function data permissions for the position. The steps for configuring global data permissions and functional data permissions include: Configure the resource table for global data permissions, the permission value column, and the permission allocation display column; and Configure the resource table for function data permissions, permission value column, permission allocation display column, function scope, whether it is associated with global permissions, and the relationship column with global permissions; Configure global data permissions or functional data permissions for each function, and configure corresponding functional and data permission inheritance permissions for each job position, including: Configure the functional scope, global permissions, and data permissions of each position, and determine whether they inherit global permissions. Determining whether to acquire global data permissions or functional data permissions for a specific role depends on whether data permissions are associated with global data permissions and the data permission inheritance permissions. In response to the association between data permissions and global data permissions, determine whether to obtain global data permissions or functional data permissions for a specific role based on the data permission inheritance permissions. Since data permissions are not associated with global data permissions, they directly obtain the functional data permissions specific to the job role.

2. The data access control method according to claim 1, characterized in that, The steps for configuring corresponding functions and data permissions and inheritance permissions for each position include: In response to the assignment of multiple functions with the same data permissions to the same job position, the function data permissions can be configured to inherit the business organization permissions on the same job position, or data permissions can be configured separately for each function.

3. The data access control method according to claim 1, characterized in that, The steps for configuring the functional scope, global permissions, and data permissions of each position, and whether to inherit global permissions, include: The positions are divided into general organizational positions and single organizational positions; In response to assigning users to general organizational positions, the applicable scope of business organizations for users is specified, and the correspondence between general organizational positions, users, and business organizations is written into the correspondence table of positions, business organizations, and users. In response to assigning users to a single organizational position, the mapping relationship between the single organizational position and the user is written into the mapping relationship table of the position, business organization, and user, thus completing the user's permission configuration.

4. The data access control method according to claim 1, characterized in that, The step of determining whether to obtain global data permissions or functional data permissions for a position based on the data permission inheritance permissions includes: In response to the fact that the job position has set functional data permissions that inherit global data permissions, the global data permissions on the job position are obtained; and In response to the fact that the position has not set functional data permissions to inherit global data permissions, the functional data permissions of the position are obtained.

5. A data access control system, characterized in that, include: The configuration module is used to configure global data permissions and functional data permissions; The permissions module is used to configure global data permissions or functional data permissions for each function, and to configure corresponding functional and data permission inheritance permissions for each position. The first execution module is used to, in response to the requirement of obtaining data permissions within a function and the function being configured with global data permissions, locate all positions that have been assigned to the function and obtain the global data permissions for all positions. as well as The second execution module is used to respond to the requirement of obtaining data permissions within a function and the function being configured with function data permissions, to search for all positions that have been assigned the function, and to determine whether to obtain global data permissions or function data permissions for a position based on whether the data permissions are associated with global data permissions and the data permission inheritance permissions. The configuration module is also used for: Configure the resource table for global data permissions, the permission value column, and the permission allocation display column; and Configure the resource table for function data permissions, permission value column, permission allocation display column, function scope, whether it is associated with global permissions, and the relationship column with global permissions; The permissions module is also used for: Configure the functional scope, global permissions, and data permissions of each position, and determine whether they inherit global permissions. The second execution module is also used for: In response to the association between data permissions and global data permissions, determine whether to obtain global data permissions or functional data permissions for a specific role based on the data permission inheritance permissions. Since data permissions are not associated with global data permissions, they directly obtain the functional data permissions specific to the job role.

6. An electronic device, characterized in that, include: At least one processor; as well as A memory storing computer instructions executable on the processor, which, when executed by the processor, implement the steps of the method according to any one of claims 1-4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-4.

Images