Permission management method, device, terminal device, storage medium and computer program product

Abstract

The present application discloses a permission management method, apparatus, terminal device, storage medium and computer program product, which relate to the field of permission management technology. The method comprises: analyzing the group structure corresponding to the group management terminal to obtain comprehensive permission management rules; and performing permission management on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive permission management rules. Thus, the group structure of the actual group is analyzed to obtain comprehensive permission management rules for permission management, and permission management is performed on the configuration data in the group configuration and the business data in the group business system based on the comprehensive permission management rules, thereby solving the problem that group enterprises cannot flexibly manage data permissions and improving the efficiency of permission management.

Description

Technical Field

[0001] The present application relates to the technical field of permission management, and in particular to a permission management method, apparatus, terminal device, storage medium, and computer program product. Background Art

[0002] Different digital products for group enterprises, such as human resources services, payment on behalf of others, financial expense control, etc., have various business implementations, which also generate a variety of configuration data (business lines, reimbursement policies, expense forms, etc.) and business data (incoming orders, reimbursement orders, expenses, orders, etc.).

[0003] For group enterprises with multiple legal entities, multiple organizations, and multiple dimensions, while ensuring the security of configuration data and business data, permission control also needs to adapt to the diverse management configurations of the group enterprises and ensure high availability of the system.

[0004] Currently, the permission management solutions of most systems mainly target business data and do not consider the diverse configuration data of group enterprises. The expansion of different management functions is time-consuming and labor-intensive, and the management performance under multi-organization configurations also has problems, making it difficult to meet the increasingly diverse permission management needs of group enterprises.

[0005] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a permission management method, apparatus, terminal device, storage medium and computer program product, aiming to solve the technical problem that group enterprises are unable to flexibly manage data permissions.

[0007] To achieve the above objectives, this application proposes a permission management method, which is applied to the group management end and includes:

[0008] Analyze the group structure corresponding to the group management end to obtain comprehensive authority control rules;

[0009] Based on the comprehensive authority management and control rules, authority management and control is performed on the configuration data in the preset group configuration system and the business data in the group business system.

[0010] In one embodiment, before the step of performing permission control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive permission control rules, the method further includes:

[0011] Analyze the group structure to obtain subsidiary information, where the subsidiary information includes one or more of department information, business information, process information, and employee information;

[0012] A group configuration system is constructed based on the department information, process information and employee information;

[0013] A group business system is constructed based on the business information.

[0014] In one embodiment, before the step of analyzing the group structure corresponding to the group management terminal to obtain comprehensive authority control rules, the method further includes:

[0015] Determine default permissions based on employee contract information of the employee information to obtain a first employee permission management rule, wherein the employee contract information includes one or more of a department and a contract type;

[0016] performing additional authority determination based on employee attribute information of the employee information to obtain a second employee authority management rule, wherein the employee attribute information includes one or more of employee position, employee job, and employee role;

[0017] Determine management authority based on the process information, department information, and business information to obtain company authority control rules;

[0018] Output comprehensive authority control rules based on the first employee authority control rules, the second employee authority control rules and the company authority control rules.

[0019] In one embodiment, after the step of performing permission control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive permission control rules, the method includes:

[0020] Output control data according to the configuration data and business data;

[0021] Monitoring the control data based on a preset control threshold;

[0022] When the control data exceeds the control threshold, redundant permissions of the corresponding employees in the group structure are cleared.

[0023] In one embodiment, the step of clearing redundant permissions of corresponding employees in the group structure includes:

[0024] Lazy loading of the employee's permission information to obtain the employee's permission data;

[0025] Based on the authority data, the preset temporary authority redundancy table authData is updated, and the authority redundancy operation of the employee is recorded in the preset authority redundancy record table authRecord;

[0026] Analyzing the employee's update authority based on the authData and authRecord, and performing a delayed update on the employee's authority information according to the update authority;

[0027] Perform threshold analysis on the employee login time recorded in the authRecord according to a preset time threshold;

[0028] When the employee login time exceeds the time threshold, redundant data in the authData is cleared.

[0029] In one embodiment, after the step of performing permission control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive permission control rules, the method further includes:

[0030] Receive data query requests;

[0031] If the data query request is a permission information query, query the authRecord based on the data query request to obtain the corresponding permission information;

[0032] If the data query request is a business data query, the group business system is queried based on the default authority of the data query request to obtain a business data table, and the corresponding business data is obtained by filtering the business data table and authRecord.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a permission control device, which is applied to a group management terminal and includes:

[0034] An analysis module is used to analyze the group structure corresponding to the group management terminal to obtain comprehensive authority control rules;

[0035] The control module is used to perform authority control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive authority control rules.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a permission management device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the permission management method described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the permission management method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the permission management method described above.

[0039] One or more technical solutions proposed in this application have at least the following technical effects:

[0040] The embodiments of the present application propose a permission management method, apparatus, device, storage medium, and computer program product, which analyze the group structure corresponding to the group management end to obtain comprehensive permission management rules; based on the comprehensive permission management rules, permission management is performed on the configuration data in the preset group configuration system and the business data in the group business system. Thus, the group structure of the actual group is analyzed to obtain comprehensive permission management rules for permission management, and based on the comprehensive permission management rules, permission management is performed on the configuration data in the group configuration system and the business data in the group business system, which solves the problem that group enterprises cannot flexibly manage permissions on data and improves the efficiency of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0043] Figure 1 A flowchart of the first embodiment of the application permission management method is provided;

[0044] Figure 2 This is an overall diagram of the group's standardized authority control method involved in this application's authority control method;

[0045] Figure 3 This is a schematic diagram of the group-level control involved in this application permission control method;

[0046] Figure 4 This is a schematic diagram of the custom permission control switch involved in this application permission control method;

[0047] Figure 5 This is a flowchart of the second embodiment of the application permission management method.

[0048] Figure 6 This is a schematic diagram of the data permission redundant synchronization logic involved in this application permission management method;

[0049] Figure 7 This is a schematic diagram of the use of redundant permissions involved in this application permission control method;

[0050] Figure 8 This is a schematic diagram of the module structure of the permission control device according to an embodiment of the present application;

[0051] Figure 9 This is a schematic diagram of the device structure of the hardware operating environment involved in the permission management method in the embodiment of this application.

[0052] The purpose, features and advantages of this application will be further explained with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] The main solution of the embodiment of the present application is: analyzing the group structure to obtain subsidiary information, the subsidiary information includes one or more of department information, business information, process information and employee information; constructing a group configuration system based on the department information, process information and employee information; constructing a group business system based on the business information. Determining default permissions based on the employee contract information of the employee information to obtain a first employee permission control rule, the employee contract information includes one or more of the department to which the employee belongs and the contract type; determining additional permissions based on the employee attribute information of the employee information to obtain a second employee permission control rule, the employee attribute information includes one or more of the employee position, employee job and employee role; determining management permissions based on the process information, department information and business information to obtain a company permission control rule; outputting comprehensive permission control rules based on the first employee permission control rule, the second employee permission control rule and the company permission control rule. Outputting control data based on the configuration data and business data; monitoring the control data based on a preset control threshold; and clearing redundant permissions of the corresponding employee in the group structure when the control data exceeds the control threshold. The system lazily loads the employee's permission information to obtain the employee's permission data; updates a preset temporary permission redundancy table, authData, based on the permission data, and records the employee's permission redundancy operation in a preset permission redundancy record table, authRecord; analyzes the employee's update permission based on authData and authRecord, and performs a delayed update of the employee's permission information based on the update permission; performs a threshold analysis on the employee login time recorded in authRecord based on a preset time threshold; and clears redundant data from authData when the employee login time exceeds the time threshold. A data query request is received; if the data query request is for permission information, the system queries authRecord based on the data query request to obtain the corresponding permission information; if the data query request is for business data, the system queries the group business system based on the default permissions of the data query request to obtain a business data table, and filters the business data table and authRecord to obtain the corresponding business data. This system solves the problem of group enterprises lacking flexible data permission control, implements permission control, and improves the efficiency of permission control.Based on the solution of the present invention, in view of the fact that most of the control solutions applied to the group authority control system in reality mainly target business data, and do not take into account the actual diverse configuration data of group enterprises, the expansion of different control functions is time-consuming and labor-intensive, and there are also problems with the control performance under multi-organization configuration, which makes it difficult to meet the increasingly diverse authority management needs of group enterprises, thereby resulting in low actual control efficiency, a permission control method is designed, and the effectiveness of the permission control method of the present invention is verified when controlling permissions. Finally, the accuracy of permission control performed by the method of the present invention is significantly improved.

[0056] In this embodiment, for ease of description, the following description is made with the permission control device as the execution entity.

[0057] Since different digital products for group enterprises in the existing technology, such as human resources services, payment on behalf of others, financial expense control, etc., have various business implementations, they will also generate a variety of configuration data (business lines, reimbursement policies, expense forms, etc.) and business data (warehouse receipts, reimbursement forms, expenses, orders, etc.). For group enterprises with multiple legal persons, multiple organizations, and multiple dimensions, while ensuring the security of configuration data and business data, permission control also needs to adapt to the diverse management configurations of group enterprises and ensure the high availability of the system. However, the permission control solutions of most systems currently focus on business data and do not consider the actual diverse configuration data of group enterprises. The expansion of different control functions is time-consuming and labor-intensive, and the control performance under multi-organization configurations also has problems. It is difficult to meet the increasingly diverse permission management needs of group enterprises, and the efficiency of permission control will also decrease.

[0058] This application provides a solution. In the group management end, a group configuration system and a group business system are constructed based on the group architecture. At the same time, the group configuration system and the group business system are controlled by using preset comprehensive authority management rules to provide users with better services.

[0059] As can be seen from the above embodiments, this application obtains comprehensive authority control rules by analyzing the group structure corresponding to the group management end; based on the comprehensive authority control rules, authority control is performed on the configuration data in the pre-built group configuration system and the business data in the group business system. Thus, by analyzing the group structure of the actual group to obtain comprehensive authority control rules for authority control, and based on the comprehensive authority control rules, authority control is performed on the configuration data in the group configuration system and the business data in the group business system, which solves the problem that group enterprises cannot flexibly control the authority of data and improves the efficiency of authority control.

[0060] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device or intention device capable of implementing the above functions. The following uses the permission control device as an example to illustrate this embodiment and the following embodiments.

[0061] Based on this, the present application embodiment provides a method for controlling permissions. Figure 1 , Figure 1 This is a flowchart of the first embodiment of the permission management method of this application.

[0062] In this embodiment, the permission control method is applied to the group management end, including steps S05 to S09:

[0063] Step S05: Analyze the group structure corresponding to the group management terminal to obtain comprehensive authority control rules;

[0064] The permission control method described in this embodiment is mainly aimed at different digital products of group enterprises, such as human resources services, payment processing, financial expense control, etc., which have various business implementations and therefore generate a variety of configuration data (business lines, reimbursement policies, expense forms, etc.) and business data (incoming orders, reimbursement orders, expenses, orders, etc.);

[0065] For multi-legal, multi-organization, and multi-dimensional group enterprises, while ensuring the security of configuration data and business data, permission control must also adapt to the diverse management configurations of the group enterprise while ensuring high system availability.

[0066] Currently, most systems' permission management solutions focus primarily on business data, without considering the diverse configuration data of group enterprises. Expanding diverse control functions is time-consuming and labor-intensive, and performance issues exist in multi-organization configurations, making it difficult to meet the increasingly diverse permission management needs of group enterprises.

[0067] Therefore, for group usage scenarios, we first build the group configuration system and group business system corresponding to the group management end based on the group's organizational structure. Among them, the group configuration system includes corresponding personnel services, payment and financial cost control configuration data, while the group business system includes corresponding project information, project personnel and business data.

[0068] Step S09 : performing authority control on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive authority control rules.

[0069] After the group's organizational structure is determined, it is necessary to manage the configuration data and business data within the group. In this embodiment, management is carried out through preset comprehensive authority control rules. It should be clear that in order to adapt to the diverse management configurations of group enterprises and ensure the high availability of the system, this embodiment sets corresponding company authority control rules and corresponding employee authority control rules for authority control.

[0070] Specifically, the above step S09, before the step of performing permission control on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive permission control rules, includes:

[0071] Step S06: Analyze the group structure to obtain subsidiary information, where the subsidiary information includes one or more of department information, business information, process information, and employee information.

[0072] Step S07: constructing a group configuration system based on the department information, process information, and employee information;

[0073] Step S08: constructing a group business system based on the business information.

[0074] Before managing and controlling the business data and configuration data within the group, it is necessary to first build the group configuration system and group business system. Therefore, the group structure should be analyzed first to determine how many subsidiaries the current group has. Based on the analysis of different subsidiaries, the corresponding department information of the subsidiaries should be obtained, that is, how many departments there are and what the responsibilities of the departments are. For example, the Human Resources Management Department is responsible for daily recruitment and human resources care, etc. The business information is the corresponding business that the subsidiary is responsible for. For example, the consumables subsidiary's main business is to sell consumables used in products. The process information is the process required by the subsidiary when applying. For example, the leave process needs to be transmitted to the superior leader, human resources management department, and boss, etc. The employee information contains the personal information of all employees in the subsidiary, such as education, rank, and salary, etc.

[0075] After obtaining the corresponding subsidiary information, the group configuration system can be constructed based on department information, process information, and employee information. It should be noted that only using this information for construction is to separate the business system and the configuration system to avoid data confusion. In some special cases, business information can also be used for corresponding system construction, but only key information is used.

[0076] Business information is usually only used to build the group's business system. However, in actual business system construction, business information alone is not enough, because business development requires responsible persons, follow-up personnel, and payment request processes, etc. Therefore, data can also be collected simultaneously from department information, process information, and employee information to build the business system.

[0077] The various types of information mentioned above should not be limited to the information recorded above. A normally functioning group should include more data, so the actual business system and configuration system should be set up according to actual business needs.

[0078] More specifically, before the step S05 of performing authority control on the group configuration system and the group business system according to the preset authority control rules, the method includes:

[0079] Step S01: determining default permissions based on employee contract information in the employee information to obtain a first employee permission management rule, wherein the employee contract information includes one or more of a department and a contract type;

[0080] Step S02: performing additional authority determination based on employee attribute information of the employee information to obtain a second employee authority management rule, wherein the employee attribute information includes one or more of employee position, employee job title, and employee role;

[0081] Step S03: Determine management authority based on the process information, department information, and business information to obtain company authority management rules;

[0082] Step S04: outputting comprehensive authority control rules based on the first employee authority control rules, the second employee authority control rules, and the company authority control rules.

[0083] To improve the usability of permission control, reduce repeated configuration by users, and support customized permission control rules, this embodiment adopts: individual + multi-person authorization rules and customized permission switches;

[0084] Before we begin explaining the switches and authorization rules above, it should be clear that in actual management, there are some default permissions for employee information. For example, if an employee signs a business position upon joining the company, their permissions in the business system should increase accordingly. Therefore, the default permissions can be determined based on the employee contract information in the employee information to obtain the first employee permission management rule. The employee contract information includes the department to which the employee belongs and the contract type, so when determining the corresponding permission management rule, the configuration data and employee data that the department can access are included.

[0085] In addition, as employees advance and their business involvement changes, additional permissions need to be determined based on the employee attribute information in the employee information. For example, if an employee needs to be temporarily seconded to participate in another business, permissions can be determined based on employee attribute information such as employee position, employee position, and employee role to obtain a second employee permission management rule.

[0086] In addition to employee management, corresponding management authority must be determined for each process, department, and business so that the group's managers can be aware of it. Therefore, management authority can be determined based on process information, department information, and business information to obtain company authority control rules. Finally, comprehensive authority control rules are output based on the first employee authority control rules, the second employee authority control rules, and the company authority control rules.

[0087] This embodiment manages the permissions of the group configuration system and the group business system based on comprehensive permission management rules. Figure 2 As shown:

[0088] Based on the actual group's permission control method, permission control is divided into group configuration permissions and group business permissions. The implementation of configuration permissions and business permissions are isolated from each other and do not affect each other;

[0089] Group configuration authority control: Supports control of group configuration authority based on group mode and legal person company mode. Enterprises can freely switch the ownership of configuration authority and isolate group configuration authority.

[0090] (1) The group model is mainly aimed at group companies with few legal persons and few configurations. Configuration data rarely supports configuration sharing because the enterprise configuration belongs to the group by default and is shared by the configuration personnel. The configuration personnel with the corresponding role have the authority to add, delete, modify and query the enterprise configuration;

[0091] (2) The legal person company model is mainly aimed at group companies with multiple legal persons and multiple configurations. The configuration data needs to be operated by the administrators of each company, and the configurations of different companies need to be isolated according to authorization. Configuration personnel with the same role are granted different configuration permissions because they belong to different companies, and their permissions to add, delete, modify and query enterprise configurations are also different;

[0092] Group business authority control: Supports enterprises to open and close the control of business authority according to actual conditions, and determine the business operation permissions of personnel with different roles;

[0093] The implementation of aspect-based permission control is as follows Figure 3As shown in the figure, the control logic based on data permissions is implemented in a faceted manner. The control logic does not invade the existing configuration system and business system. As long as it complies with the unified docking specifications, permission control for new configuration entries and business functions can be quickly implemented.

[0094] In addition, this embodiment also includes customized permission rules: Figure 4 As shown, in order to improve the usability of permission control, reduce repeated configuration by users, and support customized permission control rules, this is mainly implemented from two aspects: individual + multi-person authorization rules and customized permission switches:

[0095] 1. Individual authorization + multi-person authorization: Optimize the implementation of permission control in group enterprises. In terms of individual permissions, support default permission control and customized permission control based on the individual circumstances of employees (department affiliation, contract signing), and support multi-person permission control based on the individual attributes of employees (position, job title, role, etc.), reducing repeated implementation in enterprises;

[0096] 2. Customized permission switches: For the personalized permission control of group enterprises, support is provided for adding customized switch control according to the personalized needs of the enterprise. In the actual group settings / business permission control, support is provided for associating the dimensions (company, department, business group, etc.) that the enterprise management switch needs to control, and self-configure the rule dimensions of the associated control (full, including belonging, including deactivation, etc.). This facilitates the group to implement customized rule support such as full, including sub-department, including deactivation in permission control. It also facilitates the subsequent implementation of related switch control by enterprises when adding customized control dimensions.

[0097] This embodiment, through the above solution, specifically analyzes the group structure corresponding to the group management terminal to obtain comprehensive permission management rules; based on these comprehensive permission management rules, permission management is performed on the configuration data in the pre-built group configuration system and the business data in the group business system. Thus, by analyzing the actual group structure to obtain comprehensive permission management rules for permission management, and based on these comprehensive permission management rules, permission management is performed on the configuration data in the group configuration system and the business data in the group business system. This solves the problem of group enterprises being unable to flexibly manage data permissions and improves the efficiency of permission management.

[0098] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 5 After step S09 of performing permission control on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive permission control rules, the method includes steps S10 to S12:

[0099] Step S10: outputting control data according to the configuration data and business data;

[0100] Step S11, monitoring the control data based on a preset control threshold;

[0101] Step S12: When the control data exceeds the control threshold, the redundant permissions of the corresponding employees in the group structure are cleared.

[0102] For control configurations involving large amounts of data, such as large groups with tens of thousands of organizations, if the configuration data managed by the enterprise exceeds a specified threshold, group permission control is implemented based on a temporary redundancy solution based on customized permission configuration. This means that when the enterprise triggers a corresponding permission configuration change, it is marked. By asynchronously redundating employee data permissions, the real-time query process during permission verification and screening is skipped, thereby improving the performance and stability of group permission screening.

[0103] This embodiment takes into account that actual scenarios may include multiple subsidiaries, multiple businesses, and multiple employees. Therefore, changes are likely to result in a large amount of permission data changes. Therefore, the group configuration system is first analyzed to obtain the first control data, and the group business system is analyzed to obtain the second control data. The two are then merged and output to obtain the control data.

[0104] Finally, the preset control threshold is used to monitor the control data. When the control data exceeds the control threshold, the corresponding redundant permissions of employees in the group structure are cleared. It should be clear that in group permission control, process and business permission management are all aimed at specific employees. Therefore, when the redundant data corresponding to employees is cleared, the performance and stability of group permission screening can be better improved.

[0105] Specifically, the above step S12, the step of clearing redundant permissions of corresponding employees in the group structure, includes:

[0106] Step S121, lazy loading the permission information of the employee to obtain the permission data of the employee;

[0107] Step S122: updating the preset temporary authority redundancy table authData based on the authority data, and recording the employee's authority redundancy operation in the preset authority redundancy record table authRecord;

[0108] Step S123: Analyze the employee's update authority based on the authData and authRecord, and perform a delayed update on the employee's authority information according to the update authority;

[0109] Step S124, performing a threshold analysis on the employee login time recorded in the authRecord according to a preset time threshold;

[0110] Step S125: When the employee login time exceeds the time threshold, the redundant data in the authData is cleared.

[0111] In this embodiment, if Figure 6 As shown, a temporary permission redundancy table (hereinafter referred to as authData) and a permission redundancy record table (hereinafter referred to as authRecord) are used:

[0112] 1. Permission lazy loading + redundancy: Design employee temporary permission redundancy table and permission redundancy record table. When an employee logs in, lazy load the employee's permission data, record / update the permission data authData, and record the redundant operations of this login permission and update them to authRecord.

[0113] 2. Permission change record + delayed update: For user data that has used authData and has authRecord records, it is necessary to mark the permissions that need to be updated based on changes in employee configuration (department, position, job title, rank, role) / permission configuration (permission configuration rules) so that delayed updates can be performed the next time the employee logs in;

[0114] 3. Redundant permission cleaning: Regularly clean up redundant permission data. When an employee logs in and uses authData data, record their login time in authRecord. Then, run a batch daily to clean up the redundant permission database for employees who have not logged in and used authData for more than one week, to ensure that redundant permission data does not accumulate and there is no large amount of inactive data.

[0115] Furthermore, Figure 1 In the illustrated embodiment, after the step S06 of performing permission control on the group configuration system and the group business system according to the preset comprehensive permission control rules, the method further includes:

[0116] Step S13, receiving a data query request;

[0117] Step S14: If the data query request is a permission information query, query the authRecord based on the data query request to obtain corresponding permission information;

[0118] Step S15: If the data query request is a business data query, the group business system is queried based on the default authority of the data query request to obtain a business data table, and the corresponding business data is obtained by filtering the business data table and authRecord.

[0119] After the permissions are managed, you may face the situation where employees query their permissions. Figure 7 As shown:

[0120] For scenarios involving direct query of available organizations when redundancy is enabled, the logic of filtering individual permissions and multi-person permissions can be skipped. As long as the user has an authRecord permission record saved, the authRecord table can be directly queried to return the employee's available permissions information.

[0121] For scenarios involving business data filtering (such as documents and expenses), filtering needs to be performed based on the user's default permissions. In this case, the filtering logic can be implemented by joining the business data table with the redundant permission table authRecord. This avoids directly passing in a large amount of permission data through the IN query, which may cause database stability issues.

[0122] If you need to verify the user's permission information and determine whether the user's filtered permission data is compliant, you can directly match the user's filtered permission information with the redundant permission table authRecord, which can also avoid the matching logic involved in the permission configuration.

[0123] This embodiment, through the above-mentioned solution, specifically outputs control data based on the configuration data and business data; monitors the control data based on a preset control threshold; and when the control data exceeds the control threshold, clears the redundant permissions of the corresponding employees in the group structure. Thus, by analyzing the actual group structure to obtain comprehensive permission control rules for permission control, permission control is implemented on the configuration data in the group configuration system and the business data in the group business system based on the comprehensive permission control rules. This solves the problem of group enterprises being unable to flexibly control data permissions and improves the efficiency of permission control.

[0124] It should be noted that the above examples are only used to understand this application and do not constitute a limitation on the permission management method of this application. More simple transformations based on this technical concept are all within the scope of protection of this application.

[0125] This application also provides a permission management device, please refer to Figure 8 The authority control device is applied to the group management end and includes:

[0126] An analysis module 10 is configured to analyze the group structure corresponding to the group management terminal to obtain comprehensive authority control rules;

[0127] The control module 20 is configured to perform authority control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive authority control rules.

[0128] The permission control device provided in this application, which adopts the permission control method in the above-mentioned embodiment, can solve the technical problem that group enterprises cannot flexibly control data permissions. Compared with the existing technology, the beneficial effects of the permission control device provided in this application are the same as the beneficial effects of the permission control method provided in the above-mentioned embodiment, and the other technical features of the permission control device are the same as those disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0129] The present application provides a permission management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the permission management method in the above-mentioned embodiment one.

[0130] Reference below Figure 9 , which shows a schematic diagram of the structure of a permission management device suitable for implementing the embodiments of the present application. The permission management device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 9 The permission management device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0131] like Figure 9As shown, the permission control device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the permission control device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the permission control device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a permission control device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0132] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0133] The permission control device provided in this application, using the permission control method in the above-mentioned embodiment, can solve the technical problem of group enterprises being unable to flexibly control data permissions. Compared with the existing technology, the beneficial effects of the permission control device provided in this application are the same as those of the permission control method provided in the above-mentioned embodiment, and the other technical features of the permission control device are the same as those disclosed in the above-mentioned embodiment, so they will not be repeated here.

[0134] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0136] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, and the computer-readable program instructions are used to execute the permission management method in the above-mentioned embodiment.

[0137] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0138] The computer-readable storage medium may be included in the permission control device, or may exist independently without being incorporated into the permission control device.

[0139] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by a group enterprise and the data permission control device is unable to flexibly perform data permission control, the permission control device: analyzes the group structure corresponding to the group management end to obtain comprehensive permission control rules; and performs permission control on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive permission control rules.

[0140] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0141] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0142] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0143] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned permission management method. This computer-readable storage medium can address the technical issue of group enterprises being unable to flexibly manage data permissions. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the permission management method provided in the aforementioned embodiment, and are not further elaborated here.

[0144] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned permission management method when executed by a processor.

[0145] The computer program product provided in this application can solve the technical problem that group enterprises cannot flexibly control data permissions. Compared with the existing technology, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the permission control method provided in the above embodiment, and will not be repeated here.

[0146] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A permission management method, characterized in that: The permission control method is applied to the group management end, and the method includes: Analyze the group structure corresponding to the group management end to obtain comprehensive authority control rules; Performing authority control on the configuration data in the pre-built group configuration system and the business data in the group business system based on the comprehensive authority control rules; Before the step of performing authority control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive authority control rules, the method further includes: Analyze the group structure to obtain subsidiary information, where the subsidiary information includes one or more of department information, business information, process information, and employee information; A group configuration system is constructed based on the department information, process information and employee information; A group business system is constructed based on the business information; After the step of performing authority control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive authority control rules, the method includes: Output control data according to the configuration data and business data; Monitoring the control data based on a preset control threshold; When the control data exceeds the control threshold, redundant permissions of the corresponding employees in the group structure are cleared.

2. The method according to claim 1, wherein Before the step of analyzing the group structure corresponding to the group management terminal to obtain comprehensive authority control rules, the method further includes: Determine default permissions based on employee contract information of the employee information to obtain a first employee permission management rule, wherein the employee contract information includes one or more of a department and a contract type; performing additional authority determination based on employee attribute information of the employee information to obtain a second employee authority management rule, wherein the employee attribute information includes one or more of employee position, employee job, and employee role; Determine management authority based on the process information, department information, and business information to obtain company authority control rules; Output comprehensive authority control rules based on the first employee authority control rules, the second employee authority control rules and the company authority control rules.

3. The method according to claim 1, wherein The step of clearing redundant permissions of corresponding employees in the group structure includes: Loading the permission information of the employee to obtain the permission data of the employee; Based on the authority data, the preset temporary authority redundancy table authData is updated, and the authority redundancy operation of the employee is recorded in the preset authority redundancy record table authRecord; Analyzing the employee's update authority based on the authData and authRecord, and performing a delayed update on the employee's authority information according to the update authority; Perform threshold analysis on the employee login time recorded in the authRecord according to a preset time threshold; When the employee login time exceeds the time threshold, redundant data in the authData is cleared.

4. The method according to claim 3, wherein After the step of performing authority control on the configuration data in the preset group configuration system and the business data in the group business system based on the comprehensive authority control rules, the method further includes: Receive data query requests; If the data query request is a permission information query, query the authRecord based on the data query request to obtain the corresponding permission information; If the data query request is a business data query, the group business system is queried based on the default authority of the data query request to obtain a business data table, and the corresponding business data is obtained by filtering the business data table and authRecord.

5. A permission management device, characterized in that: The device is applied to a group management terminal and includes: An analysis module is used to analyze the group structure corresponding to the group management terminal to obtain comprehensive authority control rules; A control module, configured to perform authority control on configuration data in a preset group configuration system and business data in a group business system based on the comprehensive authority control rules; The control module is further configured to analyze the group structure to obtain subsidiary information, wherein the subsidiary information includes one or more of department information, business information, process information, and employee information; A group configuration system is constructed based on the department information, process information and employee information; A group business system is constructed based on the business information; Output control data according to the configuration data and business data; Monitoring the control data based on a preset control threshold; When the control data exceeds the control threshold, redundant permissions of the corresponding employees in the group structure are cleared.

6. A permission management device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the permission control method according to any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the permission management method according to any one of claims 1 to 4 are implemented.

8. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the permission management method according to any one of claims 1 to 4 are implemented.

Images