Information authority management method and device, electronic equipment and storage medium

Abstract

The invention provides an information authority management method and device, electronic equipment and a storage medium, and belongs to the field of authority management.The method comprises the steps that an information access request initiated by a user is received, and identity recognition data of the user is extracted; according to the extracted identity recognition data, a preset permission rule is obtained, and the permission rule defines visible and invisible rules of all users in information access; obtaining codes of visible and invisible organizations in the authority rule, and calculating visible and invisible ranges of the user in the organizations; and according to the calculated visible range, screening information entries conforming to the user permission. According to the method, the problem of insufficient flexibility of address book information management under dynamic change of the organization structure is effectively solved, and the real-time performance and adaptability of information authority management are ensured.

Description

Technical Field

[0001] The present application relates to the technical field of rights management, and in particular to an information rights management method, device, electronic device and storage medium. Background Art

[0002] As companies merge, reorganize, expand or shrink, the division of departments, job settings and staffing within the organization are constantly changing. This dynamic change places higher demands on information management within the organization, especially the effective management of address book information. As the cornerstone of internal communication within the organization, the address book contains key data such as employee contact information, department affiliation, and job level. This information is crucial for daily collaboration, communication and decision-making.

[0003] However, traditional address book management solutions usually use static permission settings, which are difficult to adapt to the rapid changes in organizational structure, resulting in delayed permission updates and increased risks of data leakage and improper access. In addition, employees at different positions and levels have significantly different access requirements for address book information. For example, senior managers need to access a wider range of address book information, while grassroots employees only need to access information directly related to their work. Therefore, employees at different positions and levels have significantly different access requirements for address book information, and it is necessary to meet personalized access needs while ensuring information security. Summary of the invention

[0004] The present application provides an information rights management method, device, electronic device and storage medium, aiming to solve the problem of insufficient flexibility in address book information management under dynamic changes in organizational structure.

[0005] In a first aspect, the present application provides an information rights management method, the information rights management method comprising:

[0006] Receive information access requests initiated by users and extract the user's identity data;

[0007] According to the extracted identity data, a preset permission rule is obtained, wherein the permission rule defines the visible and invisible rules of all users in information access;

[0008] Obtain the codes of visible and invisible organizations in the permission rule, and calculate the visible and invisible scopes of the user in the organization;

[0009] According to the calculated visible range, filter the information entries that meet the user's permissions.

[0010] In a second aspect, the present application further provides an information rights management device, the device comprising:

[0011] A user identification module is used to receive information access requests initiated by users and extract the user's identity identification data;

[0012] The permission acquisition module is used to obtain preset permission rules based on the extracted identity recognition data, wherein the permission rules define visible and invisible rules for all users in information access;

[0013] A range calculation module is used to obtain the codes of visible and invisible organizations in the permission rule and calculate the visible and invisible ranges of the user in the organization;

[0014] The information filtering module is used to filter information items that meet the user's permissions based on the calculated visible range.

[0015] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the steps of the information rights management method as described in any one of the first aspects are implemented.

[0016] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the information rights management method as described in any one of the first aspects are implemented.

[0017] The present application provides an information rights management method, device, electronic device and storage medium, which are intended to solve the problem of insufficient flexibility in address book information management under dynamic changes in organizational structure. The method first receives an information access request initiated by a user and extracts the user's identity data, allowing the system to identify the user's identity in real time, and ensures the accuracy of the user's identity even when the organizational structure changes. Then, according to the extracted identity data, a preset permission rule is obtained. The permission rule defines the visible and invisible rules of all users in information access. Through the preset permission rules, the system can flexibly adapt to changes in the organizational structure and ensure the rationality and timeliness of permission allocation. In addition, the preset organization's code is parsed and combined with the permission rules to determine the visible and invisible rules of the user in the organization's code, and its visible range is calculated according to the visible and invisible rules. This ensures that the system can dynamically parse changes in the organizational structure and adjust the user's visible range accordingly. Finally, according to the calculated visible range, the information items that meet the user's permissions are screened. This means that the system can dynamically adjust the information accessible to the user according to the real-time changes in the organizational structure, thereby improving the flexibility and accuracy of address book information management.

[0018] Therefore, this application effectively solves the problem of insufficient flexibility in address book information management under dynamic changes in organizational structure through dynamic identity recognition, flexible application of permission rules, organizational coding analysis and dynamic information screening, ensuring the real-time and adaptability of information permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is a flow chart of the information rights management method provided by this application;

[0021] Figure 2 It is a schematic diagram of the coding of the organization structure tree provided in the embodiment of the present application;

[0022] Figure 3 It is a structural diagram of the information rights management device provided by this application;

[0023] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein.

[0026] The terms involved in this application are explained below.

[0027] An organizational structure tree is a data structure that represents the hierarchical relationship of an organization. It is similar to an inverted tree, and each node contains detailed information about the organization, such as name, ID, responsibilities, etc. In the organizational structure tree: the root node represents the highest level of organization, such as a company or institution. Branch nodes represent subordinate departments, teams, or other sub-organizations. Leaf nodes represent the lowest level units without subordinate organizations, such as groups or individuals. The hierarchical structure of the organizational structure tree reflects the power, responsibilities, and reporting relationships within the organization. For example, in a company, the CEO is the root node, which is divided into branch nodes such as the Finance Department, Marketing Department, and Human Resources Department, and these departments have smaller teams or project groups as leaf nodes.

[0028] A bitmap is a data structure that consists of a series of bits, each of which can represent a simple binary state, usually 0 or 1. Bitmaps are widely used in many fields of computer science, including image processing, data compression, memory management, and permission control, due to their compact storage and efficient bit operations. In a bitmap, the position of each bit usually corresponds to some kind of identifier or index, such as a user ID, pixel position, memory address, etc. By setting or clearing a specific bit in a bitmap, the state of the corresponding element can be quickly represented and modified.

[0029] Exemplarily, the information rights are managed using an organizational structure tree or a bitmap as follows:

[0030] Solution 1: Use the organizational structure tree to manage information permissions.

[0031] Specifically, the management of user information access rights is achieved by maintaining the hierarchical structure of the organization tree and combining it with predefined visibility rules, including the following steps:

[0032] (1) Maintenance of the organizational structure tree:

[0033] A tree structure representing the organizational hierarchy is constructed within the system, and each organizational node is assigned a unique identifier (ID).

[0034] (2) Definition of visibility rules:

[0035] Visibility rules are scoped by referencing an organization ID. These rules can be for a single organization (leaf node) or a composite organization with sub-organizations (non-leaf node).

[0036] (3) Determination of user visible range:

[0037] When evaluating the visibility of a user, the system first locates the organization node to which the user belongs. It then traverses the entire organization structure tree and checks the applicable visibility rules and hidden rules one by one:

[0038] a. If the rule is directly associated with the organization that contains the user, the organization will be included in the visible organization set or the hidden organization set.

[0039] b. If the rule is associated with an organization that is not a leaf node, the system will recursively traverse all its child nodes and add the organization of the leaf node to the corresponding set.

[0040] (4) Calculation of the final visible range:

[0041] After the traversal is completed, the system performs set operations to remove the organizations in the hidden organization set from the visible organization set, thereby obtaining the user's final visible range.

[0042] The first solution is to maintain an organizational structure tree to represent the organizational hierarchy, and use traversal and set operations to determine the user's visible range. However, this solution has many disadvantages: in large organizations, the efficiency of traversing the organizational structure tree is low, which may lead to performance bottlenecks; the space complexity of the recursive algorithm is high, which may cause stack overflow; set operations, especially difference operations, have high computational overhead and affect performance; visibility rules are tightly coupled with organizational IDs, which increases maintenance costs and error risks; and this solution fails to fully utilize the mathematical characteristics of the organizational hierarchy, lacks targeted and efficient data structure and algorithm support, and is difficult to meet large-scale, real-time visibility computing needs.

[0043] Solution 2: Use bitmaps to manage information permissions.

[0044] Specifically, a bitmap-based access control list (ACL) scheme is used to manage the visibility of address book records, including the following steps:

[0045] (1) Bitmap index allocation:

[0046] The system assigns a unique ID to each organization or person, which is used as an index to the bit in the bitmap.

[0047] (2) Bitmap represents visibility:

[0048] Each address book record is associated with a bitmap, and the length of the bitmap is equal to the total number of organizations or people. Each bit in the bitmap corresponds to an organization or person, where 0 means that the organization or person is not visible to the record, and 1 means that it is visible.

[0049] (3) User query processing:

[0050] When a user queries the address book, the system obtains the user's ID and checks the value of the corresponding position in the visibility bitmap of the target record. If the value of the position is 1, the user is allowed to access the record; if the value of the position is 0, access is denied.

[0051] (4) Changes in organizational structure or authority:

[0052] When the organizational structure changes or personnel permissions change, the system needs to traverse all address book records and update the visibility bitmap of the affected records to reflect the latest visibility status.

[0053] The second solution mentioned above uses a bitmap data structure to represent and manage the visibility of address book records, but when the organizational structure or permissions change, all related records need to be updated. However, this solution has multiple disadvantages when processing large-scale organizational and personnel data: high storage overhead. As the number of organizations and personnel increases, the storage requirements of the bitmap rise sharply; high maintenance costs. Any visibility change requires traversing a large number of records to update the bitmap, resulting in time-consuming and error-prone operations; poor scalability. The bitmap length is fixed and it is difficult to adapt to dynamic changes in the size of the organization; security risks. The bitmap is directly associated with a specific organization or person, and leakage may lead to privacy leakage; incompatible with the characteristics of relational databases. Bitmaps are not built-in database data types, and queries and operations require complex coding and conversion.

[0054] It can be seen that Solution 1 is a solution based on organizational hierarchy traversal. In large-scale organizations and massive data scenarios, due to frequent recursive traversal and visibility judgment, query performance will drop sharply and it is difficult to meet the requirements of real-time response. Solution 2 is a solution based on bitmaps. Although it improves query performance in specific scenarios, its unstructured data types and query methods make it difficult to utilize the query optimization and indexing mechanisms of relational databases, and its scalability is limited by the length of the initially designed bitmap. The storage density of the adopted bitmap is low, resulting in large storage overhead, much data redundancy, and high storage cost. In addition, both solutions require the implementation of complex visibility control logic at the application level, which has high development and maintenance costs.

[0055] In order to further solve the problems of solution one and solution two, the present application provides an information permission management method. The method assigns a pair of left and right boundary values ​​(i.e., left boundary value and right boundary value) to each node in the organizational structure tree, and uses a value interval to represent the visible and invisible organizational range. When calculating permissions, interval operations are used to merge the ranges of multiple visible and invisible rules defined based on user attributes (such as the organization, role, or label) to obtain the user's final visible organizational range, thereby achieving fine-grained dynamic permission control. By converting visibility judgment into a range comparison of a numeric field, the calculation efficiency and query performance are improved. By introducing permission control based on boundary values, the speed and accuracy of permission judgment are ensured, which not only simplifies the complexity of permission management, but also improves the flexibility and response speed of the system, ensures that permission settings can adapt to the dynamic changes of the organizational structure, and effectively optimizes the information access control mechanism in large-scale organizations.

[0056] Please refer to Figure 1 , Figure 1 The flowchart of the information rights management method provided by the present application is as follows:

[0057] S110, receiving an information access request initiated by a user, and extracting the user's identity identification data.

[0058] Specifically, after receiving the user's request, the system extracts the data used to identify the user from the request. The user's identity data includes, for example, the user name, user ID, session token, email address, etc., which are used to confirm the user's identity and permissions. This step ensures that only authenticated users can access specific information resources. By extracting the identity data, the system can apply the corresponding permission rules and further process the user's access request.

[0059] S120, obtaining preset permission rules according to the extracted identity recognition data, wherein the permission rules define visible and invisible rules for all users in information access.

[0060] Specifically, the user identification data extracted in step S110 is used to confirm the identity of the user. The system applies pre-set permission rules based on the user's identification data. Permission rules can be pre-configured by the system administrator or permission management tool to control the access rights of different users to information. Permission rules specify in detail which information is visible to all users and which is not visible. Permission rules can define the scope of information that users can access based on the user's role, department, position or other attributes. This step is key to ensuring information security and compliance. By applying preset permission rules, the system can ensure that users can only access information they are authorized to, thereby protecting sensitive data from unauthorized users.

[0061] S130, obtaining the codes of the visible and invisible organizations in the permission rule, and calculating the visible and invisible ranges of the user in the organization.

[0062] Specifically, the codes of visible and invisible organizations in the permission rules are first obtained to calculate the final scope of organizations that the user can access. This means that the system will comprehensively consider the user's organizational role and permission rules to determine the scope of information that the user can actually access. This step ensures that information permission management can adapt to the dynamic changes in the organizational structure, while ensuring that users can only access information within their permission scope, thereby achieving effective information security and access control.

[0063] S140: Filter information items that meet the user's authority according to the calculated visible range.

[0064] Specifically, the system uses the user visible range calculated in step S130. The visible range is derived based on the user's identity data, the organization's coding analysis, and the preset permission rules. The system will filter out those items that meet the user's permissions from all accessible information items based on the user's visible range. This means that only those information items within the user's visible range will be returned to the user, ensuring that the user can only access the information they are authorized to. This step is the key to ensuring the final implementation of information rights management. By filtering out information items that meet user permissions, the system can protect sensitive data from being accessed by unauthorized users, while ensuring that users can access the information they need.

[0065] The above steps S120 to S140 are described in detail below in conjunction with embodiments.

[0066] In some embodiments, the information rights management method further includes constructing an organization's code, the process of which includes:

[0067] S201, initialize a global counter (such as denoted as c), and set its initial value to a pre-specified value (such as 1).

[0068] The purpose of this step is to start the encoding process, and the purpose of setting the initial value is to ensure the uniqueness and continuity of subsequent node encodings.

[0069] S202, starting from the root node of the organization structure tree (such as the root node is A), assign left and right boundary values ​​to each node:

[0070] When a node (such as node N) is visited for the first time, its left boundary value is recorded as the current value of the global counter plus one (such as L(N) = c+1);

[0071] b. Recursively traverse all child nodes of the node (such as node N);

[0072] c. After completing the traversal of all child nodes of the node (such as node N), record its right boundary value as the current value of the global counter plus one (such as R(N)=c+1); this can establish the precise position and scope of the node (such as node N) in the organizational structure tree.

[0073] Repeat the above process from a to c until all nodes of the entire organization structure tree are traversed to complete the encoding.

[0074] Specifically, step S202 may adopt a depth-first traversal (DFS) strategy to ensure a comprehensive exploration of the tree structure and sequential access to nodes. The recursive traversal and boundary value assignment process in S202 is repeated until all nodes of the entire organizational structure tree are traversed, ensuring that each node is assigned a correct boundary value to reflect its hierarchy and relationship in the tree structure.

[0075] In some embodiments, the information rights management method further includes verifying the organization's code to ensure the accuracy and consistency of the code. The verification process may include the following steps:

[0076] S301, verify the order of left boundary values:

[0077] Confirm that for any node (e.g., node N), its left edge value (denoted as L(N)) is less than the left edge values ​​of all its child nodes. This step ensures that in the organizational structure tree, the left edge value of each node reflects its correct position in the hierarchy.

[0078] S302, verify the order of right boundary values:

[0079] Confirm that for any node (for example, node N), its right boundary value (denoted as R(N)) is greater than the right boundary values ​​of all its child nodes. This step ensures that the right boundary value of each node also correctly reflects its position in the hierarchy.

[0080] S303, verify the coverage of the boundary value interval:

[0081] Confirm that the left and right boundary value intervals [L(N), R(N)] of any node (for example, node N) accurately represent the range of the number interval covered by the subtree with it (node ​​N) as the root. This step ensures that the boundary value intervals of each node correctly define the range of its subtree.

[0082] Through the verification of these three steps from S301 to S303, the accuracy and consistency of the organization's coding can be ensured, thus providing a solid foundation for subsequent information rights management.

[0083] Please refer to Figure 2 , Figure 2 It is a schematic diagram of the organization structure tree coding provided in the embodiment of the present application. Figure 2 It shows the hierarchical structure of an organizational structure tree, where each node has a left and right boundary value, which is used to indicate the position and scope of the node in the organizational structure. The details are as follows:

[0084] (1) Root Node A:

[0085] The left and right boundary values ​​are [1,18], indicating that A is the top-level node of the entire organizational structure tree, covering the entire range from 1 to 18.

[0086] (2) A's left subtree B, A's right subtree C:

[0087] The left and right boundary values ​​are [2,7], which means that B is the left subtree of A, covering the range from 2 to 7. The left and right boundary values ​​are [8,17], which means that C is the right subtree of A, covering the range from 8 to 17.

[0088] (3) B’s left child node D, B’s right child node E:

[0089] The left and right boundary values ​​are [3,4], which means that D is the left child of B, covering the range from 3 to 4. The left and right boundary values ​​are [5,6], which means that E is the right child of B, covering the range from 5 to 6.

[0090] (4) C's left subtree F, C's right subtree G:

[0091] The left and right boundary values ​​are [9,12], which means that F is the left subtree of C and covers the range from 9 to 12. The left and right boundary values ​​are [13,16], which means that G is the right subtree of C and covers the range from 13 to 16.

[0092] (5) F's left child node H, F's right child node I:

[0093] The left and right boundary values ​​are [10,11], which means H is the left child of F and covers the range from 10 to 11. The left and right boundary values ​​are [14,15], which means I is the right child of F and covers the range from 14 to 15.

[0094] As can be seen, the above example can quickly perform range queries by configuring a left and right boundary value for each node, such as finding all child nodes or ancestor nodes of a node. In this example, the left and right boundary values ​​of each node define its position and range in the organizational structure, which can be used in scenarios such as permission control, data query, and organizational structure display.

[0095] In addition, you can define permission rules for each user role, user group or organization to provide appropriate visible and invisible rules. When the organizational structure changes (such as adding, deleting, moving, merging, and splitting nodes), the node code may change, and the visible and invisible ranges need to be adjusted accordingly to ensure that the adjusted ranges match the updated organizational structure.

[0096] In some embodiments, in step S130, obtaining the codes of visible and invisible organizations in the permission rule and calculating the visible and invisible ranges of the user in the organization include:

[0097] S401, define the interval of visible range:

[0098] A set of predefined left and right boundary value intervals (denoted as [L, R]) are used to define visibility rules. These intervals are pre-set to determine which nodes are visible to the user.

[0099] S402, verify whether the node is within the visible rule:

[0100] For a certain node (such as node N), check whether its left and right boundary values ​​(represented as [L(N), R(N)]) fall within the predefined visible interval. The specific conditions include:

[0101] a. The left boundary value of the predefined interval is not greater than the left boundary value of the node, that is, L≤L(N);

[0102] b. The left boundary value of the node is less than its right boundary value, that is, L(N) <R(N);

[0103] c. The right boundary value of the node is not greater than the right boundary value of the predefined interval, that is, R(N)≤R;

[0104] S403, determine the visibility of the node:

[0105] If the left and right boundary values ​​of the node (node ​​N) meet all the above conditions, it is determined that the node is visible to the current user.

[0106] Through the above three steps S401 to S403, the calculation rules of the code itself are reflected, and the system can determine which nodes are visible to the user, thereby realizing refined information authority management.

[0107] In some embodiments, in step S130, obtaining the codes of visible and invisible organizations in the permission rule and calculating the visible and invisible ranges of the user in the organization include:

[0108] S501, define the interval of the non-visible range:

[0109] A set of predefined left and right boundary value intervals (denoted as [L, R]) are used to define the invisible range. These intervals are pre-set to determine which nodes are invisible to the user.

[0110] S502, verify whether the node is within the invisible range:

[0111] For a certain node (such as node N), check whether its left and right boundary values ​​(represented as [L(N), R(N)]) fall within the predefined non-visible interval. The specific conditions include:

[0112] a. The left boundary value of the predefined interval is not greater than the left boundary value of the node, that is, L≤L(N);

[0113] b. The left boundary value of the node is less than its right boundary value, that is, L(N) <R(N);

[0114] c. The right boundary value of the node is not greater than the right boundary value of the predefined interval, that is, R(N)≤R.

[0115] S503, determining the non-visibility of the node:

[0116] If the left and right boundary values ​​of the node (node ​​N) meet all the above conditions, it is determined that the node is not visible to the current user.

[0117] Through the above three steps S501 to S503, the calculation rules of the code itself are reflected, and the system can determine which nodes are invisible to the user, thereby realizing refined information authority management.

[0118] Combination Figure 2 , the above S401 to S403, and S501 to S503 are illustrated by example:

[0119] Assume that the visible rule V1 = [2,7], which means that nodes with left boundary values ​​between 2 and 7 (ie, nodes B, D, and E) are visible to the user.

[0120] Assume that the invisible rule H1 = [5, 6], which means that the node with the left boundary value between 5 and 6 (ie, node E) is invisible to the user.

[0121] For Section E, Figure 2 It can be seen that the left and right values ​​of the node E are [L(E), R(E)] = [5, 6]. The left and right values ​​of the node E [5, 6] fall within the interval [2, 7] of the visible rule V1, so according to the visible rule V1, the node E is visible. At the same time, the left and right values ​​of the node E [5, 6] also fall within the interval [5, 6] of the invisible range H1, so according to the invisible rule H1, the node E is invisible. Because the invisible rule H1 takes precedence over the visible rule V1, the node E is finally judged to be invisible.

[0122] Through this example, you can see how permission rules are applied to determine the visibility of a node, and understand that non-visible rules take precedence over visible rules, thereby achieving more refined permission control.

[0123] In some embodiments, in the above S130, the step of calculating the visible and invisible ranges of the user in the organization includes:

[0124] S610, calculating a preliminary visible range, which specifically includes S611 to S613.

[0125] S620, calculating the final visible range, which specifically includes S621 to S623.

[0126] S611: Merge all visible intervals in the permission rule to obtain a preliminary visible range.

[0127] For example, for a given user, collect all applicable visible rules V1, V2, ..., V n and invisible rules H1,H2,...,H m . All visible intervals corresponding to the visible rules are merged to obtain the initial visible range V, that is, V = V1∪V2∪...∪V n , where ∪ represents the interval union operation.

[0128] S612, for any two intervals in the initial visible range, if they have an intersection, the union of the two intervals will form a new interval, the left boundary value of the new interval is the minimum value of the left boundary values ​​of the two intervals, and the right boundary value is the maximum value of the right boundary values ​​of the two intervals.

[0129] For example, if two intervals [L1, R1] and [L2, R2] have an intersection, that is Then their union [L1, R1] ∪ [L2, R2] = [min(L1, L2), max(R1, R2)].

[0130] S613: If any two intervals in the initial visible range do not have an intersection, the two intervals are independently retained in the initial visible range.

[0131] For example, if two intervals [L1, R1] and [L2, R2] do not intersect, that is Then their union [L1, R1] ∪ [L2, R2] = {[L1, R1], [L2, R2]}, that is, the two intervals are kept unchanged in the initial visible range.

[0132] In some embodiments, the step of calculating the visible and invisible ranges of the user in the organization includes:

[0133] S621, removing each non-visible interval from the preliminary visible range one by one, so as to construct a final visible range.

[0134] From S611, we can see that the invisible rules are H1, H2, ..., H m , the initial visible range V = V1∪V2∪...∪V n Subtract each non-visible interval corresponding to the non-visible rule from the preliminary visible range V to obtain the final visible range V', that is, V' = V-H1-H2-...-H m , where - represents the interval difference operation.

[0135] S622: For any two intervals in the final visible range, if there is an intersection between them, perform an interval difference operation on the two intervals to eliminate the overlapping parts. This includes:

[0136] S6221, when the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the first interval, and at the same time the right boundary value of the first interval is less than the right boundary value of the second interval, the result is a new interval, whose left boundary value is the left boundary value of the first interval and the right boundary value is the value before the left boundary value of the second interval.

[0137] For example, That is, if the first interval and the second interval have an intersection, then when L1 < L2 ≤ R1 < R2, [L1, R1] - [L2, R2] = {[L1, L2 - 1]}.

[0138] S6222, when the left boundary value of the second interval is less than or equal to the left boundary value of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary value of the second interval, and at the same time the right boundary value of the second interval is less than the right boundary value of the first interval, the result is a new interval, whose left boundary value is the value next to the right boundary value of the second interval and the right boundary value is the right boundary value of the first interval.

[0139] For example, That is, if the first interval and the second interval have an intersection, then when L2 ≤ L1 ≤ R2 < R1, [L1, R1] - [L2, R2] = {[R2 + 1, R1]}.

[0140] S6223, when the left boundary of the second interval is less than or equal to the left boundary of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary of the first interval, and at the same time the right boundary value of the first interval is less than or equal to the right boundary value of the second interval, the result is empty.

[0141] For example, That is, if the first interval and the second interval have an intersection, then when L2 ≤ L1 ≤ R1 ≤ R2,

[0142] S6224, when the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the second interval, and at the same time the right boundary value of the second interval is less than the right boundary value of the first interval, the result is two new intervals; the left boundary value of the first new interval is the left boundary value of the first interval and the right boundary value is the value before the left boundary value of the second interval; the left boundary value of the second new interval is the value next to the right boundary value of the second interval and the right boundary is the right boundary value of the first interval.

[0143] For example, That is, if the first interval and the second interval have an intersection, then when L1 < L2 ≤ R2 < R1, [L1, R1] - [L2, R2] = {[L1, L2 - 1], [R2 + 1, R1]}.

[0144] S623: If any two intervals in the final visible range do not have an intersection, an interval difference operation is performed on the two intervals to retain the subtracted interval.

[0145] For example, That is, the first interval and the second interval do not intersect, so [L1, R1]-[L2, R2] = {[L1, R1]}, that is, the reduced interval [L1, R1] is retained.

[0146] Combination Figure 2 , S610 and S620 are described as follows:

[0147] Assume visible rules: V1 = [2,7], V2 = [13,16];

[0148] Assume non-visible rules: H1 = [5,6], H2 = [10,11];

[0149] Initial visible range: V = [2,7] ∪ [13,16] = [2,7], [13,16];

[0150] Final visible range: V' = V-[5,6]-[10,11] = [3,4],[13,16].

[0151] In this example, the final visible range V' contains the interval [3,4],[13,16], such as Figure 2 As shown, the nodes G and its subtrees correspond to the node D. The nodes E and H are invisible because they fall within the invisible range.

[0152] In some embodiments, in step S140, the step of filtering information items that meet the user's authority according to the calculated visible range includes:

[0153] S701: Express the final visible range as a set of non-intersecting left and right boundary value intervals as the visible range.

[0154] For example, the final visible range V' is represented as a set of non-overlapping left and right boundary value intervals.

[0155] S702, converting the visible range into corresponding query conditions to filter out information items that meet the user's authority within the final visible range.

[0156] Specifically, the visible range can be converted into corresponding query conditions or filtering rules according to the specific implementation method of the query:

[0157] For example, using SQL query, the visible range is converted into a WHERE clause condition, such as (L>=3AND L<=4) OR (L>=13AND R<=16).

[0158] For example, other query languages ​​or APIs (Application Programming Interface) are used to pass the visible range as a query parameter or filter condition, allowing the query engine or server to filter data based on these intervals.

[0159] For example, use in-memory data or non-relational databases to filter query results based on visible ranges at the application level.

[0160] The data finally returned to the user is limited to the final visible range V', ensuring that only authorized information is displayed.

[0161] The information authority management device provided by the present application is described below. The information authority management device and the information authority management method described below can be referenced to each other.

[0162] Please refer to Figure 3 , Figure 3 The information rights management device 300 includes a user identification module 310 , a rights acquisition module 320 , a range calculation module 330 , and an information screening module 340 .

[0163] Exemplarily, the user identification module 310 is used to receive an information access request initiated by a user and extract the identity identification data of the user.

[0164] Exemplarily, the permission acquisition module 320 is used to acquire preset permission rules according to the extracted identity recognition data, wherein the permission rules define visible and invisible rules for all users in information access.

[0165] Exemplarily, the range calculation module 330 is used to obtain the codes of visible and invisible organizations in the permission rule, and calculate the visible and invisible ranges of the user in the organization.

[0166] Exemplarily, the information screening module 340 is used to screen information items that meet the user's authority according to the calculated visible range.

[0167] Exemplarily, the range calculation module 330 is further used for:

[0168] Initialize a global counter and set its initial value to a pre-specified value;

[0169] Starting from the root node of the organization structure tree, assign left and right boundary values ​​to each node: when a node is first visited, record its left boundary value as the current value of the global counter plus one; recursively traverse all child nodes of the node; after completing the traversal of all child nodes of the node, record its right boundary value as the current value of the global counter plus one;

[0170] Repeat this process until all nodes of the entire organizational structure tree are traversed to complete the encoding.

[0171] Exemplarily, the range calculation module 330 is further used for:

[0172] Make sure that for any node, its left edge value is less than the left edge values ​​of all its child nodes;

[0173] Make sure that for any node, its right edge value is greater than the right edge values ​​of all its child nodes;

[0174] Confirm that the left and right boundary value intervals of any node represent the range of numeric intervals covered by the subtree with it as the root.

[0175] Exemplarily, the range calculation module 330 is further used for:

[0176] A set of predefined left and right boundary value intervals are used to define visible rules;

[0177] For a node, if its left and right boundary values ​​fall within the predefined visible interval, the following conditions are met at the same time:

[0178] The left boundary value of the predefined interval is not greater than the left boundary value of the node;

[0179] The left boundary value of the node is less than its right boundary value;

[0180] The right boundary value of the node is not greater than the right boundary value of the predefined interval;

[0181] It is determined that the node is visible to the current user.

[0182] Exemplarily, the range calculation module 330 is further used for:

[0183] A set of predefined left and right boundary value intervals are used to define non-visible rules;

[0184] For a node, if its left and right boundary values ​​fall within the predefined non-visible interval, the following conditions are met at the same time:

[0185] The left boundary value of the predefined interval is not greater than the left boundary value of the node;

[0186] The left boundary value of the node is less than its right boundary value;

[0187] The right boundary value of the node is not greater than the right boundary value of the predefined interval;

[0188] It is determined that the node is not visible to the current user.

[0189] Exemplarily, the range calculation module 330 is further used for:

[0190] Merge all visible intervals in the permission rules to obtain a preliminary visible range;

[0191] For any two intervals in the initial visible range, if they have an intersection, the union of the two intervals will form a new interval, the left boundary value of the new interval is the minimum value of the left boundary values ​​of the two intervals, and the right boundary value is the maximum value of the right boundary values ​​of the two intervals;

[0192] If there is no intersection between any two intervals in the preliminary visible range, the two intervals are independently retained in the preliminary visible range.

[0193] Exemplarily, the range calculation module 330 is further used for:

[0194] From the preliminary visible range, remove each non-visible interval one by one to construct the final visible range;

[0195] For any two intervals in the final visible range, if there is an intersection between them, the interval difference operation is performed on the two intervals to eliminate the overlapping parts;

[0196] If any two intervals in the final visible range do not have an intersection, an interval difference operation is performed on the two intervals to retain the subtracted interval.

[0197] Exemplarily, the range calculation module 330 is further used for:

[0198] When the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the first interval, and the right boundary value of the first interval is less than the right boundary value of the second interval, the result is a new interval, whose left boundary value is the left boundary value of the first interval, and the right boundary value is the previous value of the left boundary value of the second interval;

[0199] When the left boundary value of the second interval is less than or equal to the left boundary value of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary value of the second interval, and the right boundary value of the second interval is less than the right boundary value of the first interval, the result is a new interval, whose left boundary value is the next value of the right boundary value of the second interval, and whose right boundary value is the right boundary value of the first interval;

[0200] When the left boundary of the second interval is less than or equal to the left boundary of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary value of the first interval, and the right boundary value of the first interval is less than or equal to the right boundary value of the second interval, the result is empty;

[0201] When the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the second interval, and the right boundary value of the second interval is less than the right boundary value of the first interval, the result is two new intervals; the left boundary value of the first new interval is the left boundary value of the first interval, and the right boundary value is the previous value of the left boundary value of the second interval; the left boundary value of the second new interval is the next value of the right boundary value of the second interval, and the right boundary is the right boundary value of the first interval.

[0202] Exemplarily, the information screening module 340 is further used to:

[0203] Representing the final visible range as a set of disjoint left and right boundary value intervals as the visible range;

[0204] The visible range is converted into corresponding query conditions to filter out information items that meet the user's authority within the final visible range.

[0205] It should be noted here that the above-mentioned information authority management device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0206] Figure 4 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 4 As shown, the electronic device may include: a processor (Processor) 410, a communication interface (Communications Interface) 420, a memory (Memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the information rights management method.

[0207] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including a number of instructions to ensure that a computer device (which can be a personal computer, a server, or a network device, etc.) executes all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0208] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the information rights management method provided by the above methods.

[0209] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the information rights management method provided above.

[0210] The embodiments of the present application provide an electronic device, a computer program product, and a processor-readable storage medium, on which the computer program stored enables the processor to implement all the method steps implemented in the above-mentioned method embodiments and to achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiments will not be described in detail herein.

[0211] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0212] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions to ensure that a computer device (which can be a personal computer, a server, or a network device, etc.) executes the methods described in each embodiment or some parts of the embodiments.

[0213] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An information rights management method, characterized in that: The method comprises: Receive information access requests initiated by users and extract the user's identity data; According to the extracted identity data, a preset permission rule is obtained, wherein the permission rule defines the visible and invisible rules of all users in information access; Obtain the codes of visible and invisible organizations in the permission rule, and calculate the visible and invisible scopes of the user in the organization; According to the calculated visible range, filter the information entries that meet the user's permissions.

2. The information rights management method according to claim 1, characterized in that: The method further comprises constructing a code of the organization, the process comprising: Initialize a global counter and set its initial value to a pre-specified value; Starting from the root node of the organization structure tree, assign left and right boundary values ​​to each node: when a node is first visited, record its left boundary value as the current value of the global counter plus one; recursively traverse all child nodes of the node; after completing the traversal of all child nodes of the node, record its right boundary value as the current value of the global counter plus one; Repeat this process until all nodes of the entire organizational structure tree are traversed to complete the encoding.

3. The information rights management method according to claim 2, characterized in that: The method also includes verifying the coding of the organization, the process comprising: Make sure that for any node, its left edge value is less than the left edge values ​​of all its child nodes; Make sure that for any node, its right edge value is greater than the right edge values ​​of all its child nodes; Confirm that the left and right boundary value intervals of any node represent the range of numeric intervals covered by the subtree with it as the root.

4. The information rights management method according to claim 1, characterized in that: The steps of obtaining the codes of visible and invisible organizations in the permission rule and calculating the visible and invisible ranges of the user in the organization include: A set of predefined left and right boundary value intervals are used to define visible rules; For a node, if its left and right boundary values ​​fall within the predefined visible interval, the following conditions are met at the same time: The left boundary value of the predefined interval is not greater than the left boundary value of the node; The left boundary value of the node is less than its right boundary value; The right boundary value of the node is not greater than the right boundary value of the predefined interval; It is determined that the node is visible to the current user.

5. The information rights management method according to claim 1, characterized in that: The step of obtaining the codes of visible and invisible organizations in the permission rule and calculating the visible and invisible ranges of the user in the organization comprises: A set of predefined left and right boundary value intervals are used to define non-visible rules; For a node, if its left and right boundary values ​​fall within the predefined non-visible interval, the following conditions are met at the same time: The left boundary value of the predefined interval is not greater than the left boundary value of the node; The left boundary value of the node is less than its right boundary value; The right boundary value of the node is not greater than the right boundary value of the predefined interval; It is determined that the node is not visible to the current user.

6. The information rights management method according to claim 1, characterized in that: The step of calculating the visible and invisible ranges of the user in the organization includes: Merge all visible intervals in the permission rules to obtain a preliminary visible range; For any two intervals in the initial visible range, if they have an intersection, the union of the two intervals will form a new interval, the left boundary value of the new interval is the minimum value of the left boundary values ​​of the two intervals, and the right boundary value is the maximum value of the right boundary values ​​of the two intervals; If there is no intersection between any two intervals in the preliminary visible range, the two intervals are independently retained in the preliminary visible range.

7. The information rights management method according to claim 6, characterized in that: The step of calculating the visible and invisible ranges of the user in the organization also includes: From the preliminary visible range, remove each non-visible interval one by one to construct the final visible range; For any two intervals in the final visible range, if there is an intersection between them, the interval difference operation is performed on the two intervals to eliminate the overlapping parts; If any two intervals in the final visible range do not have an intersection, an interval difference operation is performed on the two intervals to retain the subtracted interval.

8. The information rights management method according to claim 7, characterized in that: If there is an intersection between them, the step of performing an interval difference operation on the two intervals to eliminate the overlapping part includes: When the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the first interval, and the right boundary value of the first interval is less than the right boundary value of the second interval, the result is a new interval, whose left boundary value is the left boundary value of the first interval, and the right boundary value is the previous value of the left boundary value of the second interval; When the left boundary value of the second interval is less than or equal to the left boundary value of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary value of the second interval, and the right boundary value of the second interval is less than the right boundary value of the first interval, the result is a new interval, whose left boundary value is the next value of the right boundary value of the second interval, and whose right boundary value is the right boundary value of the first interval; When the left boundary of the second interval is less than or equal to the left boundary of the first interval, and the left boundary value of the first interval is less than or equal to the right boundary value of the first interval, and the right boundary value of the first interval is less than or equal to the right boundary value of the second interval, the result is empty; When the left boundary value of the first interval is less than the left boundary value of the second interval, and the left boundary value of the second interval is less than or equal to the right boundary value of the second interval, and the right boundary value of the second interval is less than the right boundary value of the first interval, the result is two new intervals; the left boundary value of the first new interval is the left boundary value of the first interval, and the right boundary value is the previous value of the left boundary value of the second interval; the left boundary value of the second new interval is the next value of the right boundary value of the second interval, and the right boundary is the right boundary value of the first interval.

9. The information rights management method according to claim 7, characterized in that: The step of filtering information items that meet the user's authority according to the calculated visible range includes: Representing the final visible range as a set of disjoint left and right boundary value intervals as the visible range; The visible range is converted into corresponding query conditions to filter out information items that meet the user's authority within the final visible range.

10. An information rights management device, characterized in that: The device comprises: A user identification module is used to receive information access requests initiated by users and extract the user's identity identification data; The permission acquisition module is used to acquire preset permission rules based on the extracted identity recognition data, wherein the permission rules define visible and invisible rules for all users in information access; A range calculation module is used to obtain the codes of visible and invisible organizations in the permission rule and calculate the visible and invisible ranges of the user in the organization; The information filtering module is used to filter information items that meet the user's permissions based on the calculated visible range.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the information rights management method according to any one of claims 1 to 10 are implemented.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the information rights management method according to any one of claims 1 to 10 are implemented.

Images