Refined authority control data management system

Abstract

The invention relates to the technical field of information security, and discloses a refined authority control data management system, which comprises an authority control module used for setting refined data modification authority according to roles and responsibilities of users and ensuring that only authorized users can modify specific data; and the operation recording module is used for recording each data modification operation of the user, including modification time, modification content, data states before and after modification and the like, so as to facilitate subsequent auditing and tracing. Through refined authority control and real-time verification, unauthorized modification operation and wrong modification operation are effectively prevented, the accuracy and safety of data modification are improved, through centralized management of the data management platform, the consistency and integrity of data are ensured, meanwhile, the maintainability and expandability of the system are improved, and the system is suitable for popularization and application. And the data management platform adopts a modular design, so that subsequent function expansion and upgrading are facilitated.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a refined authority control data management system. Background Art

[0002] In the current information-based production environment, the database plays a core role, storing a large amount of production data and business information. However, there is a high risk in modifying data directly in the database, because any inaccurate modification may lead to data errors, which in turn affects production efficiency and product quality, and may even cause production accidents. At present, there are many methods to try to solve this problem, such as data backup, recovery mechanism and permission control.

[0003] The prior art solution closest to the present invention mainly implements the supervision and control of data modification by setting database administrator permissions and audit logs. However, this solution still has the following limitations: first, the permission setting is relatively rough, and it is impossible to accurately control the modification permissions of each data item; second, although the audit log can record the history of data modification, it cannot prevent erroneous modification operations in real time. For this reason, those skilled in the art have proposed a refined permission control data management system to solve the above problems. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a refined authority control data management system, which solves the problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a refined authority control data management system, comprising:

[0006] The permission control module is used to set refined data modification permissions based on the user's role and responsibilities, ensuring that only authorized users can modify specific data;

[0007] The operation record module is used to record each data modification operation of the user, including modification time, modification content, data status before and after modification, etc., to facilitate subsequent audit and tracing;

[0008] The real-time verification module is used to verify the data in real time during the data modification process. Once an error or abnormality is found, the modification operation is immediately blocked and the administrator is notified to handle it.

[0009] The identity authentication module is responsible for verifying the user's identity information to ensure that only authenticated users can use the system;

[0010] The role management module is used to provide the functions of creating, editing and deleting roles, and manage the permission settings of different user roles in the system;

[0011] The approval process management module is used to support the setting and management of the approval process for data modification operations. When a user submits a modification request, the system can control the process and assign approvers according to the preset approval rules to ensure that the modification operation is properly reviewed and authorized.

[0012] Data backup and recovery module, used to automatically back up important data in the system regularly and provide data recovery function to prevent problems caused by data loss or accidental modification;

[0013] The report and analysis module provides statistical reports and analysis functions for data access, authority control, and operation records. Administrators can use reports to understand system usage, the rationality of authority allocation, and the trend of operation records, so as to make system optimization and management decisions.

[0014] The abnormal monitoring and alarm module is used to monitor the system's operating status and data access behavior in real time. Once abnormal activities or illegal access are found, an alarm will be immediately issued to notify the administrator. This module can help respond to security threats and system failures in a timely manner.

[0015] Preferably, the authority control module includes:

[0016] The permission allocation unit is responsible for defining and managing the access rights of users or roles to data and system functions;

[0017] Access control policy management unit, used to provide an interface or tool for managing and configuring access control policies;

[0018] Approval and workflow unit, used to support the setting and management of approval processes for data access and modification operations;

[0019] The dynamic permission adjustment unit is used to adjust the user's permissions according to real-time context information.

[0020] Preferably, the real-time verification module includes:

[0021] The data format validation unit is responsible for verifying whether the data format entered by the user meets the expected data type and structure requirements, including checking the date format, number range, string length, etc.

[0022] The logic verification unit is used to perform data verification based on logic rules to ensure that the logical relationship and constraint conditions of the data are met;

[0023] The permission verification unit is used to verify whether the user has the permission to perform a specific operation based on the user's identity and role;

[0024] Real-time data integrity check unit, used to verify the integrity of data when writing or modifying data, to ensure that each field or attribute of the data is correctly updated and that data will not be damaged or lost due to operational errors or anomalies;

[0025] The transactional verification unit is used to monitor and verify the transactional nature of data operations to ensure that data modification operations are atomic, that is, either all succeed or all fail.

[0026] Preferably, the real-time verification module further includes:

[0027] Real-time security check unit, used to check whether data access and operations comply with security policies and security requirements;

[0028] Anomaly detection and processing unit, used to capture and process abnormal situations in data access and operation, such as invalid input, system errors or network problems, to ensure that the system can properly handle and feedback when anomalies occur;

[0029] The real-time performance monitoring unit is used to monitor the performance and response time of the real-time verification module to ensure that the system can still quickly respond to and process data verification requests under high load and complex operations.

[0030] Preferably, the approval process management module includes:

[0031] The process definition unit allows administrators or system configuration personnel to define the steps, conditions, and participants of the approval process;

[0032] Approval rule configuration unit, which provides flexible configuration options to define when approval is required, what the conditions for approval are, and how to automatically assign approvers;

[0033] The approval task management unit is responsible for managing and tracking the status and progress of all approval tasks, including the creation of approval tasks, assignment to specific approvers, status updates (such as pending, in progress, completed), timeout processing, etc.

[0034] Preferably, the approval process management module also includes a notification and reminder unit, which is responsible for sending approval request notifications to relevant approval personnel and sending reminders when the task is overdue or there is an important status update.

[0035] Preferably, it also includes an access log module for recording each system login and data access behavior of the user, including information such as login time, accessed data object and operation type.

[0036] Preferably, it also includes an extensibility and customizable module for providing system expansion and customization functions, and supporting customization of authority control strategies and functional modules according to specific business needs.

[0037] Preferably, a compliance management module is also included to provide compliance management functions for regulations and industry standards in data management and authority control.

[0038] Preferably, it also includes a data encryption module for providing encryption and decryption functions for sensitive data to protect the security of data during storage and transmission.

[0039] The present invention provides a refined authority control data management system, which has the following beneficial effects:

[0040] 1. The present invention realizes centralized data management, refined authority control and real-time error modification prevention by introducing a data management platform, thereby eliminating the risk of erroneous data modification and improving the accuracy and security of data modification.

[0041] 2. The present invention reduces the risk of data modification. Through refined permission control and real-time verification, it effectively prevents unauthorized modification operations and erroneous modification operations, and improves the accuracy and security of data modification. Through the centralized management of the data management platform, it ensures the consistency and integrity of the data, while improving the maintainability and scalability of the system. The data management platform adopts a modular design to facilitate subsequent functional expansion and upgrading. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Example:

[0045] Please refer to the attached Figure 1 The embodiment of the present invention provides a refined authority control data management system, including:

[0046] The permission control module is used to set refined data modification permissions based on the user's role and responsibilities, ensuring that only authorized users can modify specific data;

[0047] Specifically include:

[0048] Fine-grained permission management: allows administrators to set detailed read, write, and modify permissions based on user roles, departments, and even specific data objects or fields. For example, an administrator can set a role to only read certain fields in a specific database table, or only modify specific attributes of a specific data object.

[0049] Dynamic permission adjustment: Supports dynamic adjustment of permissions based on actual business needs. Administrators can change the permission settings of roles at any time, which will take effect immediately, and ensure that the system updates and applies permission adjustments in real time

[0050] The operation record module is used to record each data modification operation of the user, including modification time, modification content, data status before and after modification, etc., to facilitate subsequent audit and tracing;

[0051] Specifically include:

[0052] Comprehensive operation records: Record every data access and modification operation, including detailed information such as user identity, operation time, operation type, and operation content. Each modification should include the data status before and after the modification for audit and traceability.

[0053] Audit logs and reports: Provides the function of generating audit logs and reports. Administrators can query and analyze the operation history within a specific time period as needed to verify the legitimacy and integrity of the operations.

[0054] The real-time verification module is used to verify the data in real time during the data modification process. Once an error or abnormality is found, the modification operation is immediately blocked and the administrator is notified to handle it.

[0055] Specifically include:

[0056] Data integrity check: When a user submits a data modification request, a data integrity check is performed immediately to ensure that all modification operations comply with the preset data format, constraints, and business rules.

[0057] Exception handling and notification: When a data modification request is found to contain an error or violate the rules, the system should immediately block the modification operation and send an alert to notify the relevant administrator to handle it. The notification can be achieved through the system interface, email or SMS.

[0058] The identity authentication module is responsible for verifying the user's identity information to ensure that only authenticated users can use the system;

[0059] The role management module is used to provide the functions of creating, editing and deleting roles, and manage the permission settings of different user roles in the system;

[0060] Specifically include:

[0061] Custom roles and permission combinations: Allow administrators to create custom roles based on organizational structure and business needs, and assign specific permission combinations to each role.

[0062] Role inheritance and detailed control: Supports role inheritance and detailed control to ensure that users at different levels can inherit appropriate permissions and make customized adjustments as needed.

[0063] The approval process management module is used to support the setting and management of the approval process for data modification operations. When a user submits a modification request, the system can control the process and assign approvers according to the preset approval rules to ensure that the modification operation is properly reviewed and authorized.

[0064] Data backup and recovery module, used to automatically back up important data in the system regularly and provide data recovery function to prevent problems caused by data loss or accidental modification;

[0065] Specifically include:

[0066] Regularly and automatically back up important data: This module is responsible for regularly and automatically backing up important data in the system. Backups can be performed at predetermined intervals, such as daily, weekly, or monthly. Important data includes user information, business data, system configuration, etc., ensuring that they can be restored in a timely manner in the event of accidental data loss or modification.

[0067] Data recovery function: Provides data recovery function, allowing administrators to select data at a specific time point from the backup to recover. This can effectively prevent data loss caused by misoperation, hardware failure or malicious attack, and ensure the data integrity and reliability of the system.

[0068] The report and analysis module provides statistical reports and analysis functions for data access, authority control, and operation records. Administrators can use reports to understand system usage, the rationality of authority allocation, and the trend of operation records, so as to make system optimization and management decisions.

[0069] Specifically include:

[0070] Data access statistics report: Provides statistics on data access in the system. Administrators can view information such as data access frequency, access volume, and accessed data types by user, role, or department to help evaluate system usage and data flow.

[0071] Permission control analysis: Analyze the rationality of permission allocation to ensure that the permission settings for each role or user group meet the enterprise's security policies and data management requirements. For example, excessive or unauthorized access can be identified, and permissions can be adjusted in a timely manner to reduce security risks.

[0072] Operation record trend analysis: By analyzing the trend of operation records, you can identify frequently occurring operation types, possible problems, or potential improvement points. Administrators can develop strategies to optimize system operations and management decisions based on these analysis results.

[0073] The abnormal monitoring and alarm module is used to monitor the system's operating status and data access behavior in real time. Once abnormal activities or illegal access are found, an alarm will be immediately issued to notify the administrator. This module can help respond to security threats and system failures in a timely manner.

[0074] Specifically include:

[0075] Real-time monitoring of system operation status: Monitor the system's operation status, including performance indicators, resource utilization, and possible abnormal activities. This helps administrators to promptly detect system failures or performance degradation and take prompt measures to repair and optimize.

[0076] Data access behavior monitoring: Real-time monitoring of data access behavior of users or system processes to detect abnormal access patterns or unauthorized data operations. For example, abnormally high-frequency data access and abnormal large-scale data exports can be identified.

[0077] Alerts notify administrators: Once abnormal activity or illegal access is detected, the system will immediately send an alert to notify the relevant administrator. Notifications can be sent via email, SMS or integrated alert platforms, ensuring that administrators can respond and handle potential security threats and system failures in a timely manner.

[0078] The permission control module includes:

[0079] The permission allocation unit is responsible for defining and managing the access rights of users or roles to data and system functions;

[0080] Access control policy management unit, used to provide an interface or tool for managing and configuring access control policies;

[0081] Approval and workflow unit, used to support the setting and management of approval processes for data access and modification operations;

[0082] The dynamic permission adjustment unit is used to adjust the user's permissions according to real-time context information.

[0083] The real-time verification module includes:

[0084] The data format validation unit is responsible for verifying whether the data format entered by the user meets the expected data type and structure requirements, including checking the date format, number range, string length, etc.

[0085] The logic verification unit is used to perform data verification based on logic rules to ensure that the logical relationship and constraint conditions of the data are met;

[0086] The permission verification unit is used to verify whether the user has the permission to perform a specific operation based on the user's identity and role;

[0087] Real-time data integrity check unit, used to verify the integrity of data when writing or modifying data, to ensure that each field or attribute of the data is correctly updated and that data will not be damaged or lost due to operational errors or anomalies;

[0088] The transactional verification unit is used to monitor and verify the transactional nature of data operations to ensure that data modification operations are atomic, that is, either all succeed or all fail;

[0089] The real-time verification module also includes:

[0090] Real-time security check unit, used to check whether data access and operations comply with security policies and security requirements;

[0091] Anomaly detection and processing unit, used to capture and process abnormal situations in data access and operation, such as invalid input, system errors or network problems, to ensure that the system can properly handle and feedback when anomalies occur;

[0092] The real-time performance monitoring unit is used to monitor the performance and response time of the real-time verification module to ensure that the system can still quickly respond to and process data verification requests under high load and complex operations.

[0093] The approval process management module includes:

[0094] The process definition unit allows administrators or system configuration personnel to define the steps, conditions, and participants of the approval process;

[0095] Approval rule configuration unit, which provides flexible configuration options to define when approval is required, what the conditions for approval are, and how to automatically assign approvers;

[0096] The approval task management unit is responsible for managing and tracking the status and progress of all approval tasks, including the creation of approval tasks, assignment to specific approvers, status updates (such as pending, in progress, completed), timeout processing, etc.

[0097] The approval process management module also includes a notification and reminder unit, which is responsible for sending approval request notifications to relevant approvers and sending reminders when the task is overdue or there are important status updates.

[0098] It also includes an access log module, which is used to record each system login and data access behavior of a user, including information such as login time, accessed data object and operation type.

[0099] Specifically include:

[0100] System login records: Records the time of each user's system login, login IP address, device information used, etc. This information is crucial for monitoring the legitimacy and security of system access, and can help administrators track and verify user login behavior.

[0101] Data access records: record detailed information such as the data object, access time, access type (such as read, modify, etc.) accessed by each user. This helps to audit and track the actual operations of users on data in the system and ensure the legality and transparency of data use.

[0102] It also includes extensibility and customizable modules to provide system expansion and customization capabilities, and support customization of permission control strategies and functional modules based on specific business needs.

[0103] It also includes a compliance management module that provides compliance management capabilities for regulations and industry standards in data management and access control.

[0104] It also includes a data encryption module, which is used to provide encryption and decryption functions for sensitive data and protect the security of data during storage and transmission.

[0105] In summary: The present invention realizes centralized data management, refined authority control and real-time error modification prevention by introducing a data management platform, thereby eliminating the risk of erroneous data modification and improving the accuracy and security of data modification. At the same time, the present invention reduces the risk of data modification, effectively prevents unauthorized modification operations and erroneous modification operations through refined authority control and real-time verification, and improves the accuracy and security of data modification. Through the centralized management of the data management platform, the consistency and integrity of the data are ensured, while the maintainability and scalability of the system are improved. The data management platform adopts a modular design, which is convenient for subsequent functional expansion and upgrading.

[0106] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A refined authority control data management system, characterized in that: include: The permission control module is used to set refined data modification permissions based on the user's role and responsibilities, ensuring that only authorized users can modify specific data; The operation record module is used to record each data modification operation of the user, including modification time, modification content, data status before and after modification, etc., to facilitate subsequent audit and tracing; The real-time verification module is used to verify the data in real time during the data modification process. Once an error or abnormality is found, the modification operation is immediately blocked and the administrator is notified to handle it. The identity authentication module is responsible for verifying the user's identity information to ensure that only authenticated users can use the system; The role management module is used to provide the functions of creating, editing and deleting roles, and manage the permission settings of different user roles in the system; The approval process management module is used to support the setting and management of the approval process for data modification operations. When a user submits a modification request, the system can control the process and assign approvers according to the preset approval rules to ensure that the modification operation is properly reviewed and authorized. Data backup and recovery module, used to automatically back up important data in the system regularly and provide data recovery function to prevent problems caused by data loss or accidental modification; The report and analysis module provides statistical reports and analysis functions for data access, authority control, and operation records. Administrators can use reports to understand system usage, the rationality of authority allocation, and the trend of operation records, so as to make system optimization and management decisions. The abnormal monitoring and alarm module is used to monitor the system's operating status and data access behavior in real time. Once abnormal activities or illegal access are found, an alarm will be immediately issued to notify the administrator. This module can help respond to security threats and system failures in a timely manner.

2. A refined authority control data management system according to claim 1, characterized in that: The authority control module includes: The permission allocation unit is responsible for defining and managing the access rights of users or roles to data and system functions; Access control policy management unit, used to provide an interface or tool for managing and configuring access control policies; Approval and workflow unit, used to support the setting and management of approval processes for data access and modification operations; The dynamic permission adjustment unit is used to adjust the user's permissions according to real-time context information.

3. A refined authority control data management system according to claim 1, characterized in that: The real-time verification module comprises: The data format validation unit is responsible for verifying whether the data format entered by the user meets the expected data type and structure requirements, including checking the date format, number range, string length, etc. The logic verification unit is used to perform data verification based on logic rules to ensure that the logical relationship and constraint conditions of the data are met; The permission verification unit is used to verify whether the user has the permission to perform a specific operation based on the user's identity and role; Real-time data integrity check unit, used to verify the integrity of data when writing or modifying data, to ensure that each field or attribute of the data is correctly updated and that data will not be damaged or lost due to operational errors or anomalies; The transactional verification unit is used to monitor and verify the transactional nature of data operations to ensure that data modification operations are atomic, that is, either all succeed or all fail.

4. A refined authority control data management system according to claim 1, characterized in that: The real-time verification module also includes: Real-time security check unit, used to check whether data access and operations comply with security policies and security requirements; Anomaly detection and processing unit, used to capture and process abnormal situations in data access and operation, such as invalid input, system errors or network problems, to ensure that the system can properly handle and feedback when anomalies occur; The real-time performance monitoring unit is used to monitor the performance and response time of the real-time verification module to ensure that the system can still quickly respond to and process data verification requests under high load and complex operations.

5. A refined authority control data management system according to claim 1, characterized in that: The approval process management module includes: The process definition unit allows administrators or system configuration personnel to define the steps, conditions, and participants of the approval process; Approval rule configuration unit, which provides flexible configuration options to define when approval is required, what the conditions for approval are, and how to automatically assign approvers; The approval task management unit is responsible for managing and tracking the status and progress of all approval tasks, including the creation of approval tasks, assignment to specific approvers, status updates (such as pending, in progress, completed), timeout processing, etc.

6. A refined authority control data management system according to claim 1, characterized in that: The approval process management module also includes a notification and reminder unit, which is responsible for sending approval request notifications to relevant approval personnel and sending reminders when the task is overdue or there is an important status update.

7. A refined authority control data management system according to claim 1, characterized in that: It also includes an access log module, which is used to record each system login and data access behavior of a user, including information such as login time, accessed data object and operation type.

8. A refined authority control data management system according to claim 1, characterized in that: It also includes extensibility and customizable modules to provide system expansion and customization capabilities, and support customization of permission control strategies and functional modules based on specific business needs.

9. A refined authority control data management system according to claim 1, characterized in that: It also includes a compliance management module that provides compliance management capabilities for regulations and industry standards in data management and access control.

10. A refined authority control data management system according to claim 1, characterized in that: It also includes a data encryption module, which is used to provide encryption and decryption functions for sensitive data and protect the security of data during storage and transmission.

Images