Enterprise three-member management method and system based on multi-tenant architecture

Abstract

The invention relates to the technical field of management control systems, and discloses an enterprise three-member management method and system based on a multi-tenant architecture, and the method comprises the steps: configuring three-member information of an organization node according to the type of the organization node; configuring three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node; configuring three-member information of enterprise application tenants according to the type of the enterprise application, the type of the organization node and the three-member information of the organization node; through unified configuration and hierarchical management, three-member information of different organization nodes can be effectively managed and configured for a complex organization structure under a multi-tenant architecture, enterprise application and application tenant three-member architecture are rapidly realized, the three-member compliance requirement is met, the management efficiency is improved, and the problem of three-member account data redundancy in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of management control systems, and in particular to an enterprise three-member management method and system based on a multi-tenant architecture. Background Art

[0002] Multi-tenant technology is a software architecture that is widely used in SaaS, cloud computing, enterprise applications, social networks, etc. In different fields, the connotation of "tenant" is different: in the SaaS field, tenants mainly refer to customers; in the cloud computing field, tenants mainly refer to users; in the enterprise application field, tenants mainly refer to organizations within the enterprise; in the social network field, tenants mainly refer to individual users.

[0003] "Three members" is a professional term in computer management systems, referring to system administrators, security and confidentiality administrators, and security auditors. According to national confidentiality regulations and standards, confidential information systems should be equipped with system administrators, security and confidentiality administrators, and security auditors, referred to as "three members". The three members are responsible for the operation and maintenance, security and confidentiality management, and security auditing of confidential information systems. The three members should be strictly reviewed, regularly audited, and remain relatively stable. For confidential units and enterprises, even non-confidential information systems are usually required to be managed by three members.

[0004] In the SaaS field, there are methods to implement the three-member architecture. However, for multi-level complex organizations (enterprise applications with enterprise organizational structures as tenants), the three-member management under its multi-tenant architecture usually meets compliance requirements by automatically initializing the three-member accounts of application tenants, which leads to data redundancy of tenant three-member accounts in multiple applications. The multi-tenant three-member management of related technologies cannot achieve hierarchical control and can only rely on the administrator of the digital base platform for maintenance or initialization. When there is a complex organizational structure, the independent implementation of the three-member management architecture will complicate the background management function. Summary of the invention

[0005] In view of this, the present invention provides an enterprise three-member management method and system based on a multi-tenant architecture to solve the technical problem of how to reduce three-member data redundancy and reduce the complexity of background management functions when the enterprise has a complex organizational structure.

[0006] In a first aspect, the present invention provides an enterprise three-member management method based on a multi-tenant architecture, which is applied to a digital base PaaS platform, and the method includes: obtaining the type of an organization node and the type of an enterprise application, wherein the organization node represents management nodes of different levels within the enterprise, and the enterprise application represents an application pre-registered within the enterprise for enterprise management or business;

[0007] Configure the three-member information of the organization node according to the type of the organization node;

[0008] Configure the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node;

[0009] Configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node, and the three-member information of the organization node;

[0010] When the three-member information of the organization node, the three-member information of the enterprise application, and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

[0011] The embodiment of the present invention first obtains the type of organization node, and configures the three-member information of the organization node according to the type of organization node. And further in turn, the three-member information of the organization node is used to uniformly configure the three-member information of the enterprise application, and finally the three-member information of the enterprise application tenant is configured according to the type of enterprise application, the type of organization node and the three-member information of the organization node. Each tenant and application is configured based on the existing three-member information of the organization node, and there is no need to repeatedly create or initialize the three-member account of the application or tenant. In other words, during the configuration process, it is only necessary to configure the three-member information once for different types of organization nodes to determine the three-member information of the application and the application tenant, instead of initializing the three-member account for each tenant and each application separately in the related art. Therefore, the present invention can reduce data redundancy, and also combines the consideration of enterprise application type to meet the requirements of different applications for three-member management without increasing redundant data.

[0012] In an optional implementation, one organization node corresponds to one or more enterprise applications, one enterprise application corresponds to one or more enterprise application tenants, and the enterprise application tenants include organization tenants and business tenants;

[0013] The organizational tenant represents single tenant information created based on a pre-selected single organizational node, and the business tenant represents combined tenant information created based on a plurality of pre-selected cross-organizational hierarchical organizational nodes.

[0014] In the embodiment of the present invention, an organization node corresponds to one or more enterprise applications, and an enterprise application corresponds to one or more enterprise application tenants. Enterprise application tenants include organization tenants and business tenants. By dividing different users or instances in enterprise applications into two types of tenants, organization tenants and business tenants, in essence, the organization tenant corresponds to a single organization node, avoiding the situation of repeated creation of tenant information and reducing data redundancy. Business tenants are cross-level combined nodes that can integrate related organization nodes together.

[0015] This embodiment effectively avoids the repeated creation and maintenance of the same or similar tenant information in a multi-level organizational structure, and further reduces data redundancy. While providing flexible multi-tenant data isolation capabilities based on administrative organizations, it also meets the multi-tenant data isolation requirements based on business organizations through a rapid configuration method for organizational tenants and business tenants.

[0016] In an optional embodiment, the type of the organization node includes an authority type and a function type; the organization node is divided into a first type of organization node and a second type of organization node according to the authority type, the first type of organization node represents an organization node whose authority meets the preset management authority conditions, and the second type of organization node represents an organization node whose authority does not meet the preset management authority conditions.

[0017] The embodiment of the present invention can more clearly define the management permissions of different levels by distinguishing between organization nodes with independent management permissions and organization nodes without independent management permissions, thereby providing a data basis for subsequent three-member configuration. Organization nodes that do not meet the preset management permission conditions also do not have the authority to independently configure three-member information, thereby reducing the redundancy of three-member accounts.

[0018] In an optional implementation manner, configuring the three-member information of the organization node according to the type of the organization node specifically includes:

[0019] Configure the three-member information of the first type of organization node according to the preset three-member information;

[0020] Determine the hierarchical management relationship between the organizational nodes of the enterprise according to the permission type of the organizational nodes;

[0021] According to the hierarchical management relationship between the organizational nodes of the enterprise, the three-member information of the second-type organizational node is configured as the three-member information of the first-type organizational node to which it belongs.

[0022] In the embodiment of the present invention, by reasonably classifying organization nodes and reusing the three-member information of the upper-level organization nodes, the account redundancy problem in the multi-tenant system is effectively reduced, while simplifying the enterprise management process, thereby improving the overall management efficiency.

[0023] In an optional implementation, configuring the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node specifically includes:

[0024] According to the preset management authority query rule, searching for authority types corresponding to a plurality of the first-category organization nodes, and obtaining a first target organization node therefrom, wherein the first target organization node indicates that the authority it possesses is greater than that of any other first-category organization node;

[0025] The three-member information of the enterprise application is configured according to the permission information of the first target organization node.

[0026] In an embodiment of the present invention, under a multi-tenant architecture, different organizational nodes may have different permissions and three-member configuration requirements. By using the node with the greatest authority and management capabilities as the only management node for enterprise applications, the permissions of multiple tenants can be managed in a unified manner, reducing repeated configurations across nodes and redundant application accounts.

[0027] In an optional implementation, the type of the enterprise application includes multiple demand function types, and configuring the three-member information of the enterprise application tenant according to the type of the enterprise application, the type of the organization node, and the three-member information of the organization node specifically includes:

[0028] Determine tenant condition query rules based on the type of enterprise application;

[0029] Searching for the function types of the plurality of organization nodes according to the tenant condition query rule, and obtaining a second target organization node therefrom, wherein the second target organization node indicates that the function type implemented by the second target organization node is the same as any required function type of an enterprise application;

[0030] Determining the application tenant type of the second target organization node according to the permission type of the second target organization node;

[0031] When the application tenant type of the second target organization node is an organization tenant, the three-member information of the corresponding enterprise application tenant is configured according to the three-member information of the second target organization node;

[0032] When the application tenant type of the second target organization node is a business tenant, the three-member information of the enterprise application tenant corresponding to the second target organization node is configured according to the three-member information of the first type of organization node to which the second target organization node belongs.

[0033] The embodiment of the present invention can automatically find the organization node that needs to be configured through predefined rule conditions, and automatically configure the tenant information according to its permission type. This embodiment is equivalent to allowing multiple organization nodes to share the same set of three-member information. For nodes with similar permissions or clear subordinate relationships, by binding the organization nodes that do not have independent management qualifications to their superior organization nodes, it is avoided to create independent tenant information for each small business node, thereby reducing unnecessary repeated configuration and reducing the redundancy of three-member accounts.

[0034] In a second aspect, the present invention provides a system for enterprise three-member management based on a multi-tenant architecture, which is applied to a digital base PaaS platform. The system includes:

[0035] A type acquisition module is used to obtain the type of the organization node and the type of the enterprise application;

[0036] An organization node three-member configuration module, used to configure the three-member information of the organization node according to the type of the organization node, wherein the organization node represents the management nodes of different levels within the enterprise;

[0037] An application three-member configuration module, used to configure the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node, wherein the enterprise application represents an application pre-registered within the enterprise for enterprise management or business;

[0038] The tenant three-member configuration module is used to configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node and the three-member information of the organization node; among which, when the three-member information of the organization node, the three-member information of the enterprise application and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

[0039] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the enterprise three-member management method based on a multi-tenant architecture of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the enterprise three-member management method based on a multi-tenant architecture of the above-mentioned first aspect or any corresponding embodiment thereof.

[0041] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the enterprise three-member management method based on a multi-tenant architecture of the above-mentioned first aspect or any corresponding embodiment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a flowchart of a method for managing three members of an enterprise based on a multi-tenant architecture according to an embodiment of the present invention;

[0044] Figure 2 is a multi-tenant management class diagram of an enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention;

[0045] Figure 3 is a flow chart of another enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention;

[0046] Figure 4 It is a schematic diagram of the configuration of the three-member relationship of the organization node and the enterprise application of the enterprise three-member management method based on the multi-tenant architecture according to an embodiment of the present invention;

[0047] Figure 5 It is a schematic diagram of the configuration of the three-member relationship of the organization node and the enterprise application of another enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention;

[0048] Figure 6 1. It is a schematic diagram of the functions of three members of an application tenant according to an enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention;

[0049] Figure 7 is a structural block diagram of a system for enterprise three-member management based on a multi-tenant architecture according to an embodiment of the present invention;

[0050] Figure 8 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0052] In the SaaS field, mature technologies are available for implementing the three-member architecture. However, for complex multi-level organizations with corporate organizations as tenants, the three-member management under the multi-tenant architecture usually meets compliance requirements by automatically initializing the three-member accounts of tenants, which will lead to data redundancy of the three-member accounts of tenants in multiple applications. At present, no effective technical methods or feasible solutions have been found to solve this problem of data redundancy of three-member accounts.

[0053] An enterprise three-member management method based on a multi-tenant architecture provided by an embodiment of the present invention is applied to multi-level organizational management scenarios of large enterprises. For example, different departments and levels may require different three-member configuration requirements. Through unified configuration and hierarchical management, for the complex organizational structure under the multi-tenant architecture, the three-member information of different organizational nodes can be effectively managed and configured, redundancy can be reduced, management efficiency can be improved, and the data redundancy problem in the prior art can be solved.

[0054] According to an embodiment of the present invention, an embodiment of an enterprise three-member management method based on a multi-tenant architecture is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0055] In this embodiment, a method for managing three members of an enterprise based on a multi-tenant architecture is provided, which is applied to a digital base PaaS platform. Figure 1 is a flow chart of an enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0056] Step S101 , obtaining the type of organization node and the type of enterprise application, wherein the organization node represents management nodes of different levels within the enterprise, and the enterprise application represents applications pre-registered within the enterprise for enterprise management or business.

[0057] It should be noted that organization nodes refer to management units at different levels within an enterprise, such as group headquarters, branches, departments, etc. Enterprise applications refer to application programs used for management or business within an enterprise, such as financial systems, human resources systems, etc.

[0058] It can be understood that step S101 is mainly to make basic preparations for the subsequent three-member configuration. By identifying organizational nodes and enterprise applications at different levels, the configuration of the three-member information can be guaranteed to be accurate.

[0059] Specifically, in a package multi-level organization enterprise architecture, the types of organization nodes are first identified, and then the types of enterprise applications running on these organization nodes are further identified, such as ERP (asset management application system), CRM (customer relationship management application system), financial management system, etc.

[0060] Step S102, configuring the three-member information of the organization node according to the type of the organization node.

[0061] It should be noted that the three-member information refers to the information of three types of administrators who assume different management responsibilities in the enterprise system, namely, system administrators, security and confidentiality administrators, and security auditors.

[0062] It is understandable that the required administrators are configured according to the types of organizational nodes at different levels. For example, at a high-level organizational node such as the group headquarters, the three members that need to be configured may include a system administrator, a security and confidentiality administrator, and a security auditor. The three-member information of the configured organizational node can serve as the basis for the three-member enterprise application and the three-member application tenant in the subsequent steps. Once the three-member information of the organizational node has been determined, the personnel corresponding to the three-member information of the organizational node have the authority to manage enterprise applications and application tenants, and there is no need to create other redundant accounts to manage enterprise applications and application tenants.

[0063] For example, a certain group-institute-institute three-level organization is managed by the platform management staff of the digital base platform, and the hierarchical organization management staff of the top-level organization node is configured, such as the organization management staff of the group headquarters / institute node. The organization management staff of the institute-level node creates the organization management staff of the lower-level node institute-level unit, and the organization node management staff maintains the identity data information of the organization (including departments), personnel, users, etc. of each unit node. The organization management staff is only configured on the organization node of the unit type, and the department-type organization node is not configured with an administrator.

[0064] Step S103, configuring the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node.

[0065] It should be noted that according to the type of organization node and its corresponding three-member information, the system will configure the three-member information of the enterprise application. The three-member information of the enterprise application refers to the three-member information related to a specific application (such as the above-mentioned ERP, CRM, etc.).

[0066] Specifically, the mapping relationship of the three-member information of the organization node is used to automatically configure the three members of the enterprise application associated with the node. For example, if an application system is running at the group headquarters, the system administrator, security and confidentiality administrator, and security auditor of the application can be automatically configured as the corresponding three members of the group headquarters.

[0067] Step S104, configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node and the three-member information of the organization node. When the three-member information of the organization node, the three-member information of the enterprise application and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

[0068] It should be noted that enterprise application tenants refer to different users or instances of enterprise applications in a multi-tenant architecture, and tenant three-member information refers to the three-member information related to a specific tenant.

[0069] Specifically, the three-member information of different tenants is automatically configured through the mapping of organization nodes and applications. For example, if a tenant is bound to a department node, and the department is not configured with three-member information, it is traced back to the parent organization node of the department and its three-member information is used as the tenant's three-member information.

[0070] In an embodiment of the present invention, step S101 first identifies the organization node type and the enterprise application type to prepare for the subsequent three-member configuration. Step S102 configures the three-member information according to different organization node types to ensure that each management level has the correct system administrator, security and confidentiality administrator, and security auditor. Step S103 uses the configured organization node three-member information to automatically configure the three-member information of the enterprise application associated with it, thereby reducing the process of repeated account configuration, and automatically configures the application tenant three-member information in a multi-tenant environment according to the enterprise application type, organization node type and its three-member information, to ensure that the management requirements of different tenants are met.

[0071] In addition, the responsibilities of the three members of the organization node, the three members of the enterprise application, and the three members of the enterprise application tenant are basically the same. Under the three-member architecture, different types of personnel assume different responsibilities to ensure the security of the organization and the effective management of the confidential information system. Among them, the system administrator is responsible for the daily operation and maintenance of the confidential information system, the creation, modification and deletion of user accounts, the setting and maintenance of user permissions, the backup and recovery of data, the monitoring of the system operation status, etc. The security and confidentiality administrator is responsible for the security and confidentiality management of confidential information within the organization, controls the access rights to confidential information, regularly checks and evaluates the security of confidential information systems, etc. The security auditor is responsible for collecting, analyzing and storing the audit logs of the system, auditing the security and confidentiality management of confidential information systems, regularly checking the system's operation records and user behavior, generating security audit reports, etc. This embodiment will not be repeated here.

[0072] The embodiment of the present invention first obtains the type of organization node, and configures the three-member information of the organization node according to the type of organization node. And further in turn, the three-member information of the organization node is used to uniformly configure the three-member information of the enterprise application, and finally the three-member information of the enterprise application tenant is configured according to the type of enterprise application, the type of organization node and the three-member information of the organization node. Each tenant and application is configured based on the existing three-member information of the organization node, and there is no need to repeatedly create or initialize the three-member account of the application or tenant. In other words, during the configuration process, it is only necessary to configure the three-member information once for different types of organization nodes to determine the three-member information of the application and the application tenant, instead of initializing the three-member account for each tenant and each application separately in the related art. Therefore, the present invention can reduce data redundancy. And it also combines the consideration of the type of enterprise application, and meets the requirements of different applications for three-member management without increasing redundant data.

[0073] In an optional implementation, one organization node corresponds to one or more enterprise applications, one enterprise application corresponds to one or more enterprise application tenants, and the enterprise application tenants include organization tenants and business tenants;

[0074] The organizational tenant represents single tenant information created based on a pre-selected single organizational node, and the business tenant represents combined tenant information created based on a plurality of pre-selected cross-organizational hierarchical organizational nodes.

[0075] It should be noted that enterprise application tenants refer to different users or instances of enterprise applications in a multi-tenant architecture. The enterprise application system administrator is responsible for the quick configuration of application tenants. The configuration of application tenants relies on the pre-set organizational structure tree to quickly create and configure two types of tenant relationships: organizational tenants and business tenants. In the process of code implementation, the class diagram of multi-tenant management can be referred to Figure 2 The application owner class (organization node) and the enterprise application class have a one-to-many relationship, while the enterprise application class and the application tenant class have a one-to-many relationship. The application tenant class and the tenant class have a one-to-many relationship. The tenant class includes two categories, the organization tenant class and the business tenant class, which inherit the parent tenant class respectively.

[0076] In a specific embodiment, when creating an organizational tenant, the organizational tenant information corresponding to the organizational node is created based on the single organizational node (such as a unit node or a department node) selected during the configuration process. There is a one-to-one relationship between an organizational tenant and an organizational node. The organizational tenant information contains the organizational ID information of the selected organizational node. For example, if a college-level node on the organizational tree is selected in Application 1, the system will create a corresponding independent college-level tenant information and form a relationship between Application 1 and the college-level tenant, which is called an application tenant relationship. If the college-level tenant has been created by other applications, it will not be created repeatedly.

[0077] In another specific embodiment, the creation of a business tenant is based on a combination of multiple organizational nodes across organizational levels. During the configuration process, multiple cross-level organizational nodes (including unit nodes and department nodes) are selected to create business tenant information in a combined manner. The business tenant information records multiple cross-level organizational information bound to the business tenant. For example, if the quality department of the headquarters and the quality department of the subordinate factory are selected as two cross-level nodes to form a quality management business relationship, a quality management business tenant can be created, and the list of these bound organizational nodes will be saved in the business tenant information.

[0078] In the embodiment of the present invention, an organization node corresponds to one or more enterprise applications, and an enterprise application corresponds to one or more enterprise application tenants. Enterprise application tenants include organization tenants and business tenants. By dividing different users or instances in enterprise applications into two types of tenants, organization tenants and business tenants, the organization tenants essentially correspond to a single organization node, avoiding the repeated creation of tenant information and reducing data redundancy. Business tenants are cross-level combined nodes that can integrate related organization nodes together. This embodiment effectively avoids the repeated creation and maintenance of the same or similar tenant information in a multi-level organizational structure, and further reduces data redundancy. While providing flexible multi-tenant data isolation capabilities based on administrative organizations, it also meets the multi-tenant data isolation requirements based on business organizations through a rapid configuration method for organization tenants and business tenants.

[0079] In an optional embodiment, the type of the organization node includes an authority type and a function type; the organization node is divided into a first type of organization node and a second type of organization node according to the authority type, the first type of organization node represents an organization node whose authority meets the preset management authority conditions, and the second type of organization node represents an organization node whose authority does not meet the preset management authority conditions.

[0080] It should be noted that the first type of organizational nodes refers to those nodes whose permissions meet the preset management permission conditions. The preset management permission conditions refer to organizations with legal person qualifications, independent business qualifications, independent management qualifications and other conditions. For example, an enterprise's group headquarters JT, the group YY branch with legal person qualifications, and the YYZ factory with legal person qualifications under the branch of the group YY branch all belong to the first type of organizational nodes. The second type of organizational nodes refers to those nodes whose permissions do not meet the preset management permission conditions. In other words, they do not have independent legal person qualifications or other independent management conditions. For example, a department within a factory (such as a department) does not have legal person qualifications and is therefore classified as a second type of organizational node.

[0081] The embodiment of the present invention can more clearly define the management permissions of different levels by distinguishing between organization nodes with independent management permissions and organization nodes without independent management permissions, thereby providing a data basis for subsequent three-member configuration. Organization nodes that do not meet the preset management permission conditions also do not have the authority to independently configure three-member information, thereby reducing the redundancy of three-member accounts.

[0082] In this embodiment, a method for managing three members of an enterprise based on a multi-tenant architecture is provided, which is applied to a digital base PaaS platform. Figure 3 is a flow chart of an enterprise three-member management method based on a multi-tenant architecture according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0083] Step S301, obtaining the type of organization node and the type of enterprise application, wherein the organization node represents the management nodes of different levels within the enterprise, and the enterprise application represents the application pre-registered within the enterprise for enterprise management or business. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0084] Step S302, configuring the three-member information of the organization node according to the type of the organization node.

[0085] Specifically, step S302 includes:

[0086] Step S3021, configure the three-member information of the first type of organization node according to the preset three-member information.

[0087] Step S3022: Determine the hierarchical management relationship between the organizational nodes of the enterprise according to the permission type of the organizational nodes.

[0088] Step S3023, according to the hierarchical management relationship between the organizational nodes of the enterprise, the three-member information of the second-type organizational node is configured as the three-member information of the first-type organizational node to which it belongs.

[0089] It should be noted that the preset three-member information refers to the pre-defined account information corresponding to the three members, which is predetermined according to the personnel relationship of the management level in the enterprise. For example, the account information of the designated personnel in the corporate headquarters or JT headquarters will be configured as the preset value.

[0090] For example, Figure 4 As shown, JT headquarters, YY, YYZ factories and SR are first-type organization nodes with independent legal personality, while JT Financial Center and JT Information Center do not have legal personality, are second-type organization nodes, and belong to JT headquarters. Therefore, the three members of JT Financial Center and JT Information Center are set as the three members of JT headquarters, and there is no need to add new three-member information separately (such as the three-member accounts of JT Financial Center).

[0091] Understandably, in a multi-tenant architecture, if each organization node is configured with independent three-member information, a large amount of redundant account data will be generated, increasing the complexity and management burden of the system. By reusing the three-member information of the first type of organization node, not only the redundant data in the system is reduced, but also the system management work is simplified.

[0092] In the embodiment of the present invention, by reasonably classifying organization nodes and reusing the three-member information of the upper-level organization nodes, the account redundancy problem in the multi-tenant system is effectively reduced, while simplifying the enterprise management process, thereby improving the overall management efficiency.

[0093] Step S303, configuring the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node.

[0094] Specifically, step S303 includes:

[0095] Step S3031, searching for permission types corresponding to a plurality of first-category organization nodes according to preset management permission query rules, and obtaining a first target organization node therefrom, wherein the first target organization node represents that the permission it possesses is greater than that of any other first-category organization node.

[0096] Step S3032: configure the three-member information of the enterprise application according to the permission information of the first target organization node.

[0097] It should be noted that the first-class organization node itself already has the conditions for preset management authority, but the size of the authority of each first-class organization node is also different. From the perspective of the enterprise, the enterprise application is a management tool that the entire enterprise needs to use. Therefore, the node with the greatest authority among the first-class organization nodes, that is, the first target organization node, should be obtained as the management node of the enterprise application.

[0098] For example, as mentioned above Figure 4 As shown, JT headquarters, YY, YYZ factories and SR are first-class organizational nodes with independent legal personality, among which the management authority of JT headquarters is the highest authority, so the three-member information of application 1 is directly set to the three-member information of JT headquarters.

[0099] In addition, during the initial configuration of the enterprise application, the digital base platform provides the management function of the application management background based on the organization to which the application owner belongs. The application administrator performs the management and maintenance of the background. Under the three-member architecture, the application administrator is defined as one of the three members, namely the application system administrator, the application security and confidentiality administrator, and the application security auditor. The initial registration of the enterprise application can be completed through the automatic registration interface or the manual registration of the platform administrator. After the registration is completed, the system will automatically initialize the application three-member account to the three-member account of the application owner organization: the application system administrator will be automatically configured as the system administrator of the owner organization, the application security and confidentiality administrator will be automatically configured as the security and confidentiality administrator of the owner organization, and the application security auditor will be automatically configured as the security auditor of the owner organization. It can be understood that once the initial configuration of the application three members is completed, the three-member information is automatically saved. In essence, the enterprise application three-member information is the configuration relationship between the application and the three-member account.

[0100] In an embodiment of the present invention, under a multi-tenant architecture, different organizational nodes may have different permissions and three-member configuration requirements. By using the node with the greatest authority and management capabilities as the only management node for enterprise applications, the permissions of multiple tenants can be managed in a unified manner, reducing repeated configurations across nodes and redundant application accounts.

[0101] Step S304, configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node and the three-member information of the organization node; when the three-member information of the organization node, the three-member information of the enterprise application and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

[0102] Specifically, step S304 includes:

[0103] Step S3041: Determine tenant condition query rules according to the type of enterprise application.

[0104] Step S3042, searching for the function types of the plurality of organization nodes according to the tenant condition query rule, and obtaining a second target organization node therefrom, wherein the second target organization node indicates that the function type implemented by the second target organization node is the same as any required function type of the enterprise application.

[0105] Step S3043: determine the application tenant type of the second target organization node according to the permission type of the second target organization node.

[0106] Step S3044: When the application tenant type of the second target organization node is an organization tenant, the three-member information of the corresponding enterprise application tenant is configured according to the three-member information of the second target organization node.

[0107] Step S3045: When the application tenant type of the second target organization node is a business tenant, the three-member information of the enterprise application tenant corresponding to the second target organization node is configured according to the three-member information of the first type of organization node to which the second target organization node belongs.

[0108] In a specific embodiment, the tenant condition query rule refers to the search condition rule for the organization nodes that jointly participate in or use a certain enterprise application. The functional type of the organization node is the corresponding responsibility business type of the organization node. For example, when the type of the enterprise application is financial, all the organization nodes of the financial type need to use the enterprise application. Therefore, the tenant condition query rule is to find all the organization nodes whose functional type is financial, that is, the second target organization node. Once the second target organization node is found, the application tenant type corresponding to the second target organization node is determined, and then the three-member configuration of the application tenant is performed based on the application tenant type.

[0109] For example, see Figure 5, the second target organization nodes of JT application 1 are JT Financial Center, YY, YYZ Factory and Business Tenant 1. Among them, JT Financial Center, YY, and YYZ Factory are all organization tenants, and the business tenant contains two organization node sequences, namely YY Department 1 and Quality Department. The Quality Department belongs to YYZ Farm, and YY Department 1 belongs to YY. However, since YY Department 1 and Quality Department do not have independent management qualifications and do not meet the preset authority conditions, the three-member information of their application tenants is set to the three-member information of YY belonging to YY Department 1 and the three-member information of YYZ Factory belonging to the Quality Department.

[0110] In another specific embodiment, when the selected organization node is of unit type, the corresponding application tenant three members will be automatically configured as the organization three members of the unit type organization node. When the selected organization node is of department type, the application tenant three members will be automatically configured as the organization three members of the unit type organization node to which the department directly belongs. Among them, for the application tenant whose tenant type is a business tenant, the three-member information will be configured in the following manner: (1) Trace back the selected organization node until the parent organization node whose organization type is a unit type is found, and use the organization three members of the node as the application tenant three members. (2) If the business tenant spans two first-level organization nodes, and the root node is a system built-in node and has no organization three members, then its application tenant three members default to the application three members, and the tenant background management is directly performed by the application three-member account. After completing the application tenant three-member mapping, save the application tenant three-member information. The essence of the application tenant three-member information is to record and manage the configuration relationship between the application tenant and the three-member account.

[0111] It can be understood that the hierarchical management and control characteristics of the three members of the organization in the embodiment of the present invention are realized by defining the superior-subordinate management and control mode of the organization. The three members of the organization node under the unified management mode are managed and maintained by the three members of the organization of the superior unit. After being mapped to the three tenant members of the enterprise application through the method of the present invention, the hierarchical management and control mode of the three members of the organization is automatically carried at the level of application tenant three member account management. However, the multi-tenant three members realized by the related technology only consider the maintenance by the administrator of the digital base platform base or the simple initialization built-in, and the three-member account management cannot realize the hierarchical management and control capabilities.

[0112] In addition, the application tenant system administrator, application tenant security administrator, and application tenant audit administrator each have different functions. Figure 6, the application tenant system administrator is responsible for configuring the tenant's identity data, which is based on the organization node information bound when the tenant is created. Specifically, the identity data information of the application tenant comes from the organization, personnel and user information under the bound organization node. The application tenant security and confidentiality administrator is responsible for managing the role permissions of the tenant based on the identity data such as organization, user and role. The main responsibility of the application tenant audit administrator is to review the operation logs of administrators and users within the scope of this tenant and manage the security audit logs of the tenant. For application tenants that carry hierarchical control features, the audit scope of the audit administrator includes the operation log information of the lower-level application tenants. The audit logs of the lower-level application tenants will be collected level by level and uniformly reviewed and reviewed by the upper-level security audit administrator. In other words, through the unified organizational management of the enterprise and the rapid binding of the organization and the application, the tenant information of the organization type can be automatically created in batches and the configuration information of the application tenant can be saved without manually creating the tenant information. Through the collaboration of the three members of the organization and the three members of the application, the three-member architecture of the application tenant can be quickly implemented to ensure that the three-member compliance requirements are met.

[0113] The embodiment of the present invention can automatically find the organization node that needs to be configured through predefined rule conditions, and automatically configure the tenant information according to its permission type. This embodiment is equivalent to allowing multiple organization nodes to share the same set of three-member information. For nodes with similar permissions or clear subordinate relationships, by binding the organization nodes that do not have independent management qualifications to their superior organization nodes, it is avoided to create independent tenant information for each small business node, thereby reducing unnecessary repeated configuration and reducing the redundancy of three-member accounts.

[0114] In this embodiment, a system for enterprise three-member management based on a multi-tenant architecture is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0115] This embodiment provides a system for enterprise three-member management based on a multi-tenant architecture, which is applied to a digital base PaaS platform, such as Figure 7 As shown, including:

[0116] A type acquisition module 701 is used to acquire the type of the organization node and the type of the enterprise application;

[0117] An organization node three-member configuration module 702 is used to configure three-member information of an organization node according to the type of the organization node, wherein the organization node represents management nodes of different levels within the enterprise;

[0118] The application three-member configuration module 703 is used to configure the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node, wherein the enterprise application represents an application pre-registered within the enterprise for enterprise management or business;

[0119] The tenant three-member configuration module 704 is used to configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node and the three-member information of the organization node; wherein, when the three-member information of the organization node, the three-member information of the enterprise application and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

[0120] In an optional implementation, one organization node corresponds to one or more enterprise applications, one enterprise application corresponds to one or more enterprise application tenants, and the enterprise application tenants include organization tenants and business tenants;

[0121] The organizational tenant represents single tenant information created based on a pre-selected single organizational node, and the business tenant represents combined tenant information created based on a plurality of pre-selected cross-organizational hierarchical organizational nodes.

[0122] In an optional embodiment, the type of the organization node includes an authority type and a function type; the organization node is divided into a first type of organization node and a second type of organization node according to the authority type, the first type of organization node represents an organization node whose authority meets the preset management authority conditions, and the second type of organization node represents an organization node whose authority does not meet the preset management authority conditions.

[0123] In an optional implementation, the organization node three-member configuration module 702 specifically includes:

[0124] The first type three-member configuration unit is used to configure the three-member information of the first type organization node according to the preset three-member information;

[0125] A management relationship determination unit, used to determine the superior-subordinate management relationship between the organization nodes of the enterprise according to the permission type of the organization nodes;

[0126] The second type three-member inheritance unit is used to configure the three-member information of the second type of organization node as the three-member information of the first type of organization node to which it belongs according to the hierarchical management relationship between the organization nodes of the enterprise.

[0127] In an optional implementation, the application three-member configuration module 703 specifically includes:

[0128] A first-category organization node authority query unit, configured to search for authority types corresponding to a plurality of first-category organization nodes according to a preset management authority query rule, and obtain a first target organization node therefrom, wherein the first target organization node indicates that the authority it possesses is greater than that of any other first-category organization node;

[0129] The three-member information configuration unit is used to configure the three-member information of the enterprise application according to the permission information of the first target organization node.

[0130] In an optional implementation, the tenant three-member configuration module 704 specifically includes:

[0131] A tenant condition query rule determination unit, used to determine a tenant condition query rule according to the type of enterprise application;

[0132] A function type search unit is used to search for function types of the plurality of organization nodes according to the tenant condition query rule, and obtain a second target organization node therefrom, wherein the second target organization node indicates that the function type implemented by the second target organization node is the same as any required function type of an enterprise application;

[0133] An application tenant type determination unit, configured to determine the application tenant type of the second target organization node according to the permission type of the second target organization node;

[0134] An organization tenant three-member information configuration unit, used for configuring the three-member information of the corresponding enterprise application tenant according to the three-member information of the second target organization node when the application tenant type of the second target organization node is an organization tenant;

[0135] The business tenant three-member information configuration unit is used to configure the three-member information of the enterprise application tenant corresponding to the second target organization node according to the three-member information of the first type of organization node to which the second target organization node belongs when the application tenant type of the second target organization node is a business tenant.

[0136] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0137] The enterprise three-member management system based on a multi-tenant architecture in this embodiment is presented in the form of functional units, where the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0138] The embodiment of the present invention also provides a computer device having the above Figure 7 The enterprise three-member management system based on multi-tenant architecture is shown.

[0139] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0140] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0141] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0142] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0144] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0145] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0146] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0147] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the defined scope.

Claims

1. A method for managing three members of an enterprise based on a multi-tenant architecture, characterized in that: Applied to the digital base PaaS platform, the method includes: Acquire the type of organization node and the type of enterprise application, wherein the organization node represents management nodes of different levels within the enterprise, and the enterprise application represents applications pre-registered within the enterprise for enterprise management or business; Configure the three-member information of the organization node according to the type of the organization node; Configure the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node; Configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node, and the three-member information of the organization node; When the three-member information of the organization node, the three-member information of the enterprise application, and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

2. The method according to claim 1, characterized in that One organization node corresponds to one or more enterprise applications, and one enterprise application corresponds to one or more enterprise application tenants, where the enterprise application tenants include organization tenants and business tenants; The organizational tenant represents single tenant information created based on a pre-selected single organizational node, and the business tenant represents combined tenant information created based on a plurality of pre-selected cross-organizational hierarchical organizational nodes.

3. The method according to claim 1 or 2, characterized in that: The types of the organization nodes include authority types and function types; the organization nodes are divided into first-category organization nodes and second-category organization nodes according to the authority types, the first-category organization nodes represent organization nodes whose authorities meet preset management authority conditions, and the second-category organization nodes represent organization nodes whose authorities do not meet preset management authority conditions.

4. The method according to claim 3, characterized in that The configuration of the three-member information of the organization node according to the type of the organization node specifically includes: Configure the three-member information of the first type of organization node according to the preset three-member information; Determine the hierarchical management relationship between the organizational nodes of the enterprise according to the permission type of the organizational nodes; According to the hierarchical management relationship between the organizational nodes of the enterprise, the three-member information of the second-type organizational node is configured as the three-member information of the first-type organizational node to which it belongs.

5. The method according to claim 3, characterized in that: The configuring the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node specifically includes: According to the preset management authority query rule, searching for authority types corresponding to a plurality of the first-category organization nodes, and obtaining a first target organization node therefrom, wherein the first target organization node indicates that the authority it possesses is greater than that of any other first-category organization node; The three-member information of the enterprise application is configured according to the permission information of the first target organization node.

6. The method according to claim 3, characterized in that The type of the enterprise application includes multiple required function types, and the configuration of the three-member information of the enterprise application tenant according to the type of the enterprise application, the type of the organization node, and the three-member information of the organization node specifically includes: Determine tenant condition query rules based on the type of enterprise application; Searching for the function types of the plurality of organization nodes according to the tenant condition query rule, and obtaining a second target organization node therefrom, wherein the second target organization node indicates that the function type implemented by the second target organization node is the same as any required function type of an enterprise application; Determining the application tenant type of the second target organization node according to the permission type of the second target organization node; When the application tenant type of the second target organization node is an organization tenant, the three-member information of the corresponding enterprise application tenant is configured according to the three-member information of the second target organization node; When the application tenant type of the second target organization node is a business tenant, the three-member information of the enterprise application tenant corresponding to the second target organization node is configured according to the three-member information of the first type of organization node to which the second target organization node belongs.

7. An enterprise three-member management system based on a multi-tenant architecture, characterized in that: Applied to the digital base PaaS platform, the system includes: A type acquisition module is used to obtain the type of the organization node and the type of the enterprise application; An organization node three-member configuration module, used to configure the three-member information of the organization node according to the type of the organization node, wherein the organization node represents the management nodes of different levels within the enterprise; An application three-member configuration module, used to configure the three-member information of the enterprise application according to the type of the organization node and the three-member information of the organization node, wherein the enterprise application represents an application pre-registered within the enterprise for enterprise management or business; The tenant three-member configuration module is used to configure the three-member information of the enterprise application tenant according to the type of enterprise application, the type of organization node and the three-member information of the organization node; among which, when the three-member information of the organization node, the three-member information of the enterprise application and the three-member information of the enterprise application tenant are all configured, it indicates that the enterprise three-member management has been completed.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the enterprise three-member management method based on a multi-tenant architecture as described in any one of claims 1-6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the enterprise three-member management method based on a multi-tenant architecture according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes computer instructions, which are used to enable a computer to execute the enterprise three-member management method based on a multi-tenant architecture as described in any one of claims 1-6.

Images