Data authority management method, system and device based on organization and storage medium

Abstract

The invention discloses a data authority management method, system and device based on an organization and a storage medium. Fields are added in the organization, organization data are divided into hierarchies and departments, and values are assigned to the fields according to corresponding preset logic for the hierarchies and the departments; according to actual business data isolation requirements, fields are added in users or roles and business assets, and fine control of data is realized by binding the fields in login users and the business assets. And independently configuring a constraint data isolation rule for mechanism data of a hierarchy or a department, and when a user accesses a function module, matching data resources in a data access permission range and returning the data resources to a front-end service. On the premise of not changing the structure of the mechanism, the method solves the problem of how to design the authority of the user to ensure that the data authority of the whole link meets the service requirement and how to design the maintenance problem caused by the change of the configured user and role later-stage factor mechanism at the same time.

Description

Technical Field

[0001] The present invention relates to the field of Internet software application systems, and in particular to a data authority management method, system, device and storage medium based on an organization. Background Art

[0002] Conventional application system platform permission control methods mostly manage and build permission systems through role-based access control (ie, Role-Based Access Control, RBAC model).

[0003] The RBAC model eliminates the direct association between users and permissions, and instead grants users permissions indirectly by associating users with roles and roles with permissions. This approach makes permission management more flexible and efficient.

[0004] By defining and assigning roles, permissions can be easily added, modified, or removed without having to modify each user individually. By creating a permission set for each role, these permissions define the data resources and functions that the role can access and operate. This ensures that only users with the corresponding role can access specific data resources.

[0005] However, enterprise-level platform applications face complex scenarios with multiple departments and multiple branch management agencies. Since data permissions include both data permission requirements under the same organization and special data permission requirements across organizations, the permission control of the traditional RBAC model also brings some problems and cannot adapt well to the complex management requirements of enterprise-level platforms and customers.

[0006] In the prior art, the following methods are usually used to implement data permissions:

[0007] 1. Use the RBAC model to directly set the visible data scope in the role and limit the visible organizational data.

[0008] Although this method is simple to operate and flexible to configure, it encounters complex data permissions associated with roles. For example, if there are roles with the same functional permissions but inconsistent data permissions, multiple roles need to be created repeatedly and redundantly, which leads to configuration redundancy and maintenance difficulties. For example, for verification posts, personnel in Zhejiang and Beijing need to create the "Zhejiang Verification Post" role and the "Beijing Verification Post" role to enable auditors in different regions to view data in different regions.

[0009] If the enterprise requires users to see more institutional data, such as the headquarters verification post, which requires to see the data of Zhejiang, Beijing, Shanghai and other regions, and the Zhejiang verification post, which also needs to see the data of the province and subordinate institutions, multiple institutional data permissions are bound to the role. When there are changes in institutional data, the relevant configured roles need to be maintained.

[0010] 2. Use ACL (Access Control List) technology to achieve fine control and management of network data traffic. By defining a clear access control list, ACL allows administrators to set read, write, execute and other permissions for specific resources for specific users or user groups. Permission control is performed by creating ACL rules for each access data resource list. Although this method achieves fine control over data access and improves data security, it also brings problems with maintaining access control lists. For example, ACL rules may need to be frequently modified due to changes in business needs, resulting in increased maintenance costs. At the same time, the matching and filtering operations of ACL rules may consume certain computing resources, thereby affecting network performance and reducing the performance of business addition, deletion and modification. Improper configuration of ACL rules may also lead to security risks, such as allowing unauthorized users to access sensitive data. Summary of the invention

[0011] The purpose of the present invention is to propose a data authority management method, system, device and storage medium based on organizational structure in view of the deficiencies of the prior art, and to provide a new data authority management model, which can solve the access control of enterprise-level multi-level organizational data while reducing the maintenance burden and configuration work of administrators. For the user's organizational tree, which is an unconventional hierarchical relationship of tree nodes of superiors and subordinates, without changing the organizational structure, the user's authority is designed to ensure that the data authority of the entire link meets the business requirements, and can also avoid the maintenance problems caused by the change of the configured users and roles in the later stage of the sub-organization.

[0012] The object of the present invention is achieved through the following technical solutions: In a first aspect, the present invention provides a data authority management method based on an organization, the method comprising the following steps:

[0013] (1) Add fields to the organizational structure to divide the organizational data into levels and departments;

[0014] (2) Adding a field to the organizational structure, and assigning a value to the field according to the different types of organizational data classified in step (1) and the corresponding preset logic;

[0015] (3) Based on the actual business data isolation requirements, add fields in users or roles, as well as business assets, to match the permissions of business data assets and users;

[0016] (4) independently configure constraint data isolation rules for hierarchical or departmental institutional data;

[0017] (5) Build an organization tree that is within the scope of the logged-in user's authority based on user authority requirements. When a user accesses a functional module of the application system, the data resources of the organizations that are within the scope of the access authority are matched in memory based on the built organization tree during system operation and returned to the front-end business.

[0018] Furthermore, in step (1), an "organization type" field is added to the organizational structure to represent the organization data as a hierarchical organization type or a departmental organization type.

[0019] Furthermore, in step (2), a field is added to the organizational structure for assignment, which is used to determine the scope of authority for the corresponding organizational data type.

[0020] Furthermore, in step (3), fields with the same business meanings, such as "business scenario", "channel", "business line", "business domain" or "application", are added to the user or role and the business asset, and the fields are bound to the logged-in user and the business asset respectively, thereby achieving refined control of the data.

[0021] Furthermore, in step (4), for hierarchical institutional data, users can see the data of the institution and subordinate institutions; for departmental institutional data, users can see the data of the institution and subordinate institutions, the hierarchy to which the department belongs, and the subordinate institutions of the hierarchy to which the department belongs; when searching for subordinate institutions through "subordinate institutions of the hierarchy to which the department belongs", other departments of the hierarchy are not included, thereby achieving data isolation between departments at the same hierarchy.

[0022] Furthermore, in step (4), the subordinate organization cannot view the data of the superior organization, and the superior organization can see the data of the subordinate organization; if there is no superior-subordinate relationship, the data between node organizations / departments at the same level are isolated from each other and cannot be seen.

[0023] In a second aspect, the present invention further provides a data rights management system based on an organization, the system comprising:

[0024] The Add Field module is used to add fields in the organization structure, divide the organization data into levels and departments; and assign values ​​to the fields according to the corresponding preset logic according to the different types of organization data;

[0025] Data isolation module, used to independently configure constraint data isolation rules for hierarchical or departmental institutional data;

[0026] The organization tree construction module is used to build an organization tree within the scope of the logged-in user's permissions according to user permission requirements, and perform data permission management based on the constructed organization tree.

[0027] The asset data matching module is used when users access the functional modules of the application system. Based on the number of established organizations, the module matches the data resources of organizations within the scope of data access permissions in memory during system operation and finally returns them to the front-end business.

[0028] In a third aspect, the present invention also provides a data permission management device based on an organization, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, the data permission management method based on an organization is implemented.

[0029] In a fourth aspect, the present invention further provides a computer-readable storage medium having a program stored thereon, and when the program is executed by a processor, the organization-based data authority management method is implemented.

[0030] In a fifth aspect, the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the data authority management method based on an organization.

[0031] Beneficial effects of the present invention:

[0032] 1. The present invention can realize the enterprise-level data authority management requirements under complex organizations with the most authentic and original organization data without changing the upper and lower nodes of the original organization tree.

[0033] 2. The solution of the present invention has good compatibility and adaptability, which can greatly reduce the cost of secondary customization and R&D. It can be compatible with various situations with conventional organization trees (clear and distinct superior and subordinate organization nodes, where the subordinate organization node is the subordinate organization or department of the organization) and complex organization trees (branch organizations and business departments are equal nodes in the organization tree node, and there is a parent organization department above the department).

[0034] 3. The present invention has good scalability and maintainability. Based on the configured users and roles, as the organization data increases, there is no need to maintain the configured user and role data, and the user data authority can automatically identify the newly added subordinate organization departments. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1This is a schematic diagram of the situation where the data of lower-level institutions / departments cannot be viewed in the prior art;

[0037] Figure 2 A schematic diagram of the rights management provided by the present invention;

[0038] Figure 3 A flow chart of a data authority management method based on an organization provided by the present invention;

[0039] Figure 4 A schematic diagram of the hierarchical and departmental divisions in an embodiment of the present invention;

[0040] Figure 5 This is a schematic diagram of permissions with a hierarchical organization type in an embodiment of the present invention;

[0041] Figure 6 This is a schematic diagram of the authority of a department in an embodiment of the present invention;

[0042] Figure 7 It is a structural diagram of a data authority management device based on an organization provided by the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be understood that the specific implementation examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0044] Application system users can only see the data permission range of the bound organization. However, due to the diversity and complexity of the enterprise-level platform organization tree, if you need to view the subordinate organization department, the structure of the organization tree is limited to the very standard hierarchical relationship of the upper and lower tree nodes. However, if the system's organization node is not within this range, the subordinate organization / department data will not be viewable.

[0045] For example: Figure 1 In the organization tree structure, the foreign exchange department of the head office hopes to see the organization data of the Hangzhou branch and the Shanghai branch. However, due to the limitation of the system tree structure, it cannot be viewed.

[0046] The present invention provides a data authority management method based on an organization, such as Figure 2 As shown, it includes the fields [Organization], [Role], and [Business Scenario] (on demand) bound to the user. The corresponding functional modules and function button permissions are authorized through roles to achieve functional-level permission isolation; through the organization matching the corresponding asset data permissions, the organization fields bound to the business data assets are matched with the organization fields in the user to achieve data visibility isolation.

[0047] like Figure 3As shown, the specific implementation steps of the present invention are as follows, which can allow the system to "sense" the definition of the subordinate organization of the present invention;

[0048] (1) Through data analysis and processing of organizational structures, organizational data is re-divided according to the business understanding of superior and subordinate organizations.

[0049] Add the [Organization Type] field in the organization to divide the organization data into levels and departments. Levels can be understood as the concept of branches, and departments are the management departments of the business.

[0050] For example: Figure 4 As shown in the figure, for the institutional data under the banking industry, the institutional type of the top-level institution, each first-level branch, each second-level branch, and sub-branch can be defined as [Level]. The institutional type of the business management department where the personnel are located can be defined as [Department].

[0051] (2) Add the "Level" field in the organization. When the organization is synchronized or manually created and saved, the "Level" field in the organization is assigned values ​​according to the following logic:

[0052] 1) For institutions whose institution type is "level", the level to which they belong is assigned to the institution;

[0053] 2) For organizations with the organization type of "department", query upward nodes through the tree structure relationship until an organization with the organization type of "level" is found, and the organization is assigned to the level to which the department belongs;

[0054] (3) Add a "business scenario" field in the organization according to actual needs (similar fields may also include: channel, business line, business domain, application, etc.), bind the field to the user or role and data assets, which is suitable for situations where the isolation of the functional modules of the organization's data alone still cannot achieve the data segmentation that meets business expectations, and further realizes fine-grained access control of data. The bound scenario field in the business data asset is matched with the scenario field in the user to achieve data visibility isolation.

[0055] For example, user Zhang San who belongs to the Hangzhou headquarters can see the data of channel A, but user Li Si can only see the data of channel B.

[0056] (4) Constrained data isolation rules. By default, users can see the organizational data within the scope of [this organization and subordinate organizations] and [this department’s hierarchy] and [subordinate organizations within this department’s hierarchy], and can see the data within the scope of the user’s business scenarios.

[0057] The specific setting rules for the above-mentioned "institutional data" are as follows:

[0058] 1) "Subordinate organizations" refers to all leaf nodes of the tree node where the current organization is located.

[0059] 2) When searching for subordinate organizations through [Subordinate organizations of the level to which this department belongs], other departments of the same level are not included.

[0060] 3) If there is no superior-subordinate relationship, the data between the node organizations / departments at the same level are isolated from each other and cannot be seen.

[0061] 4) Subordinates cannot view the data of their superiors; superiors can see the data of their subordinates by default.

[0062] 5) If the user's organization is [Level], the descriptions of [Level to which this department belongs] and [Subordinate organizations of the level to which this department belongs] can be ignored because their obtained values ​​are empty.

[0063] 6) When constraining data isolation rules, the system provides configurable capabilities, allowing users to customize isolation rules for the entire organization and departmental organizations.

[0064] For example, for some hierarchical institutional data, such as a branch organization, if you only want to allow the organization to see its own branch and no longer see the institutional data of other lower-level branches, you can set restriction logic for this rule alone.

[0065] For the institutional data of some [departments], you only want them to see the institutional data related to other departments, while other departments are not visible even if they are logically subordinate departments of this department. In this case, you can set restriction logic for this rule separately.

[0066] The rules for setting the above "business scenario data" are as follows:

[0067] 1) The data range of "Business Scenario" visible to users needs to include at least one scenario bound to the business assets in the "Business Scenario" configured in the logged-in user.

[0068] 2) When both institutional data and business scenario data exist, the final authority of the data is limited by the two, and the relationship between the two is parallel and.

[0069] The present invention is based on the setting of the above [Constraint Data Isolation Rules]. Since the constraints on institutional data adopt relative logic rather than specific institutional IDs, when the user logs in, the visible institutions within the scope of authority are instantly queried and constructed. The system data assets are isolated from data permissions in memory. If new sub-institutions are added later, there is no need to modify the configured user and role data.

[0070] For example, due to business development, the Zhejiang branch needs to establish a Ningbo branch and its management department. For the users and roles of the head office, the traditional approach is to add new institutions or departments to these users or roles.

[0071] The default settings of rule permissions in the present invention are as follows:

[0072] (4.1) When the organization type is defined as "Hierarchical" the following are visible by default: [This organization and subordinate organizations]

[0073] like Figure 5 As shown in the figure, assuming that the current organization is [Beijing Branch] and the organization type is defined as "Hierarchy", only the organization data under Beijing Branch can be seen. The organization data of other Hangzhou Branch, Shanghai Branch, etc. are not visible;

[0074] (4.2) When the organization type is defined as "department", the following are visible by default: [this organization and subordinate organizations] and [the level to which this department belongs] [the subordinate organizations of the level to which this department belongs]

[0075] like Figure 6 As shown in the figure, assuming that the current organization is [Headquarters Department 1], the organization type is defined as "Department", and the organization type of each branch is defined as Level. The data of other departments in the level to which this department belongs cannot be seen. The purpose is to exclude the data of other departments in the same level and realize the data isolation between departments in the same level.

[0076] (5) Build an organization tree that complies with the login user's authority according to the system user authority requirements

[0077] Through the setting of the first 4 steps, since the design of the present invention belongs to a newly added field, the user's organization tree structure is not destroyed, and the relationship between the original organization node and the upper node is still maintained, and a complete organization tree can still be constructed. On this basis, the data isolation rules constrained in the fourth step are iterated again, and the organization tree nodes constrained by data authority management can be obtained. It can be used to display visible organizations within the user's authority range in the organization management page and the user management page, or in some subsystem pages, it is necessary to pull down to display the organization tree nodes within the corresponding scope of authority. When a user accesses the functional module of the application system, the data resources of the organization that meets the access data authority range are matched in memory when the system is running based on the number of constructed organizations and finally returned to the front-end business.

[0078] Corresponding to the above-mentioned embodiment of a data rights management method based on an organization, the present invention also provides an embodiment of a data rights management system based on an organization. The implementation process of each module in the system specifically refers to the specific implementation steps of the above-mentioned embodiment of a data rights management method based on an organization, and the system includes:

[0079] The Add Field module is used to add fields in the organization structure, divide the organization data into levels and departments; and assign values ​​to the fields according to the corresponding preset logic according to the different types of organization data;

[0080] Data isolation module, used to independently configure constraint data isolation rules for hierarchical or departmental institutional data;

[0081] The organization tree construction module is used to build an organization tree within the scope of the logged-in user's permissions according to user permission requirements, and perform data permission management based on the constructed organization tree.

[0082] The asset data matching module is used when users access the functional modules of the application system. Based on the number of established organizations, the module matches the data resources of organizations within the scope of data access permissions in memory during system operation and finally returns them to the front-end business.

[0083] Corresponding to the aforementioned embodiment of a data authority management method based on an organization, the present invention also provides an embodiment of a data authority management device based on an organization.

[0084] See also Figure 7 An embodiment of the present invention provides a data permission management device based on an organization, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a data permission management method based on an organization in the above embodiment.

[0085] An embodiment of a data authority management device based on an organization provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 7 As shown, it is a hardware structure diagram of a data authority management device based on an organization provided by the present invention, in which any device with data processing capability is located, except Figure 7 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0086] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0087] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0088] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a data authority management method based on an organization in the above embodiment is implemented.

[0089] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0090] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the organization-based data authority management method is implemented.

[0091] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A data rights management method based on an organization, characterized in that: The method comprises the following steps: (1) Add fields to the organizational structure to divide the organizational data into levels and departments; (2) Adding a field to the organizational structure, and assigning a value to the field according to the different types of organizational data classified in step (1) and the corresponding preset logic; (3) Based on the actual business data isolation requirements, add fields in users or roles, as well as business assets, to match the permissions of business data assets and users; (4) independently configure constraint data isolation rules for hierarchical or departmental institutional data; (5) Build an organization tree that is within the scope of the logged-in user's authority based on user authority requirements. When a user accesses a functional module of the application system, the data resources of the organizations that are within the scope of the access authority are matched in memory based on the built organization tree during system operation and returned to the front-end business.

2. The method for data authority management based on an organization according to claim 1, characterized in that: In step (1), an "Organization Type" field is added to the organizational structure to represent the organization data as a hierarchical organization type or a departmental organization type.

3. The method for data authority management based on an organization according to claim 1, characterized in that: In step (2), a field is added to the organizational structure and assigned a value to determine the scope of authority for the corresponding organizational data type.

4. The method for data authority management based on an organization according to claim 1, characterized in that: In step (3), add "Business scenario", "Channel", "Business line", "Business domain" or "Application" fields in the organizational structure, bind users or roles and perform permission matching in business data assets to achieve refined control of data.

5. The method for data authority management based on an organization according to claim 1, characterized in that: In step (4), configurable capabilities are provided, allowing users to customize isolation rules for the entire or partial organization. The system is initially set up so that for hierarchical organization data, users can see the data of the organization and subordinate organizations; for department organization data, users can see the data of the organization and subordinate organizations, the hierarchy to which the department belongs, and the subordinate organizations of the hierarchy to which the department belongs; when searching for subordinate organizations through "subordinate organizations of the hierarchy to which the department belongs", other departments of the hierarchy are not included, so as to achieve data isolation between departments at the same hierarchy.

6. The method for data authority management based on an organization according to claim 1, characterized in that: In step (4), the subordinate organization cannot view the data of the superior organization, and the superior organization can see the data of the subordinate organization; if there is no superior-subordinate relationship, the data between node organizations / departments at the same level are isolated from each other and cannot be seen.

7. A data rights management system based on an organization, characterized in that: The system includes: The field adding module is used to add fields in the organizational structure, divide the organizational data into levels and departments; and assign values ​​to the fields according to the corresponding preset logic based on the different types of organizational data. The data isolation module is used to independently configure constraint data isolation rules for organizational data at the level or department. The organization tree construction module is used to build an organization tree within the scope of the logged-in user's permissions according to user permission requirements, and perform data permission management based on the constructed organization tree. The asset data matching module is used when users access the functional modules of the application system. Based on the number of established organizations, the module matches the data resources of organizations within the scope of data access permissions in memory during system operation and finally returns them to the front-end business.

8. A data rights management device based on an organization, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, an organization-based data authority management method as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, an organization-based data authority management method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, an organization-based data authority management method as described in any one of claims 1 to 6 is implemented.

Images