Authority control method and platform based on ERP (Enterprise Resource Planning) system

Abstract

The invention relates to an authority control method and platform based on an ERP (Enterprise Resource Planning) system, and the method comprises the steps: verifying an authority range and an authority identifier when a non-sensitive authority request from a user side is received; when the permission range does not contain the permission identifier, confirming the permission request; if the same permission request is still received, verifying the compliance of the permission request; when the compliance verification is passed, endowing the user side with a temporary permission containing a preset corresponding permission identifier of the permission request; and when permission information fed back by the management end is received, updating the permission range of the user end. According to the method, the permission request of the user side, the compliance of the verification information and the feedback of the management side are comprehensively considered, the dynamic adjustment of the user permission range is realized, the accuracy and the safety of permission management are improved, the permission can be flexibly given or updated according to the actual demand of the user, and the user experience is improved. And the complexity and the error rate of authority management are effectively reduced.

Description

Technical Field

[0001] The present application relates to the technical field of authority management, and in particular to an authority control method and platform based on an ERP system. Background Art

[0002] With the continuous deepening of enterprise informatization, enterprise resource planning (ERP) systems have been widely used in various enterprises, realizing the comprehensive management and optimization of enterprise resources. However, with the widespread application of the system, the issue of authority control has gradually become prominent.

[0003] In traditional ERP systems, permission control is usually based on roles or user groups. The system assigns corresponding permissions according to the role or user group to which the user belongs, and this permission allocation method is static, that is, the user is granted corresponding permissions after being defined as a certain role.

[0004] However, the above methods have certain limitations in practical applications: First, the permissions for roles or user groups in ERP systems are often relatively fixed, making it difficult to flexibly respond to changes in business, such as the formal handover of employees leaving the company; Furthermore, the existing ERP system lacks dynamic permission changes based on immediate needs, making it difficult to meet the dynamic changes in user needs, such as vacancies after employee resignation and temporary job changes caused by employee leave. Summary of the invention

[0005] In order to solve the above problems and improve the flexibility and immediacy of user authority control in the ERP system, the present application provides an authority control method and platform based on the ERP system.

[0006] The above-mentioned invention objective of the present application is achieved through the following technical solutions: A permission control method based on an ERP system comprises the following steps: When receiving a non-sensitive permission request from a user, verify the permission scope of the user and the permission identifier of the permission request; When the permission range of the user terminal does not include the permission identifier corresponding to the permission request, confirm the permission request of the user terminal; If the same permission request is still received from the user, the permission verification information of the user is obtained, and the compliance of the permission request is verified based on the permission verification information, where the permission verification information includes geographic location information, position information, and department information; When the compliance verification passes, the user terminal is granted temporary permission including the permission identifier preset corresponding to the permission request, and permission confirmation information is sent to the management terminal corresponding to the permission request; When the permission information fed back by the management end is received, the time limit feature of the permission verification information is extracted, and based on the time limit feature, the permission range of the user end is updated to include the permission identifier corresponding to the permission request.

[0007] By adopting the above technical solution, when the system receives a permission request for a non-sensitive operation from a user terminal, it verifies whether the current permission scope of the user terminal includes the permission identifier in the permission request. If the existing permission scope of the user terminal does not include the requested permission identifier, the permission request is confirmed to the user terminal to confirm whether the user really needs the permission or performs the operation. If the same permission request is received from the same user terminal again, the permission verification information of the user terminal is obtained, and compliance verification is performed based on the permission verification information to ensure that the permission request matches the user's role and responsibilities or to verify whether the permission request is reasonable and compliant. Once the compliance verification is passed, the user terminal is granted temporary permission including the requested permission identifier, allowing the user to Execute a specific operation within a period of time, and at the same time, send permission confirmation information to the management end corresponding to the permission request to confirm with the management whether the change of the relevant permission is true. When the management end feeds back the permission information and confirms the rationality of the permission request, extract the time limit characteristics of the permission verification information and update the permission scope for the user end to include the permission identifier corresponding to the permission request, thereby granting it the permission of the corresponding time limit; this application realizes dynamic adjustment of the user's permission scope by comprehensively considering the user's permission request, the compliance of the verification information and the feedback from the management end, which not only improves the accuracy and security of permission management, but also can flexibly grant or update permissions according to the actual needs of users, effectively reducing the complexity and error rate of permission management.

[0008] In a preferred example, the present application may be further configured as follows: when a non-sensitive permission request is received from a user terminal, before the step of verifying the permission scope of the user terminal and the permission identifier of the permission request, the following steps are performed: When receiving a permission request from a user, identify the sensitivity of the permission request.

[0009] By adopting the above technical solution, when a permission request is received from the user end, it is identified whether the permission request is sensitive, that is, whether it is a preset sensitive operation, so that different processing is performed based on different permission requests, making the permission management system more flexible and efficient, and being able to make corresponding response strategies according to different situations, thereby improving the overall security of the system and user experience.

[0010] In a preferred example, the present application can be further configured as follows: if the same permission request is still received from the user end, the permission verification information of the user end is obtained, and the compliance of the permission request is verified based on the permission verification information, and the permission verification information includes geographic location information, position information, and department information, including the steps of: Verify whether the user has any risk of off-site violation based on geographic location information and job information; If there is no risk of off-site violation, the user terminal is verified to match the position of the permission request based on the position information; If the job matching verification is passed, the job information and the department information are input into the pre-trained job handover judgment model, so that the job handover judgment model can judge whether the user terminal is likely to have a job handover; When the job handover feature output by the job handover judgment model is received, it is identified whether the job handover feature contains the permission identifier of the permission request to verify the compliance of the permission request.

[0011] By adopting the above technical solution, based on the acquired geographic location information and job information, it is verified whether the user terminal has the risk of illegal operation in a remote location, so as to prevent unauthorized remote access or operation, and ensure that the permission request comes from a legitimate geographic location and position. If there is no risk of illegal operation in a remote location, based on the user terminal's job information, it is verified whether it matches the requested permission, so as to ensure that the permission requested by the user is consistent with his or her job responsibilities, and avoid situations where the permission is too large, too small, or inconsistent with the job requirements. When the job matching verification is passed, the job information and the department information are input into the pre-trained job handover judgment model. The model can judge whether the user terminal may be in a state of job handover based on the input information. When the job handover feature output by the job handover judgment model is received, it is identified whether the job handover feature contains the permission identifier requested by the user terminal, so as to further verify the compliance of the permission request.

[0012] In a preferred example, the present application can be further configured as follows: the geographic location information includes current location information and historical location information, and the step of verifying whether the user terminal has a risk of off-site violation based on the geographic location information and job information includes the following steps: Compare whether the time of issuing the permission request is within the working hours associated with the position information; Identify the location similarity between the current location information and the historical location information; Based on the preset off-site verification rules, combined with the comparison results, location similarity and job information, it is verified whether the user terminal has the risk of off-site violation.

[0013] By adopting the above technical solution, the issuance time of the permission request is compared to see whether it is within the working hours associated with the user's job information, so as to confirm whether the permission request is issued within the normal working hours. This serves as a basis for preliminarily judging the compliance of user behavior, identifying the location similarity between the user's current location information and the historical location information, and judging whether the user is in a regular activity area, or whether there is an abnormal geographical location change. Based on the preset off-site verification rules and combined with the above comparison results, location similarity and the user's job information, a comprehensive verification is performed to verify whether there is an off-site violation risk on the user side.

[0014] In a preferred example, the present application can be further configured as follows: if the job matching verification is passed, the job information and the department information are input into a pre-trained job handover judgment model, so that the job handover judgment model judges whether the user terminal may have a job handover, including the following steps: When there is change information in the department information within the preset time, the job handover judgment model matches the preset corresponding operation record information based on the change type of the change information; The job handover model performs correlation analysis on job information and operation record information based on preset judgment rules.

[0015] By adopting the above technical solution, it is checked whether there is any change information about the user's department information within the preset time. If there is any change information about the department information, the job handover judgment model will match the preset corresponding historical operation record information based on the change type of the change information (such as department merger, split, personnel transfer, personnel leave, etc.), and based on the preset judgment rules, perform correlation analysis on the user's position information and the matching operation record information to determine whether the user's permission request is related to the attributes of the historical operation record information.

[0016] In a preferred example, the present application can be further configured as follows: when receiving the permission information fed back by the management end, extracting the time limit feature of the permission verification information, and updating the permission scope of the user end to include the permission identifier corresponding to the permission request based on the time limit feature, including the steps of: Obtain the change information of the department information within the preset time and the change type corresponding to the change information; A time limit feature is extracted based on the change information and its corresponding change type, and the authority scope of the user terminal is updated based on the time limit feature.

[0017] By adopting the above technical solution, before updating the user terminal's authority scope, the change information of the user's department within the preset time and its corresponding change type are obtained, and the time limit characteristics are determined based on the obtained change information and its corresponding change type. According to the determined time limit characteristics, the user terminal's authority scope is updated, that is, within the authority time limit, the user terminal will have the newly authorized authority, and after the time limit expires, the newly authorized authority will be automatically removed or restricted.

[0018] The second object of the invention is achieved by the following technical solutions: An authority control platform based on an ERP system, comprising: The permission verification module is used to verify the permission scope of the user terminal and the permission identifier of the permission request when receiving a non-sensitive permission request from the user terminal; The permission request confirmation module is used to confirm the permission request of the user terminal when the permission range of the user terminal does not include the permission identifier corresponding to the permission request; A compliance verification module, for obtaining the permission verification information of the user terminal if the same permission request is still received from the user terminal, and verifying the compliance of the permission request based on the permission verification information, wherein the permission verification information includes geographic location information, position information, and department information; A temporary permission granting module is used to grant the user terminal a temporary permission including a permission identifier preset corresponding to the permission request when the compliance verification passes, and send permission confirmation information to the management terminal corresponding to the permission request; The permission update module is used to extract the time limit feature of the permission verification information when receiving the permission information fed back by the management end, and update the permission scope of the user end to include the permission identifier corresponding to the permission request based on the time limit feature.

[0019] By adopting the above technical scheme, the permission verification module is used to verify the permission scope of the user terminal and the permission identifier of the permission request when a non-sensitive permission request is received from the user terminal; the permission request confirmation module is used to confirm the permission request of the user terminal to the user terminal when the permission scope of the user terminal does not include the permission identifier corresponding to the permission request; the compliance verification module is used to obtain the permission verification information of the user terminal if the same permission request is still received from the user terminal, and verify the compliance of the permission request based on the permission verification information, wherein the permission verification information includes geographic location information, position information and department information; the temporary permission granting module is used to grant the user terminal temporary permission including the permission identifier preset corresponding to the permission request when the compliance verification passes, and send permission confirmation information to the management terminal corresponding to the permission request at the same time; the permission update module is used to extract the time limit feature of the permission verification information when receiving the permission information fed back by the management terminal, and update the permission scope of the user terminal to include the permission identifier corresponding to the permission request based on the time limit feature.

[0020] In a preferred example, the present application can be further configured as follows: the compliance verification module includes: The off-site violation verification submodule is used to verify whether the user terminal has off-site violation risks based on geographic location information and job information; A matching verification submodule is used to verify the matching of the user terminal and the position of the permission request based on the position information if there is no risk of off-site violation; The input submodule is used to input the position information and the department information to the pre-trained job handover judgment model if the job matching verification is passed, so that the job handover judgment model can judge whether the user terminal may have a job handover; The authority identifier identification submodule is used to identify whether the job handover feature contains the authority identifier of the authority request when receiving the job handover feature output by the job handover judgment model, so as to verify the compliance of the authority request.

[0021] By adopting the above technical scheme, the off-site violation verification submodule is used to verify whether the user terminal has the risk of off-site violation based on the geographical location information and job information; the matching verification submodule is used to verify the matching of the user terminal with the job of the permission request based on the job information if there is no risk of off-site violation; the input submodule is used to input the job information and the department information to the pre-trained job handover judgment model if the job matching verification is passed, so that the job handover judgment model determines whether the user terminal may have a job handover; the authority identification submodule is used to identify whether the job handover feature contains the authority identification of the permission request when receiving the job handover feature output by the job handover judgment model, so as to verify the compliance of the permission request.

[0022] In summary, the present application includes at least one of the following beneficial technical effects: 1. This application realizes dynamic adjustment of user authority scope by comprehensively considering the user's authority request, the compliance of verification information and the feedback from the management side. It not only improves the accuracy and security of authority management, but also can flexibly grant or update authority according to the actual needs of users, effectively reducing the complexity and error rate of authority management, and improving the flexibility and immediacy of user authority control in the ERP system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of an embodiment of a permission control method based on an ERP system of the present application; Figure 2 This is a flowchart of an implementation of step S30 in an embodiment of a permission control method based on an ERP system of the present application; Figure 3 This is a flowchart for implementing step S31 in an embodiment of a permission control method based on an ERP system of the present application. DETAILED DESCRIPTION

[0024] The following is combined with Figure 1-3 This application is described in further detail.

[0025] In one embodiment, if Figure 1 As shown, the present application discloses a permission control method based on an ERP system, which specifically includes the following steps: S10: When receiving a non-sensitive permission request from a user terminal, verify the permission scope of the user terminal and the permission identifier of the permission request; In this embodiment, a non-sensitive permission request is a permission request initiated by a user terminal that does not involve sensitive data or sensitive operations; the permission scope is the scope of operations and data access that the user terminal is authorized to perform, which is set according to its role and responsibilities in the enterprise; the permission identifier is a symbol or code used to uniquely identify a specific permission. Through the permission identifier, the system can accurately identify and manage different permissions; Specifically, when the system receives a permission request for a non-sensitive operation from a user, it verifies whether the current permission scope of the user includes the permission identifier in the permission request, that is, verifies whether the user has the permission to execute the request; Furthermore, the permission requests of each user terminal in the ERP system are recorded. When a non-sensitive unfamiliar permission request is received from a user terminal, the permission scope of the user terminal and the permission identifier of the unfamiliar permission request are verified, wherein the unfamiliar permission request is a permission request that is not recorded in the permission request record of the user terminal.

[0026] S20: When the permission range of the user terminal does not include the permission identifier corresponding to the permission request, confirm the permission request of the user terminal; In this embodiment, confirming the permission request to the user terminal specifically includes sending a confirmation pop-up window to the user terminal to confirm whether the user terminal still needs to execute the permission request; Specifically, if the existing permission scope of the user terminal does not include the requested permission identifier, confirm the permission request to the user terminal to confirm whether the user really needs the permission or performs the operation.

[0027] S30: If the same permission request is still received from the user, obtaining permission verification information of the user, and verifying compliance of the permission request based on the permission verification information, wherein the permission verification information includes geographic location information, position information, and department information; In this embodiment, the authority verification information is information used to verify the compliance of the user's authority request, including geographic location information, position information, and department information; Specifically, if the same permission request is received again from the same user end, the permission verification information of the user end is obtained, and compliance verification is performed based on the permission verification information to ensure that the permission request matches the user's role and responsibilities or to verify whether the permission request is reasonable and compliant.

[0028] S40: When the compliance verification passes, grant the user terminal a temporary permission including the permission identifier preset corresponding to the permission request, and send permission confirmation information to the management terminal corresponding to the permission request; In this embodiment, temporary authority refers to the operation authority temporarily granted by the system before the user's authority request is finally confirmed; the management end refers to the system or personnel responsible for managing and approving the user's authority request; Specifically, once the compliance verification is passed, the user end is granted temporary permission containing the requested permission identifier, allowing the user to perform specific operations within a period of time. At the same time, permission confirmation information is sent to the management end corresponding to the permission request to confirm with the management whether the change in the relevant permission is true.

[0029] Furthermore, based on blockchain technology, the corresponding requests and operations after the user obtains temporary permissions are recorded, thereby increasing transparency and traceability.

[0030] S50: when receiving the permission information fed back by the management end, extracting the time limit feature of the permission verification information, and updating the permission range of the user end to include the permission identifier corresponding to the permission request based on the time limit feature; In this embodiment, the permission information is the instruction information issued by the management end to allow the user end to increase the permission; the time limit feature is the time-related feature in the permission verification information, including but not limited to the validity period of the permission, the application time, etc., and the permission scope of the user end is updated according to the time limit feature to ensure that the user end has the required permission within the specified time; Specifically, when the management end feeds back permission information and confirms the rationality of the permission request, it extracts the time limit feature of the permission verification information and updates the permission scope for the user end to include the permission identifier corresponding to the permission request, thereby granting it permission with a corresponding time limit.

[0031] In one embodiment, before step S10, the following steps are performed: S01: When receiving a permission request from a user, identifying the sensitivity of the permission request; In this embodiment, the sensitivity of the permission request is determined based on whether the data or operation involved in the permission request is sensitive; Specifically, when receiving a permission request from the user, it identifies whether the permission request is sensitive, that is, whether it is a preset sensitive operation, so that different processing is performed based on different permission requests, making the permission management system more flexible and efficient, and able to make corresponding response strategies according to different situations, thereby improving the overall security of the system and user experience.

[0032] In one embodiment, if Figure 2 As shown, step S30 includes the steps of: S31: Verify whether the user terminal has a risk of off-site violation based on the geographic location information and job information; S32: If there is no risk of off-site violation, verify the matching between the user terminal and the position of the permission request based on the position information; S33: If the job matching verification is passed, the job information and the department information are input into the pre-trained job handover judgment model, so that the job handover judgment model judges whether the user terminal may have a job handover; S34: when receiving the job handover feature output by the job handover judgment model, identifying whether the job handover feature includes the permission identifier of the permission request, so as to verify the compliance of the permission request; In this embodiment, the geographic location information is the physical location where the user logs in and the domain name of the login terminal; the position information is the information related to the role position in the ERP system and the corresponding permission information; the department information is the personnel information in the position department to which the user belongs, including personnel change information; the risk of off-site violation is the risk of the user logging in and initiating permission requests at an abnormal working location, unauthorized geographic location or abnormal terminal, indicating potential security threats or non-compliant operations; the position matching is the degree of compliance between the user's position information and the requested permissions; the job handover is the internal employee of the enterprise due to job changes. The process of handing over work responsibilities and authority is required due to job changes, resignation, leave, etc. Authority handover includes temporary authority handover and formal authority handover. Temporary authority handover means that the authority of the employee on leave or the vacant position needs to be temporarily granted to a user due to employee leave or a short-term job vacancy. Formal authority handover means that the authority of the employee needs to be handed over to the successor user of the position due to employee resignation. The job handover judgment model is a pre-trained model, which is used to judge whether the user has the possibility of being in the job handover state based on the input job information and department information, and output relevant job handover features. Specifically, based on the acquired geographic location information and job information, verify whether the user terminal has the risk of remote illegal operation to prevent unauthorized remote access or operation, and ensure that the permission request comes from a legitimate geographic location and position. If there is no risk of remote illegal operation, verify whether the position information of the user terminal matches the requested permission based on the position information to ensure that the permission requested by the user is consistent with his or her job responsibilities, and avoid situations where the permission is too large, too small, or inconsistent with the job requirements. When the job matching verification is passed, the position information and the department information are input into the pre-trained job handover judgment model. The model can judge whether the user terminal may be in a state of job handover based on the input information. When the job handover feature output by the job handover judgment model is received, it is identified whether the job handover feature contains the permission identifier requested by the user terminal, so as to further verify the compliance of the permission request.

[0033] In one embodiment, the geographic location information includes current location information and historical location information, such as Figure 3 As shown, step S31 includes the steps of: S311: Compare whether the issuance time of the permission request is within the working hours associated with the position information; S312: Identify the location similarity between the current location information and the historical location information; S313: Based on the preset off-site verification rules, verify whether the user terminal has off-site violation risks in combination with the comparison results, location similarity, and job information; In this embodiment, the current location information is the geographical location information of the user terminal when initiating the permission request, which is used to verify whether the user terminal is in the expected location; the off-site violation risk is the risk of the user terminal initiating a permission request at a geographical location that is inconsistent with its job information or regular activity pattern. For example, an employee who usually works in Beijing suddenly initiates a sensitive permission request in Guangzhou, which may cause off-site violation risks; the working time associated with the job information is the normal working time period specified according to the job information of the user segment; the historical location information is the geographical location record of the user within the preset time in the past; the location similarity is the similarity between the current location information of the user terminal and the historical location information. By calculating the location similarity, it can be evaluated whether the current location of the user terminal is consistent with its past activity pattern, thereby helping to determine whether there is an off-site violation risk; the off-site verification rule is a preset rule set used to evaluate whether the user performs abnormal operations in a different location or during an abnormal period; Specifically, compare whether the issuance time of the permission request is within the working hours associated with the user's job information to confirm whether the permission request is issued within the normal working hours. This serves as the basis for preliminarily judging the compliance of user behavior. Identify the location similarity between the user's current location information and historical location information to determine whether the user is in a regular activity area or whether there is an abnormal change in geographical location. Based on the preset off-site verification rules and combined with the above comparison results, location similarity and the user's job information, comprehensively verify whether there is an off-site violation risk on the user side.

[0034] In one embodiment, step S33 includes the steps of: S331: When there is change information in the department information within the preset time, the job handover judgment model matches the preset corresponding operation record information based on the change type of the change information; S332: The job handover model performs correlation analysis on the job information and the operation record information based on the preset judgment rules; In this embodiment, the change information refers to any changes that occur to the department and employees within the department within a specific time period, such as department mergers, splits, personnel transfers or employee resignations, leave, job transfers, promotions, etc.; the job handover judgment model is a model used to judge whether job handover or authority adjustment is required when a department or employee changes. The job handover judgment model will match the corresponding operation record information according to the type of change information; the operation record information is the user's operation history record in the ERP system, including the type of operation performed, the operation object, the operation time period, the high-frequency operation time period, etc.; Specifically, check whether there is any change information about the department information to which the user belongs within the preset time. If there is any change information about the department information to which the user belongs, the job handover judgment model will match the preset corresponding historical operation record information based on the change type of the change information (such as department merger, split, personnel transfer, personnel leave, etc.), and based on the preset judgment rules, perform correlation analysis on the user's position information and the matching operation record information to determine whether the user's permission request is correlated with the attributes of the historical operation record information; Furthermore, the preset judgment rules are preset rules for performing correlation analysis on the position information and the operation record information, specifically: Conduct similarity analysis between the job information on the change side and the job information on the user side; Analyze the operation record information of the changing end to identify whether the operation record information contains the same permission identifier as the permission request of the user end; If included, then analyzing whether the operation record information of the changing end is related to the record information of the permission request issued by the user end; Among them, the change end is the employee user end corresponding to the change information; The change end is the employee user end corresponding to the change information. When a department or employee changes, the relevant information (such as position information, operation record information, etc.) of the change end will be used to compare and analyze with the information of the current user end; the correlation analysis is to conduct a comprehensive analysis of the position information and the operation record information to determine whether there is a certain correlation or similarity between them. In this embodiment, the correlation analysis is mainly used to determine whether the operation record information of the change end is correlated with the permission request issued by the user end; Specifically, a similarity analysis is performed on the job information of the changing end and the job information of the user on the current user end to preliminarily determine whether the job information of the changing end has a certain degree of similarity or correlation with the job information of the current user end. If the job information of the two is highly similar, then the subsequent analysis needs to be more detailed, because similar jobs may mean similar permission requirements and operating habits; the operation record information of the changing end is analyzed, and attention is paid to whether it contains the same permission identifier as the permission request of the current user end. This step is directly related to whether the permission request of the user end is reasonable, and whether there is a potential risk of abuse or misuse of permissions; if the operation record of the changing end does contain the same permission identifier, then it is necessary to further explore whether there is a direct correlation between the operation record and the permission request issued by the current user end; Furthermore, if it is found that the operation record information of the changed end is related to the permission request issued by the current user end, then the subsequent processing mechanism will be triggered, including but not limited to: further review of the permission request, communication and confirmation with the user or management end, and timely adjustment of the scope of authority.

[0035] In one embodiment, step S50 includes the steps of: S51: Obtaining change information of department information within a preset time and the change type corresponding to the change information; S52: extracting a time limit feature based on the change information and its corresponding change type, and updating the authority scope of the user terminal based on the time limit feature; In this embodiment, the time limit feature is a time-related feature in the permission verification information, including but not limited to the validity period of the permission, the application time, etc. The permission scope of the user terminal is updated according to the time limit feature to ensure that the user terminal has the required permission within the specified time; Specifically, before updating the scope of user terminal authority, obtain the change information of the department to which the user belongs within a preset time and its corresponding change type, determine the time limit characteristics based on the obtained change information and its corresponding change type, and update the scope of user terminal authority according to the determined time limit characteristics, that is, within the authority time limit, the user terminal will have the newly authorized authority, and after the time limit expires, the newly authorized authority will be automatically removed or restricted; Further, extracting a time limit feature based on the change information and its corresponding change type, and updating the authority scope of the user terminal based on the time limit feature, further includes the following steps: Extracting change features based on change information and its corresponding change type; Among them, the change characteristics are other non-temporal characteristics directly related to the change of authority, such as position change, responsibility adjustment, etc.; When there are change characteristics, a permission modification request is generated according to the change characteristics, and the request is sent to the management end for verification; That is, when it is detected that the scope of the user's authority needs to be modified based on the change characteristics, a permission modification request is generated, which includes the reason for the modification (i.e., the change characteristics), the recommended permission adjustment content, etc., and is sent to the management end for review and verification; Receive verification results from the management end and adjust the scope of permissions of the user end according to the verification results; That is, after receiving the permission modification request, the management side will conduct necessary review and verification to ensure the rationality and security of the permission modification. The verification results may include approval, rejection, or request for more information, etc. Based on the verification results fed back by the management side, the scope of its permissions will be adjusted accordingly.

[0036] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0037] In one embodiment, a permission control platform based on an ERP system is provided, and the permission control platform based on an ERP system corresponds one-to-one to a permission control method based on an ERP system in the above embodiment. The permission control platform based on an ERP system includes: The permission verification module is used to verify the permission scope of the user terminal and the permission identifier of the permission request when receiving a non-sensitive permission request from the user terminal; The permission request confirmation module is used to confirm the permission request of the user terminal when the permission range of the user terminal does not include the permission identifier corresponding to the permission request; A compliance verification module, for obtaining the permission verification information of the user terminal if the same permission request is still received from the user terminal, and verifying the compliance of the permission request based on the permission verification information, wherein the permission verification information includes geographic location information, position information, and department information; A temporary permission granting module is used to grant the user terminal a temporary permission including a permission identifier preset corresponding to the permission request when the compliance verification passes, and send permission confirmation information to the management terminal corresponding to the permission request; The permission update module is used to extract the time limit feature of the permission verification information when receiving the permission information fed back by the management end, and update the permission scope of the user end to include the permission identifier corresponding to the permission request based on the time limit feature; Optionally, also include: A sensitivity identification module, used to identify the sensitivity of a permission request when receiving a permission request from a user terminal; Optional compliance verification modules include: The off-site violation verification submodule is used to verify whether the user terminal has off-site violation risks based on geographic location information and job information; A matching verification submodule is used to verify the matching of the user terminal and the position of the permission request based on the position information if there is no risk of off-site violation; The input submodule is used to input the position information and the department information to the pre-trained job handover judgment model if the job matching verification is passed, so that the job handover judgment model can judge whether the user terminal may have a job handover; The authority identification submodule is used to identify whether the job handover feature contains the authority identification of the authority request when receiving the job handover feature output by the job handover judgment model, so as to verify the compliance of the authority request; Optional, off-site violation verification submodules include: The time comparison submodule is used to compare whether the issuance time of the permission request is within the working hours associated with the position information; A similarity identification submodule is used to identify the location similarity between the current location information and the historical location information; The verification submodule is used to verify whether the user terminal has a risk of violation of the remote location based on the preset remote verification rules, combined with the comparison results, location similarity and job information; Optionally, also include: An information matching module is used to match preset corresponding operation record information based on the change type of the change information when there is change information in the department information within a preset time; The correlation analysis module is used to perform correlation analysis on job information and operation record information based on preset judgment rules; Optionally, also include: The change information acquisition module is used to obtain the change information of the department information within a preset time and the change type corresponding to the change information; The timeliness determination module is used to extract time limit features based on the change information and its corresponding change type, and update the authority scope of the user terminal based on the time limit features.

[0038] For the specific definition of an ERP system-based permission control platform, please refer to the definition of an ERP system-based permission control method mentioned above, which will not be repeated here. Each module in the above-mentioned ERP system-based permission control platform can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0039] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A permission control method based on an ERP system, characterized in that: Includes steps: When receiving a non-sensitive permission request from a user, verify the permission scope of the user and the permission identifier of the permission request; When the permission range of the user terminal does not include the permission identifier corresponding to the permission request, confirm the permission request of the user terminal; If the same permission request is still received from the user, the permission verification information of the user is obtained, and the compliance of the permission request is verified based on the permission verification information, where the permission verification information includes geographic location information, position information, and department information; When the compliance verification passes, the user terminal is granted temporary permission including the permission identifier preset corresponding to the permission request, and permission confirmation information is sent to the management terminal corresponding to the permission request; When the permission information fed back by the management end is received, the time limit feature of the permission verification information is extracted, and based on the time limit feature, the permission range of the user end is updated to include the permission identifier corresponding to the permission request.

2. According to claim 1, a permission control method based on an ERP system is characterized in that: When a non-sensitive permission request is received from a user terminal, before the step of verifying the permission scope of the user terminal and the permission identifier of the permission request, the following steps are performed: When receiving a permission request from a user, identify the sensitivity of the permission request.

3. The permission control method based on the ERP system according to claim 1 is characterized in that: If the same permission request is still received from the user, the permission verification information of the user is obtained, and the compliance of the permission request is verified based on the permission verification information, wherein the permission verification information includes geographic location information, position information, and department information, including the steps of: Verify whether the user has any risk of off-site violation based on geographic location information and job information; If there is no risk of off-site violation, the user terminal is verified to match the position of the permission request based on the position information; If the job matching verification is passed, the job information and the department information are input into the pre-trained job handover judgment model, so that the job handover judgment model can judge whether the user terminal is likely to have a job handover; When the job handover feature output by the job handover judgment model is received, it is identified whether the job handover feature contains the permission identifier of the permission request to verify the compliance of the permission request.

4. The method for controlling permissions based on an ERP system according to claim 3 is characterized in that: The geographic location information includes current location information and historical location information. The step of verifying whether the user terminal has a risk of off-site violation based on the geographic location information and job information includes the following steps: Compare whether the time of issuing the permission request is within the working hours associated with the position information; Identify the location similarity between the current location information and the historical location information; Based on the preset off-site verification rules, combined with the comparison results, location similarity and job information, it is verified whether the user terminal has the risk of off-site violation.

5. The method for controlling rights based on an ERP system according to claim 3 is characterized in that: If the job matching verification is passed, the job information and the department information are input into a pre-trained job handover judgment model, so that the job handover judgment model judges whether the user terminal may have a job handover, including the following steps: When there is change information in the department information within the preset time, the job handover judgment model matches the preset corresponding operation record information based on the change type of the change information; The job handover model performs correlation analysis on job information and operation record information based on preset judgment rules.

6. The permission control method based on the ERP system according to claim 1 is characterized in that: The step of extracting the time limit feature of the permission verification information and updating the permission scope of the user terminal to include the permission identifier corresponding to the permission request based on the time limit feature when the permission information fed back by the management terminal is received includes the following steps: Obtain the change information of the department information within the preset time and the change type corresponding to the change information; A time limit feature is extracted based on the change information and its corresponding change type, and the authority scope of the user terminal is updated based on the time limit feature.

7. An authority control platform based on an ERP system, characterized by: include: The permission verification module is used to verify the permission scope of the user terminal and the permission identifier of the permission request when receiving a non-sensitive permission request from the user terminal; The permission request confirmation module is used to confirm the permission request of the user terminal when the permission range of the user terminal does not include the permission identifier corresponding to the permission request; A compliance verification module, for obtaining the permission verification information of the user terminal if the same permission request is still received from the user terminal, and verifying the compliance of the permission request based on the permission verification information, wherein the permission verification information includes geographic location information, position information, and department information; A temporary permission granting module is used to grant the user terminal a temporary permission including a permission identifier preset corresponding to the permission request when the compliance verification passes, and send permission confirmation information to the management terminal corresponding to the permission request; The permission update module is used to extract the time limit feature of the permission verification information when receiving the permission information fed back by the management end, and update the permission scope of the user end to include the permission identifier corresponding to the permission request based on the time limit feature.

8. The permission control platform based on the ERP system according to claim 7 is characterized in that: The compliance verification module includes: The off-site violation verification submodule is used to verify whether the user terminal has off-site violation risks based on geographic location information and job information; A matching verification submodule is used to verify the matching of the user terminal and the position of the permission request based on the position information if there is no risk of off-site violation; The input submodule is used to input the position information and the department information to the pre-trained job handover judgment model if the job matching verification is passed, so that the job handover judgment model can judge whether the user terminal may have a job handover; The authority identifier identification submodule is used to identify whether the job handover feature contains the authority identifier of the authority request when receiving the job handover feature output by the job handover judgment model, so as to verify the compliance of the authority request.

Images