User permission design method and system for departure flight, storage medium and equipment

Abstract

The invention belongs to the technical field of airport flights, and provides a user permission design method and system for departure flights, a storage medium and equipment, and the method comprises the steps: collecting information of business users according to different scales and responsibilities of airport groups and airlines, and dividing the information into a plurality of posts; defining an authorization authentication model conforming to actual characteristics of civil aviation; only authorized users of the background access system can access corresponding function interfaces. According to the invention, the problem that the existing user authority base airport can only complete the departure control of the base airport and cannot realize the business dilemma of global flight centralized control is solved.

Description

Technical Field

[0001] The invention belongs to the technical field of airport flights and relates to a method, system, storage medium and equipment for designing user authority of a departing flight. Background Art

[0002] At present, the groupization of airport operations and the concentration of airlines are becoming more and more obvious; airport groups hope to improve the overall utilization rate of airport resources through the integrated development of core hub airports, trunk airports, and feeder airports. Large airlines centrally operate global flights through the service departments of the bases, complete business standardization and refinement, and enhance brand influence.

[0003] Existing airport departure flights can only be controlled by airport personnel, and cross-airport flight control is not supported. An airport can only complete departure control at its own airport, and cannot centrally control the airport group business of multiple airports, making it impossible for airport groups and large airlines to achieve full-area control capabilities.

[0004] Based on the above-mentioned problems, and taking into account the uneven capabilities of staff in various regions, inconsistent passenger service levels, and poor passenger experience, airport groups and large airlines urgently need to coordinate the flight control operations of airport groups and large airlines. Summary of the invention

[0005] In order to solve the above-mentioned problem, the present invention provides a method, system, storage medium and device for designing user rights for departing flights.

[0006] In a first aspect, the present invention provides a method for designing user rights for departing flights, which adopts the following technical solution:

[0007] According to the different sizes and responsibilities of airport groups or airlines, collect information on business users and divide roles; define an authorization and authentication model that conforms to the actual characteristics of civil aviation; only authorized users can access the corresponding functional interfaces in the backend access system.

[0008] Preferably, an authorization and authentication model that conforms to the actual characteristics of civil aviation is defined, including four models: "user group-role-functional interface", "user-user group-data permission", "support and non-support data permissions", and "user group-user subgroup-data position".

[0009] Preferably, the "user group-role-functional interface" model further simplifies the roles into three categories: controller, control director, static data administrator; "user group-role" and "role-functional interface" are both one-to-many relationships.

[0010] Preferably, the "user-user group-data permission" model includes: establishing user groups, and each user group is authorized with data permissions; the data permissions exist in multiple dimensions, including airports, airlines, flight numbers, and domestic and international attributes.

[0011] Preferably, the "data authority supporting AND and NOT" model includes: the base controller of airline A can be responsible for the agent control work of airline B...airline N at airport x, and the data authority of the flight control business of the airline supports "AND", that is, to increase the flights of the airline, the following formula is satisfied:

[0012] Data permissions = {{(airline, airport)|airline = airline A, airport∈list of all airports served by airline A}+{(airline B, airport x)+…+(airline N, airport x)}}.

[0013] Preferably, the "user group-user subgroup-data position" model includes: data position = {functional interface|functional interface∈list of functional interfaces involved in recycling}

[0014] Among them, "user group and user subgroup" and "user subgroup and data position" are both one-to-many relationships, that is, one user group corresponds to multiple user subgroups, and one user subgroup corresponds to multiple data positions.

[0015] Preferably, the user group includes multiple users with similar authority requirements, and the users are registered in the system and authenticated.

[0016] In a second aspect, the present invention provides a user authority design system for departing flights, which adopts the following technical solution:

[0017] The system includes a module for collecting business users and dividing roles, a module for building permission models, and a module for accessing the backend system.

[0018] The business user collection and role division module is used to collect business user information and divide roles;

[0019] The building module of the permission model is used to define an authorization and authentication model that conforms to the actual characteristics of civil aviation;

[0020] The access module of the background system is used to ensure that only authorized users of the background access system can access the corresponding functional interface.

[0021] In a third aspect, the present invention provides a computer storage medium, which adopts the following technical solution:

[0022] A computer storage medium stores one or more programs, and when the one or more programs are executed, the above-mentioned method for designing user rights for departing flights can be implemented.

[0023] In a fourth aspect, the present invention provides a device, which adopts the following technical solution:

[0024] A device includes a processor, a communication interface, a memory and a communication bus; the processor, the communication interface and the memory communicate with each other via the communication bus; the memory stores at least one program in the computer storage medium that can be loaded and executed by the processor.

[0025] In summary, the present invention includes the following beneficial technical effects:

[0026] 1. Through the combination of four models, namely "user group role function interface", "user user group data permissions", "support and non-support data permissions" and "user group user subgroup data positions", the user permission design of overall control and sub-control is realized. It has been successfully implemented in large airport groups and large airlines, achieving a breakthrough in the domestic civil aviation field and becoming a departure control permission system that fits the actual characteristics of civil aviation and meets data security requirements;

[0027] 2. The backend business system imposes content restrictions on data permissions. This mechanism achieves a balance between flexible system configuration and simple user operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flow chart of a method for designing user rights for departing flights is disclosed.

[0029] Figure 2 A framework diagram of a user authority design system for departing flights is disclosed.

[0030] Figure 3 A structural schematic diagram of an electronic device is disclosed. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0032] The following is combined with Figure 1-3 The present invention is further described in detail.

[0033] See attached Figure 1 The present invention proposes a user authority design method for departing flights, taking airport groups or airlines as research objects, and aims to solve the business dilemma that the base airport can only complete the departure control of the base airport in the existing user authority, and cannot realize the centralized control of global flights.

[0034] The user authority design method for the departing flight includes the following steps:

[0035] S1. Collection and role division of business users

[0036] Collect information on business users and divide them into roles according to the size and responsibilities of the airport group or airline, including:

[0037] S101. Collecting business user information

[0038] According to the existing technology, the positions of airport groups are divided into trunk airport controllers, core hub airport control directors, core hub airport controllers, feeder airport departure operators, and core hub airport static data managers;

[0039] According to the existing technology, the job division of airlines includes base general control officer, base general control director, base static data administrator, branch sub-control officer, ground agent controller, branch sub-control director, and ground agent control director.

[0040] S102. Role division of business users

[0041] Simplify the positions of airport groups or airlines, including controllers, control directors, and static data administrators.

[0042] S2. Construction of permission model

[0043] There are many permission models in the industry. Common permission models include role-based access control (RBAC) and policy-based access control (PBAC).

[0044] Among them, RBAC is simple in design and supports the authorization of interface functions, but it cannot authorize data permissions for specific airports to specific people;

[0045] PBAC supports fine-grained authorization of interface functions and data permissions, but cannot support reverse query of which users control specific airports and specific airlines.

[0046] Furthermore, based on the advantages of RBAC and PBAC, the authorization and authentication model that conforms to the actual characteristics of civil aviation is redefined, including the "user group-role-functional interface", "user group-user subgroup-data position", "user-user group-data permission", and "support and non-support data permissions" models.

[0047] S201. Build a "user group-role-function interface" model

[0048] 1. Establishing the relationship between user groups and roles. User groups and roles are in a one-to-many relationship, that is, one user group contains multiple roles. Based on the existing RBAC permission model and combined with the role division in step S102, different user groups can be divided according to actual needs.

[0049] Among them, a user group is a collection of users, including multiple users with similar permission requirements. These users are registered and authenticated by the system.

[0050] For example,

[0051] If the airport dimension is a single airport, the user group represents the position of the feeder or trunk controller;

[0052] If the airport dimension is multiple airports, the user group represents the core hub airport controller position.

[0053] 2. Establish the relationship between roles and functional interfaces. Roles and functional interfaces belong to a one-to-many relationship, that is, one role can access multiple functional interfaces. Each role corresponds to a specific functional interface access permission list. The functional interface access permission list can be defined according to actual needs.

[0054] 3. Database design of the “user group-role-functional interface” model: Design a database for the “user group-role-functional interface” model that is used to store role tables, user tables, user group tables, functional interface tables, and relationship establishment tables.

[0055] Among them, the relationship establishment table includes a user-role association table, a user group-role association table, and a role-function interface association table.

[0056] 4. Establish a corresponding "user group-role-function interface" model based on the database of the "user group-role-function interface" model.

[0057] S202. Build a "user-user group-data permissions" model

[0058] 1. User registration and management: design the user registration process and collect necessary user information, including user name, password, mobile phone number, and email address; provide user information management functions to allow users to modify personal information, passwords, etc.

[0059] 2. User group creation and management: Create user groups based on actual business needs, such as dividing them by department, team, project, etc. User groups have a hierarchical structure and support the creation and management of sub-user groups. Administrators authorize data permissions for each user group.

[0060] 3. Data permission design and management: When a user applies for interface access rights, he / she needs to clearly state which user group he / she belongs to. The system will automatically inherit the functional interface and data permissions corresponding to the user group to which the user belongs.

[0061] Among them, data permissions are designed in multiple dimensions, including airports, airlines, flight numbers, and domestic and international attributes.

[0062] 4. Database design of the "user-user group-data permission" model, designing the database of the "user-user group-data permission" model for storing user tables, user group tables, data permission tables, and association tables;

[0063] Among them, the association table includes a user-user group association table and a user group-data permission association table.

[0064] 5. Establish a corresponding "user-user group-data permission" model based on the database of the "user-user group-data permission" model.

[0065] S203, "Support and non-Support Data Permission" Model

[0066] 1. For the core hub airports of the airport group, the control rights of each airline in the airport group at different airports are different.

[0067] For example, an airline is operated by the airline at Airport A, but not by the airline at Airport B. The data rights of the airline's flight control business satisfy the Cartesian product, including the following formula:

[0068] Airline set * airport set = {(airline, airport)|airline∈airlinelist, airport∈airportlist)}

[0069] Since an airline is operated by the airline at Airport A but not at Airport B, the flight control business needs of the airline cannot be met. The data permission of the flight control business of the airline supports "non", which means excluding the flights of the airline, satisfying the following formula:

[0070] Data permissions = {{(airline, airport)|airline∈airlinelist, airport∈airportlist)}-{(exclude airline A, exclude airport 1)+…+(exclude airline n, exclude airport m)}}

[0071] 2. For an airline’s base, the base controller is not only the controller of the airline’s global flights, but may also be the acting controller of other airlines’ global flights.

[0072] For example, the base controller of airline A is responsible for the proxy control work of airline B...airline N at airport x. The data permission of the flight control business of the airline supports "and", that is, to increase the flights of the airline, the following formula is satisfied:

[0073] Data permissions = {{(airline, airport) | airline = airline A, airport∈list of all airports served by airline A} + {(airline B, airport x) + ... + (airline N, airport x)}}

[0074] 3. Based on the above data analysis of the core hub airports of airport groups and the bases of airlines, a database of the "support and non-support data authority" model is designed.

[0075] 4. Establish a corresponding "support and non-support data permissions" model based on the database of the "support and non-support data permissions" model. The "support and non-support data permissions" model takes into account the multiple identities of a user.

[0076] S204, "User Group-User Subgroup-Data Position" Model

[0077] 1. Recycling business of adding and subtracting permissions

[0078] The centralized control of the airport group means that part of the operations of the branch airport will be transferred to the hub airport for execution; the base control takes back part of the operations of the previous branches and ground agents, that is, the control rights are recovered and no longer delegated to the branches for operation; when the centralized control of the airport group or airline is opened, it is necessary to support the functional interface to be able to be readjusted again, that is, the functional interface can increase or decrease data permissions.

[0079] For example, the base controller of airline A can be responsible for the proxy control work of airlines B and airlines C at airport x. The "control director" role includes the "interface α" and "interface β" functional interfaces of airline A and the "interface α" and "interface β" functional interfaces of airline B, satisfying the following formula:

[0080] Sub-control user group 1 is the "control director" role, and the data permission is "{(airline, airport)|airline = {airline A, airline B}, airport = airport X}";

[0081] The general control user group 2 is the "control director" role, and the data permission is "{(airline, airport)|airline = airline A, airport∈list of all airports served by airline A}".

[0082] Among them, if the master control user group 2 wants to reclaim the sub-control of airline A by the sub-control user group 1, it needs to delete the "Interface α" functional interface of airline A of the sub-control user group 1, but cannot delete the "Interface α" and "Interface β" functional interfaces of airline B of the sub-control user group 1.

[0083] 2. Problems with adding and subtracting permissions

[0084] According to the "user group-role-functional interface" model in step S21, the roles and functional interfaces are in a one-to-many relationship, that is, one role can access multiple functional interfaces. Due to the global or shared nature of the system, if the "interface α" functional interface of airline A is deleted, the "interface α" functional interface of airline B will be deleted uniformly, resulting in the problem of not being able to support the addition and deletion of functional interfaces based on data permissions.

[0085] 3. Define “data positions”

[0086] Based on the above problem of "not being able to support the addition and deletion of functional interfaces based on data permissions", the definition of data positions is proposed to meet the following formula:

[0087] Data position = {functional interface | functional interface∈recycling involved functional interface list}

[0088] Among them, "user group and user subgroup" and "user subgroup and data position" are both one-to-many relationships, that is, one user group corresponds to multiple user subgroups, and one user subgroup corresponds to multiple data positions.

[0089] Exemplarily, the user group "sub-control user group 1" is decomposed into two user sub-groups "user sub-group 1.1" and "user sub-group 1.2";

[0090] The data permissions corresponding to user subgroup 1.1 satisfy the following formula:

[0091] {(airline, airport)|airline = airline A, airport = airport x}

[0092] The data permissions corresponding to user subgroup 1.2 satisfy the following formula:

[0093] {(airline, airport)|airline = airline B, airport = airport x}

[0094] The data permissions corresponding to the master control user group 2 remain unchanged.

[0095] Assume that the user subgroup with "Data Position I" can access the functions provided by "Interface α". If "Data Position I" of user subgroup 1.1 in sub-control user group 1 is deleted, it means that user subgroup 1.1 in sub-control user group 1 cannot access the functions provided by "Interface α".

[0096] If user subgroup 1.2 "Data Position I" in sub-control user group 1 is reserved, it means that master control user group 2 includes "Data Position I", and master control user group 2 can access the functions provided by "Interface α";

[0097] Therefore, the business of branch airports or ground agents that was originally handled by user subgroup 1.1 can be recovered or taken over by user subgroup 1.2 or master control user group 2.

[0098] It can be seen that by adjusting the role assignments of user groups and user subgroups, rather than directly modifying the users themselves, the system administrator can quickly reclaim or reallocate access rights to specific functions, such as "interface α".

[0099] 4. Database design of the "user group-user subgroup-data position" model: Based on the analysis of sub-steps 1-3 of the above step S204, a database of the "user group-user subgroup-data position" model is constructed.

[0100] 5. Establish a corresponding "user group-user subgroup-data position" model based on the database of the "user group-user subgroup-data position" model.

[0101] S205. Combination of four permission models

[0102] The four models of "user group-role-functional interface", "user-user group-data permission", "support and non-support data permission" and "user group-user subgroup-data position" are not isolated, but interrelated and work together, including the following steps:

[0103] 1. Assign multiple users with similar permission requirements to the same user group, and then assign roles and functional interfaces to the user groups to control user access to system functions;

[0104] 2. The user group can be broken down into multiple user subgroups, and then data permissions and data positions can be assigned to the user subgroups to control user access and operations on data.

[0105] By designing four models for basic management of authorization and authentication of departure control business and management of addition and subtraction of permissions, a comprehensive and flexible permission management system is built through the comprehensive application of the four models. This enables hub airports with higher business capabilities to be centrally authorized and completes flight control of other airports under the jurisdiction of the group.

[0106] S3. Access to the backend system

[0107] For centralized control business, the backend access system performs on-off control on access rights to ensure that only authorized users can access the corresponding functional interfaces; the backend business system performs content restrictions on data permissions to ensure that users can only access the data scope for which they are authorized; this mechanism achieves a balance between flexible system configuration and simple user operation.

[0108] See attached Figure 2The present invention proposes a user authority design system for departing flights, which includes a business user collection and role division module, an authority model construction module, and a background system access module.

[0109] Business user collection and role division module, used to collect business user information and divide roles;

[0110] The building module of the permission model is used to define the authorization and authentication model that conforms to the actual characteristics of civil aviation;

[0111] The access module of the backend system is used to ensure that only authorized users can access the corresponding functional interfaces of the backend access system.

[0112] The modules described above may be implemented in whole or in part through software, hardware, or a combination thereof, supporting processors embedded in or independent of a computer device in hardware form, and also supporting memory stored in a computer device in software form, so that the processor can call and execute operations corresponding to the modules described above.

[0113] An embodiment of the present invention provides a computer storage medium, which stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable the at least one processor to execute a computer program of a user authority design method for a departing flight as described above.

[0114] The storage medium includes, for example, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a magnetic disk, a read-only memory (ROM), a random access memory (RAM), or an optical disk.

[0115] The embodiment of the present invention provides a device, see the attached Figure 3 , used to execute the above-mentioned coding management platform, the computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is used to provide computing and control capabilities; the memory of the computer device includes a non-volatile storage medium and an internal memory; the processor of the computer device implements the steps of the above-mentioned coding management method when executing the computer program; the non-volatile storage medium stores an operating system, a computer program and a database; the internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium.

[0116] It should be noted that the user information (including but not limited to user device information and personal information, etc.) and data (including but not limited to data used for analysis, stored data and displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0117] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for designing user rights for departing flights, characterized in that: The method includes: Collect information on business users and divide their roles according to the size and responsibilities of airport groups or airlines; Define an authorization and authentication model that meets the actual characteristics of civil aviation; Only authorized users can access the corresponding functional interface of the backend access system.

2. A method for designing user rights for departing flights according to claim 1, characterized in that: The authorization and authentication model defined in the above-mentioned manner conforms to the actual characteristics of civil aviation, including four models: "user group-role-functional interface", "user-user group-data authority", "support and non-support data authority", and "user group-user subgroup-data position".

3. A method for designing user rights for departing flights according to claim 2, characterized in that: The "user group-role-functional interface" model further simplifies the roles into three categories: controller, control director, and static data administrator; Both "user group-role" and "role-functional interface" are one-to-many relationships.

4. The method for designing user rights for departing flights according to claim 2, characterized in that: The "user-user group-data permission" model includes: Establish user groups, and authorize data permissions for each user group; data permissions exist in multiple dimensions, including airports, airlines, flight numbers, and domestic and international attributes.

5. The method for designing user rights for departing flights according to claim 2, characterized in that: The "support and non-support data permissions" model includes: The base controller of airline A can be responsible for the agent control work of airline B...airline N at airport x. The data permission of the flight control business of the airline supports "and", that is, to increase the flights of the airline, satisfying the following formula: Data permissions = {{(airline, airport)|airline = airline A, airport∈list of all airports served by airline A}+{(airline B, airport x)+…+(airline N, airport x)}}.

6. The method for designing user rights for departing flights according to claim 2, characterized in that: The "user group-user subgroup-data position" model includes: Data position = {functional interface | functional interface∈recycling involved functional interface list} Among them, "user group and user subgroup" and "user subgroup and data position" are both one-to-many relationships, that is, one user group corresponds to multiple user subgroups, and one user subgroup corresponds to multiple data positions.

7. The method for designing user rights for departing flights according to claim 4, characterized in that: The user group includes multiple users with similar authority requirements, and the users are registered in the system and authenticated.

8. A user authority design system for departing flights, characterized in that: It includes business user collection and role division modules, permission model construction modules, and backend system access modules; The business user collection and role division module is used to collect business user information and divide roles; The building module of the permission model is used to define an authorization and authentication model that conforms to the actual characteristics of civil aviation; The access module of the background system is used to ensure that only authorized users of the background access system can access the corresponding functional interface.

9. A computer storage medium, characterized in that One or more programs are stored, and when the one or more programs are executed, a method for designing user rights for a departing flight as described in any one of claims 1 to 7 can be implemented.

10. A device, characterized in that: The system comprises a processor, a communication interface, a memory and a communication bus; the memory stores at least one program in a computer storage medium as claimed in claim 9 which can be loaded and executed by the processor.

Images