Service system authority management method and device, computer equipment and storage medium

Abstract

The invention relates to a business system authority management method and device, computer equipment and a storage medium. The method comprises the following steps: distributing system permissions corresponding to business systems of a target mechanism on a system layer; in the multi-system role permission control layer, role permission systems corresponding to all the service systems are configured according to system permissions corresponding to all the service systems, and an online approval unit is constructed and used for distributing role data of a user in a corresponding target service system according to a role application request of the user; and in the multi-system role permission control layer, role permissions corresponding to the role data are allocated to the user according to a role permission system corresponding to the target service system. By adopting the method, unified authority management can be carried out on a plurality of systems, and automatic authority configuration is realized.

Description

Technical Field

[0001] The present application relates to the technical field of system authority management, and in particular to a business system authority management method, apparatus, computer equipment and storage medium. Background Art

[0002] Currently, the permission management of business systems is implemented based on the User Role Premission (URP) model. The User Role Premission model is the basic model of permission management, which can meet the basic permission management needs and is widely used in the industry.

[0003] However, the user-role-permission model has the problem of difficulty in integrating with other systems, and the permission management function is also relatively imperfect. It usually only provides basic permission management functions, such as user management, role management, permission allocation, etc., and usually can only perform simple permission control on the user level. For enterprises with multiple system permission management needs, the current permission management method cannot meet the actual business needs. For example, there may be multiple operating systems that provide support for marketing personnel, and each system has its own permission management mechanism, which makes the operation of permissions complicated because they need to be configured separately between each system. Similarly, it becomes difficult to set roles and assign permissions for different positions, and they must be manually configured on each system separately. Therefore, how to unify the permission management of multiple systems and realize automated permission configuration has become a technical problem that needs to be solved at present. Summary of the invention

[0004] Based on this, it is necessary to provide a business system permission management method, device, computer equipment, and storage medium that can perform unified permission management on multiple systems and realize automated permission configuration in response to the above technical problems.

[0005] In a first aspect, the present application provides a business system rights management method, comprising:

[0006] Allocate system permissions corresponding to each business system of the target organization at the system level;

[0007] In the multi-system role permission control layer, the role permission system corresponding to each business system is configured according to the system permissions corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request;

[0008] In the multi-system role permission control layer, the role permissions corresponding to the role data are assigned to users according to the role permission system corresponding to the target business system.

[0009] In one embodiment, the system permissions corresponding to each business system of the target organization are allocated at the system level, including:

[0010] Obtain the authority files of multiple business systems of the target organization at the system level;

[0011] Matching the authority files of each business system with the authority database, and determining the database files in the authority database that match the authority files of each business system;

[0012] According to the database files in the authority database, the corresponding system permissions of each business system are allocated.

[0013] In one embodiment, the method further comprises:

[0014] A permission control unit is built at the system layer, which is used to control the on and off status of system permissions of multiple business systems.

[0015] In one embodiment, the method further comprises:

[0016] At the system level, perform a permission verification on the user login information of the source business system in multiple business systems;

[0017] After a verification is passed, the verification pass information is sent to the destination business system;

[0018] Receive the verification information sent by the target business system, and perform secondary authority verification on the verification information;

[0019] After the secondary verification is passed, the login channel between the source business system and the destination business system is opened.

[0020] In one embodiment, the method further comprises:

[0021] At the authority customization layer, the access rights of the branch organizations corresponding to the target organization are configured according to the authority customization information; the authority customization information includes at least one of authority inheritance information and authority combination information.

[0022] In one embodiment, the method further comprises:

[0023] At the permission customization layer, the permission restriction role in the branch corresponding to the target organization is determined based on the permission restriction information;

[0024] Perform role permission restrictions on permission-restricted roles based on permission restriction information.

[0025] In one embodiment, the method further comprises:

[0026] At the multi-system role permission control layer, detect abnormal users in each business system;

[0027] Disable the role permissions of abnormal users in the corresponding business system.

[0028] In a second aspect, the present application also provides a business system rights management device, including:

[0029] The system authority allocation module is used to allocate the system authority corresponding to each business system of the target organization at the system level;

[0030] The user role allocation module is used to configure the role permission system corresponding to each business system according to the system permissions corresponding to each business system in the multi-system role permission control layer, and to build an online approval unit; the online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request;

[0031] The role permission allocation module is used to allocate role permissions corresponding to role data to users in the multi-system role permission control layer according to the role permission system corresponding to the target business system.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] Allocate system permissions corresponding to each business system of the target organization at the system level;

[0034] In the multi-system role permission control layer, the role permission system corresponding to each business system is configured according to the system permissions corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request;

[0035] In the multi-system role permission control layer, the role permissions corresponding to the role data are assigned to users according to the role permission system corresponding to the target business system.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0037] Allocate system permissions corresponding to each business system of the target organization at the system level;

[0038] In the multi-system role permission control layer, the role permission system corresponding to each business system is configured according to the system permissions corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request;

[0039] In the multi-system role permission control layer, the role permissions corresponding to the role data are assigned to users according to the role permission system corresponding to the target business system.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Allocate system permissions corresponding to each business system of the target organization at the system level;

[0042] In the multi-system role permission control layer, the role permission system corresponding to each business system is configured according to the system permissions corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request;

[0043] In the multi-system role permission control layer, the role permissions corresponding to the role data are assigned to users according to the role permission system corresponding to the target business system.

[0044] The above-mentioned business system authority management method, device, computer equipment, storage medium and computer program product realize centralized authority management of multiple business systems by uniformly allocating system authorities corresponding to each business system of the target organization at the system level. Due to the adoption of unified authority control technology, the current situation of each business system acting independently is avoided, resource utilization is improved, and the network entity load is reduced. By configuring the role authority system corresponding to each business system according to the system authority corresponding to each business system at the multi-system role authority control layer, and constructing an online approval unit, the online approval unit is used to allocate the role data of the user in the corresponding target business system according to the user's role application request, thereby allocating the role authority corresponding to the role data to the user according to the role authority system corresponding to the target business system. The online approval unit realizes the online one-click application function, thereby realizing automated authority configuration, avoiding manual repetitive operations, improving efficiency, and reducing the risk of manual misoperation, improving authority management efficiency, and ensuring authority management compliance. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] FIG1 is an application environment diagram of a business system rights management method according to an embodiment;

[0047] FIG2 is a schematic diagram of a flow chart of a method for managing business system rights in one embodiment;

[0048] FIG3 is a schematic diagram of a process for allocating system permissions corresponding to each business system of a target organization at the system level in one embodiment;

[0049] FIG4 is a block diagram of a business system rights management device in one embodiment;

[0050] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] The business system authority management method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 sends a business system authority management request to the server 104, and the server 104 allocates the system authority corresponding to each business system of the target organization at the system level; at the multi-system role authority control layer, the role authority system corresponding to each business system is configured according to the system authority corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the role data of the user in the corresponding target business system according to the user's role application request; at the multi-system role authority control layer, the role authority corresponding to the role data is allocated to the user according to the role authority system corresponding to the target business system. Among them, the terminal 102 can be, but not limited to, various personal computers, laptops, smart phones and tablet computers, and the server 104 can be implemented with an independent server or a server cluster composed of multiple servers.

[0053] In an exemplary embodiment, as shown in FIG2 , a business system rights management method is provided, which is described by taking the method applied to the server in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0054] Step 202, assigning system permissions corresponding to each business system of the target organization at the system level.

[0055] The target organization refers to a large organization that has multiple business systems and needs to manage the permissions of multiple business systems. System permissions refer to the various operation permissions that users have when using the system.

[0056] Optionally, a centralized permission management platform is pre-built in the server, and the permission management platform includes a system layer and a multi-system role permission control layer. System layer permission control is the basis of the entire permission management. The multi-system role permission control layer is used to control the role permissions between multiple systems.

[0057] At the system level, the system permissions of each business system of the target structure are identified in a unified permission database, and the system permissions of each business system are allocated to each business system. The system permissions can be a permission menu of the business system, and the permission menu includes various functional operations in the business system. Further, at the system level, the permission menu identifier of each business system of the target structure is identified in a unified permission database, and permissions are allocated to each business system according to the permission menu identifier.

[0058] By assigning system permissions to each business system, corresponding permissions can be assigned to each user of each business system to ensure that users can only access resources within the scope of their permissions.

[0059] Step 204, at the multi-system role authority control layer, configure the role authority system corresponding to each business system according to the system authority corresponding to each business system, and build an online approval unit, which is used to allocate the user's role data in the corresponding target business system according to the user's role application request.

[0060] The role permission system refers to role-based access control, which separates users from permissions and associates them through the role as an intermediate layer. The online approval unit is used to implement the function of online one-click application for job roles. The user's role application request refers to the request submitted in the online approval unit for role application.

[0061] Optionally, in the multi-system role permission control layer, the customization and allocation of job role permissions are realized, including role permission definition, role allocation, and one-click application and approval steps. The role permission definition specifically includes: for each business system, according to the system permissions corresponding to each business system, the role permission system corresponding to each business system is configured, and a set of role permission systems is defined for each business system. Among them, each role contains a set of system permission menus.

[0062] For example, the role permission system can be as follows:

[0063] Users: Alice, Bob, and Charlie;

[0064] Roles: Administrator, Normal User, and Super User;

[0065] Permissions:

[0066] -Administrators: access the management backend, add / delete users, modify user roles and view operation logs;

[0067] - Ordinary users: access public content and post comments;

[0068] -Super User: Access the admin backend, add / delete users, modify user roles, view operation logs, and access sensitive content.

[0069] In the above example, user Alice is assigned the administrator role, user Bob is assigned the ordinary user role, and user Charlie is assigned the super user role. According to the permissions corresponding to the roles, both Alice and Charlie have access to the management backend and have the permissions to add / delete users, modify user roles, and view operation logs. In addition, Charlie also has the permission to access sensitive content, while Bob can only access public content and post comments. This role permission system can effectively classify and manage users and facilitate permission control.

[0070] Role allocation specifically includes: building a permission control center at the system level to centrally manage the permission status of all business systems. The permission control center includes a role allocation module, which allows administrators to assign corresponding roles to each position.

[0071] The one-click application and approval steps specifically include: building an online approval unit, where users can generate role application requests by triggering the online approval unit button, and apply for job roles with one click through the online approval unit. Administrators can approve role application requests in the online approval unit, and after approval, the online approval unit assigns the user's role data in the corresponding target business system. The target business system refers to all business systems related to the user. For example, a user can have different role data or the same role data in different business systems.

[0072] Step 206 , at the multi-system role authority control layer, the role authority corresponding to the role data is allocated to the user according to the role authority system corresponding to the target business system.

[0073] After assigning role data to users, the permission management platform can identify the role permissions corresponding to the role data in the role permission system corresponding to the target business system, and assign the corresponding role permissions to users.

[0074] Furthermore, after the online approval unit assigns role data to the user, it can also automatically enable the requested role permissions for the user in all relevant business systems.

[0075] In the above-mentioned business system authority management method, the system authority corresponding to each business system of the target organization is uniformly allocated at the system level to realize the centralized management of the authority of multiple business systems. Due to the adoption of unified authority control technology, the current situation of each business system acting independently is avoided, resource utilization is improved, and the network entity load is reduced. By configuring the role authority system corresponding to each business system according to the system authority corresponding to each business system at the multi-system role authority control layer, and constructing an online approval unit, the online approval unit is used to allocate the role data of the user in the corresponding target business system according to the user's role application request, so as to allocate the role authority corresponding to the role data to the user according to the role authority system corresponding to the target business system. The online approval unit realizes the online one-click application function, thereby realizing the automated authority configuration, avoiding manual repetitive operations, improving efficiency, and reducing the risk of manual misoperation, improving the efficiency of authority management, and ensuring the compliance of authority management.

[0076] In an exemplary embodiment, as shown in FIG3 , step 202 allocates system permissions corresponding to each business system of the target organization at the system level, including steps 302 to 306. Among them:

[0077] Step 302, obtaining the authority files of multiple business systems of the target organization at the system level.

[0078] Step 304 , matching the authority files of each business system with the authority database, and determining a database file in the authority database that matches the authority files of each business system.

[0079] Step 306: assign system permissions corresponding to each business system according to the database file in the permission database.

[0080] The permission file refers to the permission menu. The permission menu usually includes various functional operations in the business system. The database file refers to the permission file of the business system stored in the permission database.

[0081] Specifically, to implement permission control at the system level, it is necessary to first collect the permission files of all business systems, that is, permission menus. For each business system, a permission matching and mapping module is constructed. The permission matching and mapping module is used to match the permission menus of each business system with the menus in the permission database, and determine the menus that match the permission menus of each business system in the permission database as database files. According to the database files in the permission database, the corresponding system permissions of each business system are allocated.

[0082] Furthermore, the permission menu of each business system and the menu in the permission database can be embodied by a menu identifier, such as a menu identifier as a menu ID. The permission matching and mapping module is used to match the permission menu identifier of each business system with the menu identifier in the permission database, determine the menu identifier in the permission database that matches the permission menu identifier of each business system, and store the menu identifier that matches the permission menu identifier of each business system. When allocating system permissions, the system permissions corresponding to each business system are allocated according to the menu identifier stored in the permission database.

[0083] In this embodiment, by matching the permission files of each business system with the permission database and determining the database files in the permission database that match the permission files of each business system, automatic identification and control of permissions can be achieved, so that the system permissions corresponding to each business system can be uniformly allocated directly based on the permission database.

[0084] In an exemplary embodiment, the method further includes: constructing a permission control unit at the system layer, the permission control unit being used to control the on / off status of system permissions of multiple business systems.

[0085] A permission control center is built at the system level to centrally manage the permission status of all business systems. The permission control center includes a permission control unit, which can control the on and off status of system permissions of multiple business systems, that is, to open or close system permissions as needed.

[0086] Furthermore, controlling the on / off status of system permissions for multiple business systems means controlling the visibility of permission menus for all business systems. For example, when the user management menu permission for system A is turned off, the role that has been assigned to the menu has no access to the menu. Enabling the menu will restore the permission. Through the permission control center, you can control the enabling or disabling of any menu in all systems.

[0087] In an exemplary embodiment, the above method also includes: the step of opening up permissions between business systems, including: at the system layer, performing a permission verification on the user login information of the source business system among multiple business systems; after the first verification is passed, sending the verification pass information to the destination business system; receiving the verification pass information sent by the destination business system, and performing a second permission verification on the verification pass information; after the second verification is passed, opening up the login channel between the source business system and the destination business system.

[0088] Specifically, the permissions between multiple business systems are opened up, which means that the source business system can log in to the destination business system through the permission control center without logging in. The source business system can log in by calling the permission control center at the system layer. The permission control center obtains the user login information and performs a permission verification on the user login information. After the verification is passed once, the permission control center obtains the verification pass information and sends the verification pass information to the destination business system through the url (Uniform Resource Locator) parameter. The destination business system receives the verification pass information and calls the permission control center to perform a second permission verification on the verification pass information. After the second verification is passed, the login channel between the source business system and the destination business system is opened up, and the source business system can log in to the destination business system without logging in.

[0089] In an exemplary embodiment, the method further includes: at the authority customization layer, configuring access rights of the branch corresponding to the target organization according to authority customization information; the authority customization information includes at least one of authority inheritance information and authority combination information.

[0090] Specifically, the target organization may include multiple branches, and the permission management requirements of each branch may be different from the permission management requirements of the target organization. Therefore, by setting up a permission customization layer, the permissions of the branches are customized. The customization layer refers to a customized switch used to implement the local system in each business system. In the permission customization layer, the permission customization information of the branch is obtained, and the access rights of the branch corresponding to the target organization are configured according to the permission customization information. Among them, the permission customization information includes at least one of permission inheritance information and permission combination information. Permission inheritance information means that the permission control center can use the role-role relationship management function to allow a role to inherit the parent role permissions. Permission combination information means that the permission control center can use the user-role relationship management function to allow a user to have different roles and realize permission combination.

[0091] It should be noted that in addition to the preset role permissions, administrators are allowed to customize permissions for branches to control the access rights of each branch.

[0092] In an exemplary embodiment, the method further includes: at the permission customization layer, determining the permission restriction role in the branch corresponding to the target organization according to the permission restriction information; and performing role permission restriction on the permission restriction role according to the permission restriction information.

[0093] At the permission customization layer, the permission restriction information of the branch is obtained, and the administrator of the branch can determine the permission restriction role in the branch; and restrict the permission of the permission restriction role according to the permission restriction information. For example, if the permission restriction role is a marketing staff, set permission restrictions for the marketing staff, close one of their permissions, and control the permissions of each marketing staff.

[0094] Furthermore, in the permission customization layer, permission control can be performed not only according to the branch dimension, but also according to the city dimension, or directly to the black / white list of a certain user level, so as to perform more precise permission control. For example, a certain function can be gradually opened according to the branch, or a "high-risk" salesperson's use of a specific function can be controlled through a permission blacklist.

[0095] It is understandable that the entire permission control center brings together user / role / permission information from multiple business systems and can freely customize roles, including permission inheritance, permission combination, etc., so it can ultimately flexibly manage permissions across multiple business systems, including one-click permission application, one-click enabling / disabling of a permission, etc.

[0096] In this embodiment, the administrator is allowed to perform authority control according to each branch and user role, which meets personalized needs and improves the flexibility of authority management.

[0097] In an exemplary embodiment, the method further includes: at the multi-system role authority control layer, detecting abnormal users in each business system; and closing the role authority of the abnormal user in the corresponding business system.

[0098] In this embodiment, the rights management platform can also perform automated rights recovery. Specifically, in the multi-system role rights control layer, abnormal users in each business system are detected. Abnormal users include users who have resigned or users with abnormal accounts. Abnormal users in the corresponding business system refer to all business systems related to abnormal users. When an abnormal user is detected, the role rights of the abnormal user in all systems will be closed.

[0099] By automatically detecting abnormal users and shutting down their role permissions, the compliance of permissions is ensured and the risk of permission leakage is avoided.

[0100] In an exemplary embodiment, after completing the business system authority management, access control can be implemented for users. Specifically, the user logs in to the target business system, and the user's identity is authenticated. After the identity is authenticated, the user's system authority is obtained at the system level. In this way, the role data of the target business system corresponding to the user is obtained, the role data is matched with the role authority system corresponding to the target business system, and the role authority corresponding to the user's role data is obtained, and then the user can perform access control on the business system.

[0101] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0102] Based on the same inventive concept, the embodiment of the present application also provides a business system rights management device for implementing the business system rights management method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in the one or more business system rights management device embodiments provided below can refer to the limitations of the business system rights management method above, and will not be repeated here.

[0103] In an exemplary embodiment, as shown in FIG. 4 , a business system authority management device is provided, including: a system authority allocation module 402, a user role allocation module 404 and a role authority allocation module 406, wherein:

[0104] The system authority allocation module 402 is used to allocate system authorities corresponding to each business system of the target organization at the system level.

[0105] The user role allocation module 404 is used to configure the role permission system corresponding to each business system according to the system permissions corresponding to each business system in the multi-system role permission control layer, and to build an online approval unit; the online approval unit is used to allocate the user's role data in the corresponding target business system according to the user's role application request.

[0106] The role authority allocation module 406 is used to allocate role authority corresponding to role data to users according to the role authority system corresponding to the target business system at the multi-system role authority control layer.

[0107] In an exemplary embodiment, the system authority allocation module 402 is also used to obtain the authority files of multiple business systems of the target organization at the system level; match the authority files of each business system with the authority database, and determine the database files in the authority database that match the authority files of each business system; and allocate system permissions corresponding to each business system based on the database files in the authority database.

[0108] In an exemplary embodiment, the above device further includes:

[0109] The permission control module is used to build a permission control unit at the system level. The permission control unit is used to control the on and off status of system permissions of multiple business systems.

[0110] In an exemplary embodiment, the permission control module is also used to perform a permission verification on the user login information of the source business system among multiple business systems at the system level; after the first verification is passed, the verification pass information is sent to the destination business system; the verification pass information sent by the destination business system is received, and a second permission verification is performed on the verification pass information; after the second verification is passed, a login channel between the source business system and the destination business system is opened.

[0111] In an exemplary embodiment, the authority control module is further used to configure access rights of branches corresponding to the target organization according to authority customization information at the authority customization layer; the authority customization information includes at least one of authority inheritance information and authority combination information.

[0112] In an exemplary embodiment, the authority control module is also used to determine the authority restriction role in the branch corresponding to the target organization according to the authority restriction information at the authority customization layer; and to restrict the authority of the authority restriction role according to the authority restriction information.

[0113] In an exemplary embodiment, the permission control module is also used to detect abnormal users in each business system at the multi-system role permission control layer; and close the role permissions of the abnormal users in the corresponding business system.

[0114] Each module in the above-mentioned business system rights management device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0115] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as permission files, permission databases, and role permission systems. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business system permission management method is implemented.

[0116] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0118] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0119] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0122] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A business system rights management method, characterized in that: The method comprises: Allocate system permissions corresponding to each business system of the target organization at the system level; In the multi-system role authority control layer, the role authority system corresponding to each business system is configured according to the system authority corresponding to each business system, and an online approval unit is constructed. The online approval unit is used to allocate the role data of the user in the corresponding target business system according to the user's role application request; In the multi-system role authority control layer, the role authority corresponding to the role data is allocated to the user according to the role authority system corresponding to the target business system.

2. The method according to claim 1, characterized in that The system permissions corresponding to each business system of the target organization allocated at the system level include: Obtain the authority files of multiple business systems of the target organization at the system level; Matching the authority files of each business system with the authority database, and determining the database files in the authority database that match the authority files of each business system; According to the database files in the authority database, the system authority corresponding to each business system is allocated.

3. The method according to claim 1, characterized in that The method further comprises: A permission control unit is constructed at the system layer, and the permission control unit is used to control the on and off states of system permissions of multiple business systems.

4. The method according to claim 1, characterized in that: The method further comprises: At the system level, a permission verification is performed on the user login information of the source business system among the multiple business systems; After a verification is passed, the verification pass information is sent to the destination business system; Receiving verification information sent by the target business system, and performing secondary authority verification on the verification information; After the secondary verification is passed, the login channel between the source business system and the destination business system is opened.

5. The method according to claim 1, characterized in that The method further comprises: At the authority customization layer, the access rights of the branch organizations corresponding to the target organization are configured according to the authority customization information; the authority customization information includes at least one of authority inheritance information and authority combination information.

6. The method according to claim 1, characterized in that The method further comprises: At the permission customization layer, determining the permission restriction role in the branch corresponding to the target organization according to the permission restriction information; The role authority is restricted for the authority-restricted role according to the authority restriction information.

7. The method according to claim 1, characterized in that The method further comprises: In the multi-system role authority control layer, abnormal users in each business system are detected; Close the role permissions of the abnormal user in the corresponding business system.

8. A business system rights management device, characterized in that: The device comprises: The system authority allocation module is used to allocate the system authority corresponding to each business system of the target organization at the system level; The user role allocation module is used to configure the role permission system corresponding to each business system according to the system permissions corresponding to each business system at the multi-system role permission control layer, and to build an online approval unit; the online approval unit is used to allocate the role data of the user in the corresponding target business system according to the user's role application request; The role authority allocation module is used to allocate the role authority corresponding to the role data to the user in the multi-system role authority control layer according to the role authority system corresponding to the target business system.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images