User permission transfer system, method and equipment and storage medium

Abstract

The invention provides a user permission transfer system, method and device and a storage medium, and relates to the technical field of user permission management, and the system comprises a permission transfer range maintenance module which is used for setting and maintaining a user role and a permission range capable of performing permission transfer, the new authorization transfer module is used for temporarily transferring authorization of the authority of the first role user to other qualified users in an instant effective or plan effective mode, and the receiving user takes the responsibility of the first role user into play, and the authorization transfer deletion module is used for deleting the existing authorization transfer relation before the authorization transfer plan takes effect. The revocation and authorization transfer module is used for revoking authorization transfer, and the authorization transfer history query statistics module is used for recording and querying history records of authorization transfer operation and providing a statistical analysis function. According to the user permission transfer system, the efficiency and the flexibility of personnel permission management are remarkably improved through effective cooperation of all the modules.

Description

Technical Field

[0001] The present application relates to the technical field of user authority management, and in particular to a user authority transfer system, method, device and storage medium. Background Art

[0002] In the current environment where commercial bank branches are increasingly promoting digital transformation, optimizing the business processes and employee labor combinations of business institutions in order to significantly improve work efficiency has become a vital task. Traditionally, bank branches often face the phenomenon of customers waiting in line, and the service cycle for a single customer is long, which not only affects the customer experience, but also poses a challenge to the bank's operational efficiency.

[0003] After an in-depth investigation, it was found that the reason for customers to wait for a long time was not that the bank counter manager was unfamiliar with the business or was not proficient in system operation. On the contrary, in the process of handling business, the counter manager often needs to stop and wait for the system to remotely verify the customer's materials, or wait for the authorization of the on-site or remote back-office president. Although compared with the previous physical verification methods (such as verification of ID cards, customer paper forms, etc.), the existing system verification process has significantly improved work efficiency, there is still obvious room for improvement. Further analysis of the specific reasons why counter managers wait for authorization found that a key problem is that there are relatively few back-office presidents responsible for approval. Especially when the on-site back-office president is on vacation or holidays, all authorization requests will be automatically submitted to the remote authorization center, and the number of on-duty personnel at the authorization center is limited, which further prolongs the waiting time of the counter manager.

[0004] Therefore, in the case where the branch's back-office manager is temporarily away from work or there are insufficient back-office managers on duty during holidays, it is necessary to find an effective solution to reduce the waiting time of counter managers and improve business processing efficiency. Summary of the invention

[0005] In view of the above problems, the present application provides a user rights transfer system, method, device and storage medium, including the following contents:

[0006] In a first aspect, the present application provides a user rights transfer system, the system comprising:

[0007] Sub-authorization scope maintenance module, new sub-authorization module, sub-authorization deletion module, sub-authorization revocation module and sub-authorization history query statistics module;

[0008] The sub-authorization scope maintenance module is used to set and maintain the user roles and authority scopes that can be sub-authorized;

[0009] The newly added sub-authorization module is used to temporarily sub-authorize the permissions of the first role user to other qualified users in an immediate or planned manner, so that the receiving user can perform the duties of the first role user on behalf of the first role user;

[0010] The deleting sub-authorization module is used to delete the existing sub-authorization relationship before the sub-authorization plan takes effect;

[0011] The revoking sub-authorization module is used to revoke sub-authorization;

[0012] The de-authorization history query statistics module is used to record and query the historical records of de-authorization operations and provide a statistical analysis function.

[0013] Optionally, the sub-authorization scope maintenance module is used to set and maintain the user roles and authority scopes that can be sub-authorized, including:

[0014] Setting review skills for each user role, and establishing a feature model for each user role based on the review skills;

[0015] A delegating scope control table is generated according to the feature model, wherein the delegating scope control table includes a second role user corresponding to the first role user; the second role user is the receiving user; the skills of the second role user cover the skills of the first role user, but the role level is lower than that of the first role user, and the personnel in the delegating scope control table are not fixed.

[0016] Optionally, the newly added sub-authorization module includes:

[0017] The instant transfer authorization submodule is used to immediately transfer permissions to the designated receiving user;

[0018] The planned delegation submodule is used to preset the start and end time of delegation and automatically complete the transfer of authority within the specified time period.

[0019] Optionally, the deleting sub-authorization module deletes an existing sub-authorization relationship before the sub-authorization plan takes effect, including:

[0020] For planned sublicensing plans, delete the existing sublicensing relationship before the sublicensing plan takes effect.

[0021] Optionally, the revoking sub-authorization module revoking sub-authorization includes:

[0022] For the effective sub-authorization, when the first role user returns to work, the effective sub-authorization is revoked and the authority is returned to the first role user;

[0023] The uneffective sub-authorization is revoked, and the uneffective sub-authorization includes the immediately effective sub-authorization and the sub-authorization that has reached the effective date.

[0024] Optionally, the system further includes:

[0025] The security authentication module is used to authenticate and verify the user's login, operation and other behaviors to ensure the security and compliance of system operations.

[0026] Optionally, the system implements user authority transfer through a computer or mobile client.

[0027] In a second aspect, the present application provides a method for transferring user rights, wherein user rights are transferred by using the user rights transfer system described in any one of the first aspects, the method comprising:

[0028] The user generates an immediate effective plan or a planned effective plan by adding a new delegating authorization. Through the user role and authority scope pre-set by the delegating authorization scope maintenance module, the authority of the first role user is temporarily delegated to other qualified system users, and the receiving user performs the duties of the first role user on behalf of the user.

[0029] Optionally, setting and maintaining user roles and authority scopes that can be delegated through the delegation scope maintenance module includes:

[0030] Setting review skills for each user role, and establishing a feature model for each user role based on the review skills;

[0031] A delegating scope control table is generated according to the feature model, wherein the delegating scope control table includes a second role user corresponding to the first role user; the second role user is the receiving user; the skills of the second role user cover the skills of the first role user, but the role level is lower than that of the first role user, and the personnel in the delegating scope control table are not fixed.

[0032] Optionally, the newly added sub-authorization module includes:

[0033] The instant transfer authorization submodule is used to immediately transfer permissions to the designated receiving user;

[0034] The planned delegation submodule is used to preset the start and end time of delegation and automatically complete the transfer of authority within the specified time period.

[0035] Optionally, the deleting sub-authorization module deletes an existing sub-authorization relationship before the sub-authorization plan takes effect, including:

[0036] For planned sublicensing plans, delete the existing sublicensing relationship before the sublicensing plan takes effect.

[0037] Optionally, the revoking sub-authorization module revoking sub-authorization includes:

[0038] For the effective sub-authorization, when the first role user returns to work, the effective sub-authorization is revoked and the authority is returned to the first role user;

[0039] The uneffective sub-authorization is revoked, and the uneffective sub-authorization includes the immediately effective sub-authorization and the sub-authorization that has reached the effective date.

[0040] Optionally, the method further includes: performing identity authentication and permission verification on the user's login, operation and other behaviors through a security authentication module to ensure the security and compliance of system operations.

[0041] Optionally, log in to the system via a computer or mobile client to transfer user permissions.

[0042] In a third aspect, the present application provides a device comprising a memory and a processor, the memory being used to store instructions or codes, and the processor being used to execute the instructions or codes so that the device executes the user authority transfer method introduced in any implementation of the aforementioned second aspect.

[0043] In a fourth aspect, the present application provides a computer-readable storage medium, in which a code is stored. When the code is executed, the device executing the code implements the user authority transfer method introduced in any implementation manner of the aforementioned second aspect.

[0044] The present application provides a user rights transfer system. The system includes a sub-authorization scope maintenance module, a new sub-authorization module, a sub-authorization deletion module, a sub-authorization revocation module, and a sub-authorization history query statistics module. The sub-authorization scope maintenance module is used to set and maintain user roles and authority scopes that can be sub-authorized. The new sub-authorization module is used to temporarily sub-authorize the authority of a first role user to other qualified users in an immediate or planned manner, and the receiving user performs the duties of the first role user on behalf of the first role user. The sub-authorization deletion module is used to delete the existing sub-authorization relationship before the sub-authorization plan takes effect. The sub-authorization revocation module is used to revoke the sub-authorization. The sub-authorization history query statistics module is used to record and query the historical records of sub-authorization operations and provide statistical analysis functions.

[0045] The user rights transfer system provided by this application has the following beneficial effects: Improve management efficiency and flexibility: Through the delegating scope maintenance module, the system can clearly set which user roles and their rights scopes can be delegated, which greatly improves the flexibility and pertinence of rights management. The newly added delegating module supports two modes: immediate effect or planned effect, making the temporary transfer of rights more convenient and adapting to emergency or planned needs in different scenarios, thereby improving overall management efficiency.

[0046] Enhanced business continuity: In certain circumstances, such as when the primary role user is unable to perform their duties for some reason, the newly added delegating module can quickly transfer permissions to qualified users to ensure business continuity and stability. This flexible permission transfer mechanism helps avoid business interruptions caused by personnel changes or emergencies.

[0047] Optimize the security of permission management: The deleting sub-authorization module allows you to delete the existing sub-authorization relationship before the sub-authorization plan takes effect, which provides additional security for user permission management. At the same time, the revoking sub-authorization module can revoke the effective sub-authorization, ensuring the controllability and traceability of permission transfer, and further improving the security of the system.

[0048] Improve transparency and compliance: The authorization history query statistics module records the history of each authorization operation in detail and provides statistical analysis functions. This not only provides users and management with a comprehensive view of authority transfer, but also facilitates audits and compliance checks to ensure that all authority transfer operations comply with the company's policies and regulatory requirements.

[0049] To sum up, the user authority transfer system provided in this application significantly improves the efficiency, flexibility and security of authority management through the effective collaboration of its various modules, while enhancing business continuity and compliance, providing strong support for the stable operation of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of the structure of a user rights transfer system provided in an embodiment of the present application;

[0052] Figure 2 A flowchart of a method for transferring user rights provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] First, some relevant terms mentioned in this application are explained:

[0055] Commercial bank core system: An information system used within a bank to process and manage various business activities. It is responsible for handling various bank transactions, account management, risk control, customer service, etc. The bank core system usually includes multiple subsystems, such as personal customer information system, electronic banking personal customer information system, etc. The development of the bank core system has gone through a process from stand-alone system to distributed system, and from host system to open platform.

[0056] Users: are individuals or groups that directly participate in banking operations and influence the core banking system through functions. Users include natural persons such as counter managers and internal bank presidents who operate the core system in the traditional sense, as well as machines such as ATMs and POS, and other systems associated with the core system.

[0057] Transaction: Banking operations such as deposits and withdrawals, customer management, etc. handled by the counter manager within the core system, including customer transactions and internal management transactions.

[0058] Auditing skills: The ability of an internal bank president or counter manager to audit, review and examine business, including the ability to check the correctness of transaction operations, compliance with regulations, data integrity, consistency of customer information, etc.

[0059] Instant transfer of authorization: The transfer of authorization takes effect immediately. After the internal president transfers the authority, the receiving user will obtain the authority of the transferring user after signing in again.

[0060] Planned transfer of authorization: The user sets the date in the future to transfer the permissions to the receiving user. After the receiving user confirms receipt on a date between the effective date and the end date, the receiving user's permissions are changed to those of the transferring user.

[0061] Transfer-out user: The person who transfers out the authority to conduct instant transfer, transfer plan formulation or deletion operations, usually the internal manager of a bank branch.

[0062] Receiving user: The person who receives the authority to receive real-time re-authorization and revoke effective re-authorization, usually the counter manager of a bank branch.

[0063] A user rights transfer system according to an embodiment of the present application includes a sub-authorization scope maintenance module, a new sub-authorization module, a sub-authorization deletion module, a sub-authorization revocation module and a sub-authorization history query statistics module. Figure 1 As shown, Figure 1 A schematic diagram of the structure of a user rights transfer system provided in an embodiment of the present application.

[0064] The delegating scope maintenance module 110 is used to set and maintain the user roles and authority scopes that can be delegated.

[0065] Specifically, each system user is given a variety of review skills, which are determined based on factors such as the user's job requirements, professional knowledge and experience. According to the skills possessed by the user, a detailed user characteristic model is established. These models not only reflect the user's skill level, but also provide a scientific basis for the subsequent allocation of permissions. Based on the user characteristic model, a sub-authorization scope control table is automatically generated. This table lists in detail which second-role users (such as counter managers) the first-role user (such as the internal president) can subauthorize. The selection criteria for the second-role user are: their skills must cover the skills of the first-role user, but the role level must be lower than that of the first-role user. This ensures the reasonable allocation of permissions and hierarchical management. It should be noted that the personnel in the sub-authorization scope control table are not fixed, but can be dynamically adjusted according to actual conditions.

[0066] The specific maintenance process of the delegating scope includes: automatically generating a list of personnel, and automatically generating a list of personnel that meets the basic conditions for delegating for each business institution. These conditions include that the user cannot have the same role or the same level as the internal president, and the user cannot be added to the delegating scope during the period of receiving authority. The personnel list is maintainable, that is, the management personnel can add, delete, and modify the personnel within the delegating scope to adapt to the needs of personnel changes and business development. The control of the user's delegating scope is dynamic. The system can monitor the user status in real time. If the user is temporarily unable to perform his duties due to leave or leaving the post, the system will automatically remove him from the optional scope of delegating authority to ensure the continuity and security of the authority. At the same time, when the user returns to the post, the system can automatically restore his authority.

[0067] When the branch manager needs to handle the delegating business, the system will first determine whether the authorized counter manager is in the delegating scope control table. If the authorized counter manager is in the table, the delegating operation is successful; otherwise, the system will prompt an error and prevent the delegating operation from proceeding. Through the optimization of the above process, the delegating scope maintenance module not only improves the flexibility and efficiency of authority management, but also ensures the rationality and security of authority allocation. This provides strong support for the digital transformation and business process optimization of commercial bank branches.

[0068] The newly added delegation module 120 is a core functional module designed for commercial bank branches. It aims to flexibly delegate the authority of the first-role user (such as the internal president) to other qualified users (such as the counter manager) in two ways: immediate effect or planned effect. The receiving user will perform the duties of the first-role user on behalf of the first-role user. This module not only improves the flexibility of authority management, but also ensures the continuity and security of business processing.

[0069] The newly added sub-authorization module 120 mainly includes two sub-modules: an immediate sub-authorization sub-module and a planned sub-authorization sub-module:

[0070] Instant transfer of authorization submodule: This submodule is used to immediately transfer permissions to the designated receiving user. When the internal president needs to transfer authorization immediately, he can log in to the system, select the receiving user, and confirm the transfer information. The system will immediately take effect after the receiving user successfully performs fingerprint or face recognition authentication.

[0071] Planned Delegation Submodule: This submodule is used to preset the start and end time of delegation and automatically complete the authority transfer within the specified time period. The internal president can log in to the system and formulate a delegation plan, including selecting the receiving user and specifying the effective date of the plan. The system will automatically complete the authority transfer on the specified effective date.

[0072] In terms of system implementation, the newly added sub-authorization module 120 provides operation portals on the office computer client and mobile client, respectively, so that the internal president can carry out sub-authorization operations anytime and anywhere. The mobile terminal interacts with the core system of the internal network through encrypted transmission from the external network, ensuring the security and reliability of data transmission. After the internal president logs into the system, the system controls and only displays the user information of the business institution that meets the "sub-authorized user qualifications" for the internal president to choose. This ensures that the receiving user has the ability and qualifications to perform the duties of the first role user.

[0073] After the internal president selects the receiving user, if he chooses to take effect immediately, the system defaults to the current date. Both the transferring user and the receiving user must undergo fingerprint or face recognition authentication to ensure the authenticity and security of the operation. After successful authentication, the transfer takes effect immediately. After the internal president selects the receiving user, if he chooses to choose a planned effectiveness method, he must specify the planned effective date (which must be greater than the current date). The transferring user logs in to the system to formulate a transfer plan and submits it to the system backend to generate a transfer plan that includes the receiving user and the planned effective date. When the specified effective date arrives, the transfer plan automatically takes effect. After the transfer takes effect, the status of the transferring internal president changes to being replaced, and he cannot handle any business except being able to sign out of the system. The user level of the authorized user is temporarily changed to the same role and level as the user transferring the authority, so that he can perform the duties of the first role user on his behalf.

[0074] In summary, the newly added delegation module 120 provides a flexible and efficient authorization delegation management solution for commercial bank outlets through two modes: immediate effectiveness and planned effectiveness. This module not only improves the flexibility and security of authorization management, but also ensures the continuity and stability of business processing.

[0075] The deleting sub-authorization module 130 allows the transferor to delete the existing sub-authorization relationship before the sub-authorization plan takes effect. This function ensures the flexibility and accuracy of authority management and avoids authority confusion caused by plan changes or personnel changes. It is mainly used to handle sub-authorization plans of the plan-effective type. Before the sub-authorization plan takes effect, the transferor (such as the internal president) can select and delete the existing sub-authorization relationship to ensure timely adjustment of authority and normal business operations.

[0076] The back-office president can log in to the system to query all the sub-delegation plans that are to take effect in the institution. The system displays all sub-delegation plans that are to take effect in a list, including the plan effective date, transfer-out user, receiving user and other information. When the receiving user verbally confirms that the sub-delegation plan cannot be fulfilled, the transfer-out user (back-office president) can select the sub-delegation plan in the system for deletion. After selection, the system prompts to confirm the deletion information. After the transfer-out user confirms, the sub-delegation plan will be deleted.

[0077] For a reauthorization that takes effect immediately, the user who transfers out cannot perform the deletion operation. If you need to revoke a reauthorization that has taken effect, only the receiving user can log in to the system to revoke the user reauthorization. For a user reauthorization plan that reaches the effective date, the user who transfers out cannot delete it either. At this time, if you need to revoke the reauthorization, only the receiving user can log in to the system to revoke the user reauthorization.

[0078] The deleting sub-authorization module 130 provides a flexible and accurate authority management function for commercial bank branches, ensuring the timely adjustment of the sub-authorization plan and the normal operation of the business.

[0079] The revocation module 140 allows the revocation of an effective or ineffective reauthorization relationship under certain circumstances. This function ensures the flexibility and accuracy of authority management and provides a strong guarantee for business continuity. When the first-role user (such as the internal president) returns to work, if the effective reauthorization needs to be revoked, the receiving user (such as a temporary replacement counter manager) can log in to the system after fingerprint or face authentication to perform the revocation operation. After the revocation is successful, the original reauthorization relationship is terminated and the authority will be returned to the first-role user. For ineffective reauthorizations, including reauthorizations that are effective immediately but have not yet been executed and reauthorizations that have reached the effective date but have not yet taken effect, the transferring user (such as the internal president) or the system administrator can revoke them in the system. After the revocation, the reauthorization relationship will no longer be effective, and the authority will not be transferred to the receiving user.

[0080] The de-authorization history query and statistics module 150 is used to record and query the history records of de-authorization operations and provide statistical analysis functions. This module provides a comprehensive de-authorization management view for commercial bank branches, which helps to monitor the change of permissions and ensure business compliance. The system automatically records the history records of each de-authorization operation, including key information such as the transfer-out user, the receiving user, the de-authorization type (immediate or planned to take effect), the effective date, and the revocation date (if any). Users can use the query function provided by the system to quickly retrieve relevant de-authorization records based on conditions such as the transfer-out user, the receiving user, the de-authorization type, and the time range. The system also provides a statistical analysis function, which can perform multi-dimensional analysis on the de-authorization records, such as distribution by time, distribution by user, distribution by de-authorization type, etc., and display the analysis results in the form of charts. This helps users understand the overall situation of de-authorization operations and find potential problems and improvement points.

[0081] In one implementation of the embodiment of the present application, a security authentication module is added to the system. The core responsibility of this module is to implement identity authentication and permission verification for the user's login, operation and other behaviors, thereby ensuring the security and compliance of the system operation. This addition not only improves the overall security of the system, but also provides users with a more reliable operating environment. When a user logs into the system, the security authentication module will require the user to enter specified identity authentication information (such as user name, password, etc.), and may combine other verification methods (such as SMS verification code, email verification code, etc.) to further confirm the user's identity. For high-risk operations (such as transfer, receipt, revocation, etc. related to reauthorization), the system will additionally require the user to perform biometric authentication (such as fingerprint or face recognition) to ensure the authenticity and security of the operation.

[0082] The security authentication module will perform real-time verification of the user's operations within the system based on the user's role and permissions. If a user attempts to perform an operation beyond their permissions, the system will immediately block it and give a corresponding error prompt.

[0083] In the transfer, receiving, and revocation operations related to delegating authorization, the system uses biometric authentication methods such as fingerprints or faces. This measure not only significantly improves the security of operations, but also effectively prevents the abuse of permissions caused by password leakage or theft. When initiating delegating authorization, the transferring user needs to authenticate through fingerprint or face recognition to ensure the legality and authenticity of the delegating operation. When accepting delegating authorization, the receiving user also needs to confirm his or her identity through biometric authentication to ensure the accuracy and security of the delegating authorization. When revoking delegating authorization, both the transferring user and the receiving user need to verify their operating permissions through biometric authentication to prevent unauthorized revocation.

[0084] By adding a security authentication module and widely using biometric authentication methods, the system has achieved significant improvements in security as follows:

[0085] Prevent identity theft: Biometric authentication is highly unique and non-replicable, effectively preventing identity theft caused by password leakage or theft.

[0086] Improve operational security: For high-risk operations, the system requires users to perform biometric authentication, thereby ensuring the authenticity and security of the operation.

[0087] Enhanced compliance: Through strict identity authentication and permission verification, the system can ensure that user operations comply with relevant regulations and processes, thereby enhancing compliance.

[0088] In summary, the addition of security authentication modules and the widespread use of biometric authentication methods provide a more reliable security guarantee for the system, ensuring the safety and compliance of user operations.

[0089] In a specific implementation of the embodiment of the present application, the system supports the transfer of user rights through a computer or mobile client. This design is intended to provide a flexible and convenient operation method to meet the needs of different users in different scenarios.

[0090] The computer system provides complete permission transfer functions, including the initiation, receipt, and revocation of authorization. Users can easily transfer and manage permissions through the computer system.

[0091] Operation method: After the user logs in to the computer system, enter the permission management module.

[0092] In the authority management module, users can initiate a re-authorization request, select a receiving user, and set the effective time and scope of the re-authorization. After the receiving user logs into the system, he or she can receive the re-authorization request and confirm or reject it.

[0093] If the transfer authorization needs to be revoked, both the transferring user and the receiving user can perform the revocation operation in the system.

[0094] The mobile client system also provides a comprehensive permission transfer function, which allows users to manage permissions at any time on mobile devices such as mobile phones. The mobile client system also provides a message push function to promptly notify users of relevant information about permission transfer.

[0095] After the user downloads and installs the mobile client, he / she logs in. In the mobile client, the user can enter the permission transfer module to initiate a reauthorization request or view received reauthorization requests. The user can complete the transfer and management of permissions through simple operations such as sliding the screen and clicking buttons. The system will promptly notify the user of status changes such as permission transfer requests, confirmations, and revocations through the message push function.

[0096] Since the system supports permission transfer via computer or mobile client, users can choose the appropriate operation method according to their needs. The mobile client system provides permission management function anytime and anywhere, which is convenient for users to transfer and manage permissions at any time. The system promptly notifies users of relevant information about permission transfer through the message push function, ensuring that users can understand the status changes of permission transfer in a timely manner.

[0097] In summary, the system in the embodiment of the present application realizes the user's authority transfer through the computer terminal or mobile client, provides a flexible and convenient operation method, and ensures the security and accuracy of the authority transfer. This design helps to improve the business efficiency and management level of commercial bank outlets.

[0098] The above describes a user rights transfer system provided in an embodiment of the present application. The following describes a method for transferring user rights through the user rights transfer system through another embodiment. Figure 2 A flowchart of a method for transferring user rights provided in an embodiment of the present application.

[0099] The present application provides a user rights transfer method, which performs user rights transfer through the user rights transfer system introduced in any implementation of the first aspect, the system comprising a subauthorization range maintenance module, a subauthorization addition module, a subauthorization deletion module, a subauthorization revocation module and a subauthorization history query statistics module, the method comprising:

[0100] S201. The user generates an immediate-effective plan or a planned-effective plan by adding a new subauthorization.

[0101] S202. Temporarily delegate the authority of the first role user to other qualified system users through the user role and authority scope pre-set by the delegation scope maintenance module, and let the receiving user perform the duties of the first role user on behalf of the first role user.

[0102] The implementation process of the above method can refer to the implementation process in the aforementioned embodiment, which will not be repeated here.

[0103] In one implementation of the embodiment of the present application, setting and maintaining the user role and permission scope that can be delegated through the delegation scope maintenance module includes:

[0104] Setting review skills for each user role, and establishing a feature model for each user role based on the review skills;

[0105] A delegating scope control table is generated according to the feature model, wherein the delegating scope control table includes a second role user corresponding to the first role user; the second role user is the receiving user; the skills of the second role user cover the skills of the first role user, but the role level is lower than that of the first role user, and the personnel in the delegating scope control table are not fixed.

[0106] In one implementation of the embodiment of the present application, the newly added sub-authorization module includes:

[0107] The instant transfer authorization submodule is used to immediately transfer permissions to the designated receiving user;

[0108] The planned delegation submodule is used to preset the start and end time of delegation and automatically complete the transfer of authority within the specified time period.

[0109] In an implementation of the embodiment of the present application, the deleting sub-authorization module deletes the existing sub-authorization relationship before the sub-authorization plan takes effect, including:

[0110] For planned sublicensing plans, delete the existing sublicensing relationship before the sublicensing plan takes effect.

[0111] In an implementation of the embodiment of the present application, the revoking sub-authorization module revokes the sub-authorization including:

[0112] For the effective sub-authorization, when the first role user returns to work, the effective sub-authorization is revoked and the authority is returned to the first role user;

[0113] The uneffective sub-authorization is revoked, and the uneffective sub-authorization includes the immediately effective sub-authorization and the sub-authorization that has reached the effective date.

[0114] In one implementation of the embodiment of the present application, the method further includes: performing identity authentication and permission verification on the user's login, operation and other behaviors through a security authentication module to ensure the security and compliance of system operations.

[0115] In one implementation of the embodiment of the present application, the system is logged in through a computer or a mobile client to achieve user authority transfer.

[0116] The following example illustrates the implementation process of the user rights transfer method in this application:

[0117] The application scenario of this application is that due to business needs, the internal president (first role user) of a commercial bank branch needs to temporarily leave his post, but his duties need to be performed by other qualified system users (receiving users, i.e. second role users). For this reason, the branch decided to use the user authority transfer system to achieve temporary transfer of authority.

[0118] First set up and maintain the delegation scope:

[0119] The system administrator first sets review skills for each user role through the delegation scope maintenance module, such as counter manager, lobby manager, etc. These skills reflect the responsibilities and capabilities of each role.

[0120] Based on these skills, the system generates a feature model for each user role, and generates a delegating scope control table based on this. This table lists which first-role users (such as the internal president) can delegate their permissions to which second-role users (such as the counter manager, lobby manager, etc.). It is worth noting that the skills of the second-role user should cover the skills of the first-role user, but the role level is usually lower than that of the first-role user. In addition, the personnel in the delegating scope control table are not fixed and can be adjusted according to actual conditions.

[0121] The back-office president (first role user) initiates a delegating request through the newly added delegating module. He can choose the immediate delegating submodule to immediately transfer the authority to the designated receiving user (such as the counter manager), or choose the planned delegating submodule to preset the start and end time of the delegating and automatically complete the authority transfer within the specified time period. In this example, the back-office president selected the planned delegating submodule, set the start and end time of the delegating, and selected the counter manager as the receiving user.

[0122] Remove sublicense (if necessary):

[0123] If the internal president decides to cancel the delegation before the delegation plan takes effect, he can delete the existing delegation relationship through the Delete Delegation module. In this case, the delegation plan takes effect as planned, so the deletion operation is not performed.

[0124] When the back-office president returns to work, he uses the delegating revocation module to revoke the delegation in effect and return the authority to himself. If the delegation plan has not yet taken effect (such as a delegation that takes effect immediately but has not yet been executed, or a delegation that has reached the effective date but has not yet taken effect), it can also be revoked. In this example, after returning to work, the back-office president immediately revoked the authority previously delegated to the counter manager.

[0125] Throughout the entire process, whether logging into the system, initiating a transfer authorization request, or revoking a transfer authorization, users need to authenticate their identities and verify their permissions through the security authentication module. This ensures the security and compliance of system operations. In this example, the internal bank president and the counter manager performed biometric authentication of fingerprints or faces when logging into the system and performing related operations. Users can log in to the system through a computer or mobile client to transfer and manage permissions. In this example, both the internal bank president and the counter manager chose to log in to the system through a computer.

[0126] The system records and queries the history of authorization transfer operations through the statistical analysis function of the authorization history query statistics module. This helps users understand the transfer of authority and conduct compliance checks and audits. In this example, the system records the transfer process of authority from the internal president to the counter manager, as well as the subsequent revocation operation.

[0127] Through the above steps, the commercial bank branch successfully realized the temporary transfer and revocation of the internal president's authority, ensuring business continuity and compliance. At the same time, the system's security authentication module and transfer authorization history query statistics module also provide strong protection and support for authority management.

[0128] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0129] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.

[0130] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.

[0131] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0132] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0133] It should also be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A user rights transfer system, characterized in that: The system includes: a sub-authorization scope maintenance module, a new sub-authorization module, a sub-authorization deletion module, a sub-authorization revocation module and a sub-authorization history query statistics module; The sub-authorization scope maintenance module is used to set and maintain the user roles and authority scopes that can be sub-authorized; The newly added sub-authorization module is used to temporarily sub-authorize the permissions of the first role user to other qualified users in an immediate or planned manner, so that the receiving user can perform the duties of the first role user on behalf of the first role user; The deleting sub-authorization module is used to delete the existing sub-authorization relationship before the sub-authorization plan takes effect; The revoking sub-authorization module is used to revoke sub-authorization; The de-authorization history query statistics module is used to record and query the historical records of de-authorization operations and provide a statistical analysis function.

2. The system according to claim 1, characterized in that The delegation scope maintenance module is used to set and maintain the user roles and authority scopes that can be delegated, including: Setting review skills for each user role, and establishing a feature model for each user role based on the review skills; A delegating scope control table is generated according to the feature model, wherein the delegating scope control table includes a second role user corresponding to the first role user; the second role user is the receiving user; the skills of the second role user cover the skills of the first role user, but the role level is lower than that of the first role user, and the personnel in the delegating scope control table are not fixed.

3. The system according to claim 1, characterized in that The newly added sub-authorization module includes: The instant transfer authorization submodule is used to immediately transfer permissions to the designated receiving user; The planned delegation submodule is used to preset the start and end time of delegation and automatically complete the transfer of authority within the specified time period.

4. The system according to claim 1, characterized in that The deleting sub-authorization module deletes the existing sub-authorization relationship before the sub-authorization plan takes effect, including: For planned sublicensing plans, delete the existing sublicensing relationship before the sublicensing plan takes effect.

5. The system according to claim 1, characterized in that The revoking sub-authorization module revokes the sub-authorization including: For the effective sub-authorization, when the first role user returns to work, the effective sub-authorization is revoked and the authority is returned to the first role user; The uneffective sub-authorization is revoked, and the uneffective sub-authorization includes the immediately effective sub-authorization and the sub-authorization that has reached the effective date.

6. The system according to claim 1, characterized in that The system further comprises: The security authentication module is used to authenticate and verify the user's login, operation and other behaviors to ensure the security and compliance of system operations.

7. The system according to any one of claims 1 to 6, characterized in that: The system realizes the user's authority transfer through a computer or mobile client.

8. A method for transferring user rights, characterized in that: The user rights transfer is performed by using the user rights transfer system described in any one of claims 1 to 6, and the method comprises: The user generates an immediate effective plan or a planned effective plan by adding a new delegating authorization. Through the user role and authority scope pre-set by the delegating authorization scope maintenance module, the authority of the first role user is temporarily delegated to other qualified system users, and the receiving user performs the duties of the first role user on behalf of the user.

9. A computing device, characterized in that The computing device includes: a memory and a processor; The memory is used to store computer programs; The processor is configured to implement the method according to claim 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to claim 8 is implemented.

Images