Authority management method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an authority management method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: in response to a personnel change message for a target user, extracting user personnel information corresponding to the target user; determining a target permission scheme from the permission scheme set based on the user personnel information; determining a change permission role corresponding to the target user based on the scheme type and the scheme role of the target permission scheme; determining a permission data range corresponding to the target user based on the user personnel information and permission range definition parameters corresponding to the change permission role; and determining a user permission corresponding to the target user based on the change permission role and the permission data range. By adopting the method, the authority management efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a rights management method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Permission management generally refers to ensuring that users can access only the resources they are authorized to access, based on the security rules or policies set by the system. Currently, permission management is typically based on RBAC (Role-Based Access Control). RBAC establishes a set of roles between user sets and permissions. Each role corresponds to a set of permissions. Once a user is assigned a role, they gain access to all operations permitted by that role.

[0003] However, existing permission management solutions require manual permission adjustment in scenarios where personnel are appointed, dismissed, or deployed, resulting in low permission management efficiency. Summary of the Invention

[0004] Based on this, it is necessary to provide a rights management method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency of rights management in order to address the above technical problems.

[0005] In a first aspect, the present application provides a rights management method, comprising:

[0006] In response to a personnel change message for a target user, extracting user personnel information corresponding to the target user;

[0007] Based on the user's personnel information, determine the target permission scheme from the permission scheme set;

[0008] Based on the target permission scheme type and scheme role, determine the change permission role corresponding to the target user;

[0009] Determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0010] Determine the user permissions corresponding to the target user based on the changed permission role and permission data range.

[0011] In a second aspect, the present application further provides a rights management device, comprising:

[0012] An information extraction module, configured to extract user personnel information corresponding to a target user in response to a personnel change message for the target user;

[0013] A scheme determination module is used to determine a target permission scheme from the permission scheme set based on user personnel information;

[0014] The role determination module is used to determine the change permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme;

[0015] The data range determination module is used to determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0016] The permission determination module is used to determine the user permissions corresponding to the target user based on the changed permission role and permission data range.

[0017] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0018] In response to a personnel change message for a target user, extracting user personnel information corresponding to the target user;

[0019] Based on the user's personnel information, determine the target permission scheme from the permission scheme set;

[0020] Based on the target permission scheme type and scheme role, determine the change permission role corresponding to the target user;

[0021] Determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0022] Determine the user permissions corresponding to the target user based on the changed permission role and permission data range.

[0023] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0024] In response to a personnel change message for a target user, extracting user personnel information corresponding to the target user;

[0025] Based on the user's personnel information, determine the target permission scheme from the permission scheme set;

[0026] Based on the target permission scheme type and scheme role, determine the change permission role corresponding to the target user;

[0027] Determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0028] Determine the user permissions corresponding to the target user based on the changed permission role and permission data range.

[0029] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0030] In response to a personnel change message for a target user, extracting user personnel information corresponding to the target user;

[0031] Based on the user's personnel information, determine the target permission scheme from the permission scheme set;

[0032] Based on the target permission scheme type and scheme role, determine the change permission role corresponding to the target user;

[0033] Determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0034] Determine the user permissions corresponding to the target user based on the changed permission role and permission data range.

[0035] The above-mentioned permission management method, device, computer equipment, computer-readable storage medium and computer program product determine the target permission scheme from the permission scheme set according to the user personnel information of the target user, and can quickly locate the target permission scheme that meets the user personnel information; determine the target user's change permission role according to the scheme type and scheme role of the target permission scheme, and can identify the target user's permission change through the change permission role; determine the permission data range corresponding to the target user according to the user personnel information and the permission range definition parameters of the change permission role, and can automatically determine the target user's change permission role and permission data range according to the personnel information, and determine the target user's user permissions according to the change permission role and permission data range, thereby realizing automatic management of user permissions, thereby improving the user's permission management efficiency; further, by determining the permission data range corresponding to the target user according to the permission range definition parameters corresponding to the permission change role after determining the permission change role, customized data ranges for different users are realized, reflecting permission flexibility, thereby realizing refined control of the data range of user permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 A diagram of an application environment of a rights management method in one embodiment;

[0038] Figure 2 1 is a flowchart of a rights management method according to an embodiment;

[0039] Figure 3 A schematic diagram of a solution matching algorithm in one embodiment;

[0040] Figure 4 A schematic diagram of a permission processing flow in one embodiment;

[0041] Figure 5 Schematic diagram of permission data range in one embodiment;

[0042] Figure 6 is a schematic diagram of a permission filter in one embodiment;

[0043] Figure 7 A schematic diagram of a process flow for dynamic permission processing in one embodiment;

[0044] Figure 8 A schematic diagram of a dynamic permission model in one embodiment;

[0045] Figure 9 is a structural block diagram of a rights management device in one embodiment;

[0046] Figure 10 An internal structure diagram of a computer device in one embodiment

[0047] Figure 11 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] The rights management method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system can be integrated on server 104, or placed on a cloud or other network server. In one embodiment, server 104 extracts user personnel information corresponding to the target user in response to terminal 102's personnel change message for the target user; server 104 determines a target permission scheme from a set of permission schemes based on the user personnel information; server 104 determines the changed permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme; server 104 determines the permission data range corresponding to the target user based on the user personnel information and the permission range definition parameters corresponding to the changed permission role; server 104 determines the user permissions corresponding to the target user based on the changed permission role and the permission data range. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablet computers, etc. Server 104 can be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0050] In one embodiment, Figure 2 As shown, a rights management method is provided. This embodiment applies the method to Figure 1 The server is used as an example. It is understood that the method can also be applied to a terminal, or a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0051] Step 202: In response to the personnel change message for the target user, extract the user personnel information corresponding to the target user.

[0052] Step 204: Determine a target permission scheme from the permission scheme set based on the user's personnel information.

[0053] The target user is the person for whom permissions management is to be performed, and can be a company employee, for example. Personnel change information is notification information indicating a personnel change to a user, such as a user's position appointment, dismissal, transfer, or business adjustment. User personnel information refers to the user's location within the company, including personnel characteristics such as the user's position, business responsibilities, and employment relationship. A permission scheme set is a collection of user permission handling methods. The target permission scheme is the permission scheme that matches the target user's user personnel information.

[0054] Specifically, the server receives personnel change information for the target user, such as the target user's position appointment, position transfer, business adjustment, etc., and extracts the user personnel information corresponding to the target user from the personnel change information, which can be the extracted personnel characteristics of the target user after the personnel change has occurred.

[0055] The server then obtains the permission scheme set, which includes various pre-set permission schemes, and each permission scheme includes corresponding permission configuration parameters. The permission configuration parameters are used to verify whether the user's personnel information complies with the verification rules of the permission scheme, which can be understood as the personnel requirements that the user's personnel information must comply with in the permission scheme, such as the verification rules for positions: Position ≥ Position A, etc. After obtaining each permission scheme, the server matches the user's personnel information with the permission configuration parameters in each permission scheme to obtain the matching results corresponding to each permission scheme. The permission scheme conditions of each permission scheme are then obtained. The permission scheme conditions are the judgment conditions for judging whether permission processing should be performed in accordance with the corresponding permission scheme based on the matching results of the permission scheme. The permission scheme whose matching results meet the permission scheme conditions is used as the target permission scheme, and the target user can be processed for permissions according to the target permission scheme.

[0056] In one embodiment, each permission scheme also includes a corresponding scheme type, and permission scheme conditions corresponding to the scheme type are pre-set. Different scheme types correspond to different permission scheme conditions. After obtaining the matching results corresponding to each permission scheme, the server obtains the permission scheme conditions corresponding to the scheme type to which each permission scheme belongs. Based on the scheme type of the permission scheme to which the matching results belong, the server uses the permission scheme whose matching results meet the permission scheme conditions of the scheme type as the target permission scheme corresponding to the scheme type.

[0057] Step 206 : Determine the change permission role corresponding to the target user based on the solution type and solution role of the target permission solution.

[0058] A schema role refers to a permission role that can be assigned to a user in a permission schema. That is, if a user's personnel information matches the permission schema, the permission role in the permission schema will be assigned to the user. A permission role is a collection of users with corresponding permission operations and permission resources, represented by a custom identifier or number. Permission operations refer to the actions a user can perform on permission resources, such as viewing, modifying, and creating. Permission resources refer to the specific resources associated with the permission role, such as various functions, data, files, and devices. For example, permission role A1 has permission operations and permission resources that allow it to view the sales list of its assigned department; permission role A2 has permission operations and permission resources that allow it to view the sales lists of its assigned department and subordinate departments. A permission schema can include multiple permission roles. For example, permission schema 1 includes permission roles B1 and B2. Permission role B1 has permission operations and permission resources that allow it to view the employee details of its assigned department, while permission role B2 has permission operations and permission resources that allow it to modify the employee details of its assigned department. Therefore, users who match permission schema 1 have permission to view and modify the employee details of their assigned department. Changing permission roles are permission roles with operational attributes, such as assign and cancel. Changing permission roles include roles to be assigned and roles to be canceled. A role to be assigned is a permission role that is yet to be assigned to a user, while a role to be canceled is a permission role that is yet to be canceled.

[0059] Specifically, the scheme types corresponding to the permission scheme include permission allocation types and permission cancellation types, then the permission scheme of the permission allocation type is used as the permission allocation scheme, and the permission scheme of the permission cancellation type is used as the permission cancellation scheme. When the server identifies that the target permission scheme is a permission allocation scheme based on the scheme type of the target permission scheme, it generates roles to be assigned based on the scheme roles in the target permission scheme, and obtains the change permission role corresponding to the target user, which can mean that the scheme roles in the target permission scheme are assigned to the target user based on the roles to be assigned, so that the target user has the permission operations and permission resources corresponding to the scheme roles in the target permission scheme. When the server identifies that the target permission scheme is a permission cancellation scheme based on the scheme type of the target permission scheme, it generates roles to be canceled based on the scheme roles in the target permission scheme, and obtains the change permission role corresponding to the target user, that is, cancels the permission operations and permission resources corresponding to the scheme roles in the target permission scheme from the existing permission roles of the target user based on the roles to be canceled.

[0060] Step 208 : Determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role.

[0061] The permission scope definition parameter is used to define the descriptive parameters of the permission data scope, such as the department in which the user works, the position in which the user works, etc. The permission data scope refers to the specific data scope that the target user can access, such as department A, department A and its subordinate department B, etc.

[0062] Specifically, the permission scheme also includes permission scope definition parameters corresponding to the scheme role. After determining the target user's corresponding permission role, the server uses the permission scope definition parameters corresponding to the scheme role in the target permission scheme as the permission scope definition parameters corresponding to the permission role. The server determines the characteristic values ​​corresponding to the permission scope definition parameters based on the personnel characteristics of the user's personnel information, and generates the permission data range corresponding to the target user based on the permission scope definition parameters and the corresponding characteristic values.

[0063] Step 210 : Determine the user rights corresponding to the target user based on the changed permission role and permission data range.

[0064] Specifically, the server performs corresponding operations on the permission role and permission data range of the target user based on the operation attributes corresponding to the changed permission role. For example, according to the allocation attributes of the role to be assigned, the scheme role and permission data range in the target permission scheme are assigned to the target user; according to the cancellation attributes of the role to be canceled, the scheme role and permission data range in the target permission scheme are canceled for the target user's existing permission role, and the user permissions corresponding to the target user are obtained according to the operation results.

[0065] In the above-mentioned permission management method, by determining the target permission scheme from the permission scheme set according to the user personnel information of the target user, the target permission scheme that meets the user personnel information can be quickly located; the target user's change permission role is determined according to the scheme type and scheme role of the target permission scheme, and the permission change of the target user can be identified through the change permission role; the permission data range corresponding to the target user is determined according to the user personnel information and the permission range definition parameters of the change permission role, and the target user's change permission role and permission data range can be automatically determined according to the personnel information, and the user permissions of the target user can be determined according to the change permission role and permission data range, thereby realizing automatic management of user permissions, thereby improving the user's permission management efficiency; further, by determining the permission data range corresponding to the target user according to the permission range definition parameters corresponding to the permission change role after determining the permission change role, customized data ranges for different users are realized, reflecting permission flexibility, thereby realizing refined control of the data range of user permissions.

[0066] In one embodiment, step 204, based on the user's personnel information, determining a target permission scheme from a set of permission schemes includes:

[0067] Determine the permission scenario based on the change type of the personnel change message, and obtain the permission schemes corresponding to the permission scenario as a permission scheme set; the permission scheme set includes each permission scheme corresponding to at least one scheme type;

[0068] Based on the user's personnel information, the target permission scheme corresponding to each scheme type is determined from the permission scheme set.

[0069] The change type refers to the type of personnel change for the user. A permission scenario is a pre-set permission operation scenario corresponding to the change type, such as the onboarding authorization scenario or the regularization authorization scenario. A scenario permission scheme is a pre-set permission scheme associated with a permission scenario.

[0070] Specifically, the server identifies the change type of personnel change information and determines the corresponding permission scenario based on the change type. For example, if the personnel change information is information about the target user confirming their employment, and its change type is employment confirmation, then the permission scenario corresponding to the change type is the employment scenario. The server obtains the associated permission schemes for each scenario based on the permission scenario, and uses each scenario permission scheme as a permission scheme set. The permission scheme set includes each permission scheme corresponding to at least one scheme type. For example, the scheme type of each permission scheme corresponding to the employment scenario includes a permission allocation type, the scheme type of each permission scheme corresponding to the resignation scenario includes a permission cancellation type, and the scheme type of each permission scheme corresponding to the transfer scenario includes a permission cancellation scheme and a permission allocation scheme, etc.

[0071] The server matches the user's personnel information with the permission configuration parameters of each permission scheme in the permission scheme set, and obtains matching results corresponding to each permission scheme. Since the permission scheme set includes each permission scheme corresponding to at least one scheme type, it can be a matching result of each permission scheme corresponding to at least one scheme type in the permission scheme set. The server obtains the permission scheme conditions corresponding to at least one scheme type, and then, based on the scheme type of the permission scheme to which the matching result belongs, uses the permission scheme whose matching result meets the permission scheme conditions of the scheme type as the target permission scheme corresponding to the scheme type. When there are multiple permission schemes of different scheme types in the permission scheme set corresponding to the permission scenario, the target permission schemes corresponding to each scheme type are obtained based on the permission scheme conditions and matching results of each scheme type.

[0072] In this embodiment, the permission scenario is determined according to the change type, and the permission scheme set corresponding to the permission scenario is obtained. By matching the user personnel information with the corresponding permission scheme set, and determining the corresponding target permission scheme according to the scheme type of the permission scheme, detailed management of the permission scheme is achieved and the matching accuracy of the permission scheme is improved.

[0073] In one embodiment, based on the user's personnel information, the target permission scheme corresponding to each scheme type is determined from the permission scheme set, including:

[0074] From the permission schemes of the permission allocation type included in the permission scheme set, the permission scheme that matches the user's personnel information is used as the target permission scheme corresponding to the permission allocation type;

[0075] From the various permission schemes of the permission revocation type included in the permission scheme set, the permission scheme that does not match the user's personnel information is used as the target permission scheme corresponding to the permission revocation type.

[0076] The permission allocation type refers to the permission processing type for allocating permissions to users, and the permission cancellation type refers to the permission processing type for canceling existing permissions of users.

[0077] Specifically, permission scheme conditions corresponding to each scheme type are set. For example, if the permission scheme corresponding to the permission allocation type is the permission allocation scheme, then the permission scheme condition corresponding to the permission allocation type is: the user's personnel information completely matches the permission configuration parameters in the permission allocation scheme. If the permission cancellation type corresponds to the permission cancellation scheme, then the permission scheme condition corresponding to the permission cancellation type is: the user's personnel information does not completely match the permission configuration parameters in the permission allocation scheme, that is, there are mismatched permission configuration parameters.

[0078] The server matches the user's personnel information with the permission configuration parameters of each permission scheme in the permission scheme set, and obtains the matching results of each permission scheme. For each permission scheme corresponding to the permission allocation type, if there is a situation where the user's personnel information completely matches the permission configuration parameters of the permission scheme, the permission scheme that meets the permission scheme conditions corresponding to the permission allocation type will be used as the target permission scheme corresponding to the permission allocation type. For each permission scheme corresponding to the permission cancellation type, if there is a situation where the user's personnel information does not match the permission configuration parameters of the permission scheme, the permission scheme that meets the permission scheme conditions corresponding to the permission cancellation type will be used as the target permission scheme corresponding to the permission cancellation type.

[0079] In this embodiment, by refining the permission processing of the permission scheme according to the scheme type, the accuracy of user permission management can be improved and the data security of user permissions can be guaranteed. In one embodiment, step 204, based on the user's personnel information, determines the target permission scheme from the permission scheme set, including:

[0080] Obtain the permission scheme set, classify the permission scheme set by configuration attributes, and obtain the initial permission scheme set corresponding to each configuration attribute;

[0081] Obtain the user personnel information set corresponding to the user set, classify the user personnel information set by characteristic attributes, and obtain the initial user set corresponding to each characteristic attribute;

[0082] Match each configuration attribute with each characteristic attribute, and obtain a matching permission scheme set for the initial user set corresponding to each characteristic attribute based on the initial permission scheme set corresponding to the successfully matched configuration attribute;

[0083] Based on the matching permission scheme set corresponding to the initial user set to which the target user belongs, a target permission scheme corresponding to the target user is determined.

[0084] Among them, configuration attributes refer to the parameter values ​​of the permission configuration parameters in the permission scheme, such as Department A, Position B, etc. in the position verification rules. Feature attributes refer to the feature values ​​of personnel characteristics in the user's personnel information, such as Department C, Position D, etc. The initial permission scheme set refers to the set of permission schemes with the same configuration attributes after the permission scheme set is classified according to the configuration attributes. The matching permission scheme refers to the initial permission scheme corresponding to the configuration attributes that successfully match the feature attributes. The initial user set refers to the set of users with the same feature attributes after the permission scheme set is classified according to the feature attributes.

[0085] Specifically, when the server performs permission processing on the user set and determines the target permission scheme corresponding to each user in the user set, it obtains a permission scheme set, which can be a collection of all pre-set permission schemes, and classifies the configuration attributes of the permission scheme set to obtain the configuration attributes corresponding to each permission scheme. The permission schemes with the same configuration attribute are merged to obtain the initial permission scheme sets corresponding to each configuration attribute, such as {Department A} = {Scheme 1, Scheme 2, Scheme 3, ...}, {Position C} = {Scheme 2, Scheme 3, Scheme 5, ...}. Then, the user personnel information set corresponding to the user set is obtained, and the characteristic attributes of the user personnel information of each user in the user set are classified to obtain the characteristic attributes corresponding to each user. Users with the same characteristic attribute are merged to obtain the initial user sets corresponding to each characteristic attribute. For example, the initial user set corresponding to the characteristic attribute {Department A, Position C} is {User 1, User 2, User 3, ...}.

[0086] The server matches each configuration attribute with each feature attribute to obtain the initial permission scheme set corresponding to each successfully matched configuration attribute. The server then intersects the initial permission scheme sets corresponding to each configuration attribute, extracting the set of identical initial permission schemes from the initial permission scheme sets corresponding to each configuration attribute, to obtain the matching permission scheme set for the initial user set corresponding to each feature attribute. For example, if the initial user set corresponding to the feature attribute {Department A, Position C} is {User 1, User 2, User 3, …}, the initial permission scheme set corresponding to the configuration attribute matching Department A is {Department A} = {Scheme 1, Scheme 2, Scheme 3, …}, and the initial permission scheme set corresponding to the configuration attribute matching Position C is {Position C} = {Scheme 2, Scheme 3, Scheme 5, …}. The matching permission scheme set corresponding to the initial user set {User 1, User 2, User 3, …} is {Scheme 2, Scheme 3}. Based on the matching permission scheme sets for each initial user set, each matching permission scheme set is used as the target permission scheme for each user in the corresponding initial user set, thereby obtaining the target permission scheme for each user in the user set.

[0087] When executing permission processing for the target user and determining the target permission scheme corresponding to the target user, the matching permission scheme set corresponding to the initial user set to which the target user belongs is determined, and each permission scheme in the matching permission scheme set is used as the target permission scheme corresponding to the target user.

[0088] In a specific embodiment, Figure 3 As shown in the figure, a schematic diagram of a solution matching algorithm is provided. The solution matching algorithm includes a matching algorithm for a single user and a large number of solutions (for example, thousands of solutions), such as Figure 3 -a, classify the user personnel information of a single user A by characteristic attributes, and obtain the various characteristic attributes of user A, such as department = A, position = C, .... Classify each permission scheme by configuration attribute, merge the permission schemes with the same configuration attribute, and obtain the initial permission scheme set corresponding to each configuration attribute, such as department = A: scheme 1, scheme 2, scheme 3, ...; match each characteristic attribute of a single user with each configuration attribute, such as Figure 3 The arrow in -a indicates a successful match. The matching result is Department = A, Position = C. The intersection of the initial permission solution set is Solution 2 and Solution 3.

[0089] The solution matching algorithm also includes a matching algorithm for a large number of users and a large number of solutions. For example, when an enterprise integrates personnel, there are 100,000 employees who need to enter the system and have more than thousands of permission solutions, such as Figure 3-b, classify the user personnel information of each user by characteristic attributes, and obtain the initial user set corresponding to each characteristic attribute, such as department = A, position = C: user 1, user 2, user 3. Classify each permission scheme by configuration attribute, merge the permission schemes with the same configuration attribute, and obtain the initial permission scheme set corresponding to each configuration attribute. Match each characteristic attribute with each configuration attribute, such as Figure 3 The arrow in -b indicates a successful match. The matching results are that users 1, 2, and 3 with department A and position C meet options 2 and 3; users 4, 5, and 6 with department A and position D meet options 1 and 4.

[0090] In this embodiment, by dividing the configuration attributes of the permission scheme and the characteristic attributes of the user set, the amount of matching data between the configuration attributes and the characteristic attributes is reduced, the efficiency of data matching is improved, and thus the efficiency of permission management is improved.

[0091] In one embodiment, the scheme type includes a permission allocation type and a permission revocation type. Step 206 determines the change permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme, including:

[0092] The scheme role in the target permission scheme corresponding to the permission allocation type is used as the role to be assigned corresponding to the target user, and the change permission role corresponding to the target user is obtained;

[0093] The scheme role in the target permission scheme corresponding to the permission cancellation type is used as the role to be canceled corresponding to the target user, and the changed permission role corresponding to the target user is obtained.

[0094] Specifically, after the server obtains the matching results of each permission scheme, according to the scheme type of each permission scheme, in each permission scheme corresponding to the permission allocation type, the permission scheme that completely matches the user's personnel information is used as the target permission scheme corresponding to the permission allocation type, that is, the matching result of the user's personnel information meets the permission scheme conditions corresponding to the permission allocation type, indicating that the user's personnel information meets the personnel requirements represented by the permission configuration parameters in the target permission scheme, and it is necessary to add a permission role for the target user. The scheme role in the target permission scheme corresponding to the permission allocation type can be used as the role to be assigned corresponding to the target user to obtain the changed permission role corresponding to the target user; in each permission scheme corresponding to the permission cancellation type, the permission scheme that does not completely match the user's personnel information is used as the target permission scheme corresponding to the permission cancellation type, that is, the matching result of the user's personnel information meets the permission scheme conditions corresponding to the cancellation allocation type, indicating that the user's personnel information no longer meets the personnel requirements represented by the permission configuration parameters in the target permission scheme, and it is necessary to cancel the target user's existing permission role. The scheme role in the target permission scheme corresponding to the permission cancellation type is used as the role to be canceled corresponding to the target user to obtain the changed permission role corresponding to the target user.

[0095] In a specific embodiment, after determining the target user's role to be assigned or to be canceled and the corresponding permission data range, the permission file corresponding to the user is obtained, and according to the operation attributes of the role to be assigned or to be canceled, the role to be assigned and the corresponding permission data range are added to the permission file corresponding to the target user, or the role to be canceled and the corresponding permission data range are deleted from the permission file corresponding to the target user, and the user permissions corresponding to the target user are obtained based on the permission file of the target user after the operation.

[0096] In a specific embodiment, Figure 4 As shown, a flowchart of permission processing is provided. The target user can be an enterprise employee. The server receives the personnel change information of the employee, which can be a personnel change event triggered by the front end, and extracts the relevant information of the employee from the personnel change message, that is, the employee's personnel information, such as the department to which he belongs, the position to which he belongs, whether he is a cadre, etc.; determines the permission scenario according to the change type of the personnel change information, obtains the permission scheme set corresponding to the permission scenario, which can be a permission scheme list, matches the employee's personnel information with the permission configuration parameters in each permission scheme, and obtains the matching results of each permission scheme; for permission schemes of the permission allocation type, if the user's personnel information matches the permission configuration parameters of the permission scheme, then the scheme role on the permission scheme is assigned to the employee; for permission schemes of the cancellation type, if the user's personnel information does not match the permission configuration parameters of the permission scheme, then the user's existing role is canceled according to the scheme role on the permission scheme.

[0097] Specifically, the permission scheme associated with the permission scenario has corresponding permission actions (i.e., permission processing operations), including pure cancellation action, assign & cancel-cancel action (indicating permission cancellation action in a permission scheme with permission assignment and permission cancellation), assignment action, assign & cancel-assignment action (indicating permission assignment action in a permission scheme with permission assignment and permission cancellation).

[0098] The pure cancellation action is used in scenarios where the administrator needs to cancel permissions after manually assigning permissions to users in advance. The specific execution process is: query the existing permission roles manually assigned to the user according to the user name, and obtain the permission cancellation plan corresponding to the permission role, match the user's current user personnel information with the permission configuration parameters in the obtained permission cancellation plan. If it matches, the user's current user personnel information has not changed, and there is no need to change the user's permissions. The query is recorded in the development log; if it does not match, the user's current user personnel information has changed and no longer meets the personnel requirements represented by the permission configuration parameters in the permission cancellation plan. It is necessary to change the user's permissions and delete the user's existing permission roles. This can be done by deleting the role list of manually added existing permission roles and the role list recorded in the permission file, and generating a permission application form. The permission application form is sent to the reviewer. After the reviewer approves it, it is added to the allocation record based on the result of the permission change. The allocation record is used to store the permission plan record of the user's historical time period permission allocation.

[0099] Assign & Cancel - Cancel action is applied to scenarios where permissions need to be canceled after the user has been automatically or manually assigned permissions according to the permission allocation plan in advance, such as the cancellation of existing permissions of the old department in the department transfer scenario. The specific execution process is: query the permission allocation plan corresponding to the user according to the allocation record, and obtain the associated permission cancellation plan based on the queried permission allocation plan. The permission configuration parameters in the permission allocation plan and the associated permission cancellation plan can be the same or different. For example, in the permission cancellation plan and permission allocation plan corresponding to the same permission role, the verification range of the permission configuration parameters in the permission cancellation plan can be greater than or equal to the verification range of the permission configuration parameters in the permission allocation plan, which means that the verification range corresponding to the permission cancellation plan is wider than the verification range corresponding to the permission allocation plan.

[0100] The user's current personnel information is matched with the permission configuration parameters in the obtained permission cancellation scheme. If they match, the user's current personnel information has not changed and no permission change is required for the user. The query is recorded in the development log. If they do not match, the user's current personnel information has changed and no longer meets the personnel requirements represented by the permission configuration parameters in the permission cancellation scheme. A permission change is required for the user. The user's role list is searched from the user's permission profile and, based on the configuration requirements, it is determined whether to delete the automatically assigned role list. If so, the role list of both manually added and automatically added existing permission roles corresponding to the user in the permission profile is deleted. If not, only the role list of automatically added existing permission roles corresponding to the user in the permission profile is deleted. A permission application form is then generated and sent to the reviewer. After approval, the reviewer adds the permission change result to the allocation record. The allocation record is used to store the permission scheme record of the user's historical time period permission allocation.

[0101] Assignment action, Assign & Unassignment action, applied to scenarios where users add new permissions (such as joining, adding new business, etc.) or reallocate permissions (such as permission assignment action to a new department in a department transfer scenario). The specific execution process is: receiving the user's personnel change message sent by the personnel business, the personnel change message can be a subscription event sent by the message system (such as joining event, transfer event, etc.), according to the user's current user personnel information, match the user personnel information with the permission configuration parameters in the permission allocation plan. If there is no match, the user's current user personnel information has not yet met the personnel requirements represented by the permission configuration parameters in the permission allocation plan, then there is no need to change the user's permissions, and the query will be recorded in the development log; if there is a match, the user's current user personnel information has met the personnel requirements represented by the permission configuration parameters in the permission allocation plan, and the role in the permission allocation plan will be matched. The color list is used as the user's pending roles. Then, according to the logic of the personnel business file, the user's permission file is obtained. For existing user permission files, a root organization file is automatically created. If the user has multiple permission files, a new permission role is assigned to each file. Then, a check is made to see if there are identical permission roles in the permission files, such as by judging whether the data fields are consistent (manually added permission roles are not considered duplicate permission roles). If not, the role corresponding to the permission allocation plan is used as the role to be assigned and assigned to the user. If so, the validity period and assignor of the same permission role in the permission allocation plan are updated according to the role list in the permission allocation plan. A permission application form is then generated and sent to the reviewer. After the reviewer approves the form, it is added to the allocation record based on the result of the permission change. The allocation record is used to store the permission plan record for the user's historical time period permission allocation.

[0102] In this embodiment, by refining the permission processing of the permission scheme according to the scheme type, the accuracy of the user permission management can be improved and the data security of the user permission can be guaranteed.

[0103] In one embodiment, step 208 determines the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role, including:

[0104] Based on the target permission scheme, obtain permission scope definition parameters corresponding to the permission role to be changed; the permission scope definition parameters include at least one permission dynamic dimension;

[0105] Based on the user's personnel information, determine the static parameter values ​​corresponding to the dynamic dimensions of each permission;

[0106] Based on the dynamic dimensions and static parameter values ​​of each permission, the permission data range corresponding to the target user is obtained.

[0107] The dynamic dimension of permissions refers to the data dimension of the permission scope definition parameters that does not specify the permission operation object, such as company affiliation or department. The static parameter value refers to the specific permission operation object corresponding to the dynamic dimension of permissions, such as Company B or Department A.

[0108] Specifically, when determining the permission role to be changed and the target permission scheme, the server uses the permission scope definition parameters corresponding to the scheme role in the target permission scheme as the permission scope definition parameters corresponding to the permission role to be changed. Based on the permission scope definition parameters, the server obtains the static parameter values ​​corresponding to each dynamic permission dimension from the user's personnel information. Based on the dynamic permission dimensions and the corresponding static parameter values, the permission data scope corresponding to the target user is generated. The permission data scope serves as the data range accessible to the target user.

[0109] In a specific embodiment, Figure 5 As shown, a schematic diagram of the permission data range is provided. The permission range definition parameters corresponding to the scheme role in the permission scheme include at least one permission dynamic dimension. The data range annotations of each permission dynamic dimension can be pre-set. The corresponding parsing class is set according to the data range annotations. The data range annotations are annotated through the parsing class and the actual permission data range is calculated. The parsing class can be understood as an algorithm for calculating the data range. Figure 5The Dynamic Data Range Configuration list in the permission dynamic dimension allows you to configure the code (used to identify the permission dynamic dimension), name (such as the department, department, and subordinate departments), usage status, applicable scope (indicating the specified data range), resolution call type (determining how the resolution class is used, such as the resolution class call method), and resolution class. Data with empty values ​​and data with non-empty values ​​indicate that a field in the permission data contains empty data. For example, users can view and modify data with empty fields, while users can only view data with non-empty fields. Data with empty values ​​and data with non-empty values ​​can be used as supplementary permission data parameters. Based on user needs, they can be combined with the permission data range of each permission dynamic dimension to generate permission data filtering conditions, which are used to filter the data required by users within the permission data range.

[0110] In this embodiment, by calculating the permission data range corresponding to the target user based on the dynamic dimension of the permission and the corresponding static parameter value, different data ranges can be configured for the same user and the same permission role, thereby improving the flexibility of permission management.

[0111] In one embodiment, the rights management method further includes:

[0112] Generate the initial permission data screening conditions corresponding to the target user based on the permission data range corresponding to the target user;

[0113] Obtain supplementary permission data parameters, and generate target permission data filtering conditions based on the supplementary permission data parameters and initial permission data filtering conditions; the target permission data filtering conditions are used to filter business data corresponding to user permissions of the target user.

[0114] The initial permission data filter condition refers to the data filter condition generated based on the permission data range and is used to filter the data required by the user within the permission data range. The supplementary permission data parameter is used to supplement the initial permission data filter condition. The target permission data filter condition refers to the final permission data filter condition.

[0115] Specifically, the server receives a data query instruction sent by the target user, queries the target user's existing permission role according to the permission file corresponding to the target user, obtains the permission data range corresponding to the permission role, and generates initial permission data screening conditions based on the target user's user personnel information and permission data range. For example, the target user of Department A sends an instruction to query employee details, and the target user's permission data range is the department where he works. Then the initial permission data screening conditions generated are: filter the employee list of Department A.

[0116] The target user's existing permission role may include a permission level. After obtaining the target user's initial permission data screening conditions, the server obtains the corresponding supplementary permission data parameters based on the permission level of the target user's existing permission role. The supplementary permission data parameters can be data status values, such as the status value of "data with an empty value" or the status value of "data with a non-empty value." Based on the preset data screening condition template, the server uses the supplementary permission data parameters and the initial permission data screening conditions to generate the target permission data screening conditions. The server then uses the target permission data screening conditions to filter within the permission data range corresponding to the target user and returns the filtered permission data to the target user's server.

[0117] In a specific embodiment, Figure 6 As shown, a schematic diagram of a permission filter is provided. The server can determine the target user's existing permission roles and permission data range based on the target user's permission profile, and then create a permission filter corresponding to the target user based on the target user's existing permission roles and permission data range, which is used to filter the data required by the user within the permission data range. Specifically, when the target user performs a data query on the target web page, relevant parameters are obtained, including the target user's user personnel information, permission profile, and web page type of the target web page; the target user's permission role list is obtained based on the target user's permission profile, and the permission role list supported by the web page type is obtained based on the web page type of the target web page; then, based on the target user's permission role list and the permission role list supported by the web page type, the target permission role list that the target user can use on the target web page is determined. Dimensional data conditions and advanced data conditions are constructed based on the target permission role list, and then role data conditions are generated based on the dimensional data conditions and advanced data conditions, and the permission filter corresponding to the target user is obtained based on the role data conditions.

[0118] Among them, constructing dimension data conditions includes: obtaining the corresponding permission scheme according to the target permission role list, calling the corresponding parsing class to obtain dynamic values ​​according to the permission dynamic dimension of the permission range definition parameter in the permission scheme, such as the code of the department in which the employee is employed; then generating initial permission data screening conditions based on the corresponding static parameter values ​​and the obtained dynamic values ​​in the user's personnel information, and then verifying the initial permission data screening conditions according to the preset historical permission change model (used to verify the permission changes of the target user) to ensure that the permissions required by the initial permission data screening conditions are consistent with the permissions possessed by the target user; then obtaining supplementary permission data parameters, that is, the status value when the data value is empty and the status value when the data value is not empty, converting them into filtering conditions according to the supplementary permission data parameters, and generating dimension data range conditions according to the initial permission data screening conditions and the filtering conditions.

[0119] Constructing advanced data rule conditions includes: obtaining the permission data range of the corresponding permission role based on the target permission role list of the target user, obtaining the logical symbols corresponding to the advanced data rules, such as "brackets", "and", "and" and other logical symbols, and using logical symbols to recombine the permission data range according to preset rules to obtain advanced data rule conditions.

[0120] In this embodiment, by constructing a permission filter according to the permission role list of the target user, the accuracy of data screening of the target user and the security of the permission data of the target user are guaranteed.

[0121] In a specific embodiment, Figure 7 As shown, a flow chart of dynamic permission processing is provided. Dynamic permission processing can be applied to the message system and the middle-office service cloud for permission processing. The middle-office service cloud is deployed with a message consumption program. When a personnel business change occurs, the message system sends a business collaboration message to the middle-office service cloud. The message consumption program matches the corresponding permission scenario and the permission scheme corresponding to the permission scenario when consuming the business collaboration message. The user's personnel information is obtained through the microservice interface, and the user's personnel information is calculated to determine whether it meets the rule conditions (i.e., permission scheme conditions) on the permission scheme. If so, the user is assigned the corresponding permission role and data range on the scheme; if not, the user's existing role is revoked.

[0122] like Figure 7 The overall process of dynamic permissions in the middle office includes the middle office service cloud receiving various business collaboration messages sent by the message system. Business collaboration messages include onboarding forms, regularization applications, transfer applications, etc. for core human resources projects, as well as cadre appointments, regularization applications, and dismissal applications for talent development projects. The middle office service cloud generates a distributed message queue based on each business collaboration message, including successful onboarding messages, successful regularization applications, and successful appointment applications. The message consumer program in the middle office service cloud then processes the message and performs dynamic authorization operations, including matching permission scenarios and permission schemes based on the message, obtaining the adaptation rules for permission configuration parameters, and obtaining the personnel attributes (i.e., characteristic attributes) of the user's personnel information from the data source. The rule parameters and personnel attributes are then matched, and the scheme role or permission role scope is determined based on the matching results. The user role processing operation is then performed, including determining whether to cancel or assign the user's permission role based on the results of the dynamic authorization operation. Specifically, the user's existing permission role, permission dynamic dimension, and corresponding dimension value (i.e., static parameter value) are searched in the user's permission profile to determine the user's dynamic data scope. Based on the allocation record, the user's permission role is assigned or canceled.

[0123] In a specific embodiment, Figure 8 As shown in the figure, a schematic diagram of a dynamic permission model is provided.

[0124] Publishing events: Abstract personnel business change events into message publishing events so that message consuming programs can receive and process business collaboration messages;

[0125] Rule parameter items: permission configuration parameters in the permission scheme required for rule comparison, such as position, department, cadre status, etc.

[0126] Rule parameter item value: The parameter value corresponding to the rule parameter item in the user's personnel information, such as position A, department B, cadre, etc.

[0127] Dynamic data source: The data source of user personnel information of the rule parameter items required for rule matching is generally the database corresponding to the microservice interface API.

[0128] Dynamic permission scenario: An abstract setting for personnel business change scenarios. One publishing event corresponds to one permission scenario.

[0129] Dynamic permission scheme: It summarizes the dynamic conditions for assigning and canceling roles and is the basic unit for processing the matching process. It includes: the permission scenarios supported by this scheme and the personnel to be processed in the permission scenarios (such as the authorized target users and the managers who need to collaborate), the list of roles to be assigned and the custom permission data range, the dynamic rule conditions for scheme comparison (i.e., permission configuration parameters), the validity period of the assignment and the assignment text (i.e., scheme annotation information). In one embodiment, when the dynamic permission scheme is used to determine the authorization processing for the authorized personnel, the corresponding management permissions can be automatically assigned to the managers who need to collaborate. For example, if it is the onboarding authorization for a new employee, the HR can be automatically assigned the corresponding management permissions for the onboarding process, such as the access and modification permissions to the employee database.

[0130] Permission application form: A document generated when conditions are met to assign or cancel a user's role, used to record the processing results.

[0131] The server receives a publishing event, determines the business object based on the publishing event, such as the target user, and determines the dynamic permission scenario and corresponding permission scheme corresponding to the publishing event. The permission actions corresponding to the permission scheme include allocation actions and cancellation actions. The user personnel information of the business object is obtained through the microservice interface API, that is, the API output parameter value, and then the rule conditions are generated according to the rule parameter items of the permission scheme, and the rule parameter item values ​​corresponding to the rule parameter items (that is, the attribute values ​​of the business object) are obtained from the user personnel information. The rule parameter item values ​​can be obtained using a preset formula. The rule parameter item values ​​of the business object are compared with the rule conditions of the permission scheme, and the permission role of the business object is determined based on the comparison results. The permission scheme is assigned to the business object or the permission role of the business object is canceled based on the permission action of the permission scheme, and a permission application record is generated in the allocation record.

[0132] In this embodiment, by determining the target permission scheme from the permission scheme set based on the user personnel information of the target user, the target permission scheme that meets the user personnel information can be quickly located; the target user's change permission role is determined based on the scheme type and scheme role of the target permission scheme, and the permission change of the target user can be identified through the change permission role; the permission data range corresponding to the target user is determined based on the user personnel information and the permission range definition parameters of the change permission role, and the target user's change permission role and permission data range can be automatically determined based on the personnel information, and the user permissions of the target user can be determined based on the change permission role and permission data range, thereby realizing automatic management of user permissions, thereby improving the user's permission management efficiency; further, by determining the permission data range corresponding to the target user based on the permission range definition parameters corresponding to the permission change role after determining the permission change role, customized data ranges for different users are realized, reflecting permission flexibility, thereby realizing refined control of the data range of user permissions.

[0133] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0134] Based on the same inventive concept, the embodiments of the present application also provide a rights management device for implementing the rights management method involved above. The implementation solution provided by the device is similar to the implementation solution described in the above method. Therefore, the specific limitations of one or more rights management device embodiments provided below can be found in the limitations of the rights management method above, and will not be repeated here.

[0135] In one embodiment, Figure 9 As shown, a rights management device 900 is provided, comprising: an information extraction module 902, a scheme determination module 904, a role determination module 906, a data range determination module 908 and a rights determination module 910, wherein:

[0136] An information extraction module 902 is configured to extract user personnel information corresponding to a target user in response to a personnel change message for the target user;

[0137] A scheme determination module 904 is used to determine a target permission scheme from the permission scheme set based on user personnel information;

[0138] The role determination module 906 is used to determine the change permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme;

[0139] The data range determination module 908 is used to determine the permission data range corresponding to the target user based on the user's personnel information and the permission range definition parameters corresponding to the change permission role;

[0140] The authority determination module 910 is used to determine the user authority corresponding to the target user based on the changed authority role and the authority data range.

[0141] In one embodiment, the scheme determination module 904 is also used to determine the permission scenario based on the change type of the personnel change message, and obtain the permission schemes of each scenario corresponding to the permission scenario as a permission scheme set; the permission scheme set includes a permission scheme corresponding to at least one scheme type; based on the user's personnel information, the target permission schemes corresponding to each scheme type are determined from the permission scheme set.

[0142] In one embodiment, the scheme determination module 904 is also used to select the permission scheme that matches the user's personnel information from the various permission schemes of the permission allocation type included in the permission scheme set as the target permission scheme corresponding to the permission allocation type; and to select the permission scheme that does not match the user's personnel information from the various permission schemes of the permission cancellation type included in the permission scheme set as the target permission scheme corresponding to the permission cancellation type.

[0143] In one embodiment, the scheme determination module 904 is also used to obtain a permission scheme set, classify the permission scheme set by configuration attributes, and obtain an initial permission scheme set corresponding to each configuration attribute; obtain a user personnel information set corresponding to the user set, classify the user personnel information set by characteristic attributes, and obtain an initial user set corresponding to each characteristic attribute; match each configuration attribute with each characteristic attribute, and obtain a matching permission scheme set for the initial user set corresponding to each characteristic attribute based on the initial permission scheme set corresponding to the successfully matched configuration attribute; and determine a target permission scheme corresponding to the target user based on the matching permission scheme set corresponding to the initial user set to which the target user belongs.

[0144] In one embodiment, the role determination module 906 is also used to use the scheme role in the target permission scheme corresponding to the permission allocation type as the role to be assigned corresponding to the target user, and obtain the changed permission role corresponding to the target user; use the scheme role in the target permission scheme corresponding to the permission cancellation type as the role to be cancelled corresponding to the target user, and obtain the changed permission role corresponding to the target user.

[0145] In one embodiment, the data range determination module 908 is also used to obtain the authority range definition parameters corresponding to the changed authority role based on the target authority scheme; the authority range definition parameters include at least one authority dynamic dimension; based on the user's personnel information, the static parameter values ​​corresponding to each authority dynamic dimension are determined; based on each authority dynamic dimension and the static parameter value, the authority data range corresponding to the target user is obtained.

[0146] In one embodiment, the permission management device 900 is also used to generate initial permission data screening conditions corresponding to the target user based on the permission data range corresponding to the target user; obtain supplementary permission data parameters, and generate target permission data screening conditions based on the supplementary permission data parameters and the initial permission data screening conditions; the target permission data screening conditions are used to screen the business data of the user permissions corresponding to the target user.

[0147] Each module in the above-mentioned rights management device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0148] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 10As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data such as user personnel information. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a permission management method is implemented.

[0149] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 10 As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless means, and the wireless means can be implemented via Wi-Fi, a mobile cellular network, near-field communication (NFC), or other technologies. When executed by the processor, the computer program implements a rights management method. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0150] Those skilled in the art will understand that Figure 10-11The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0151] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0152] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0153] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0154] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0155] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0156] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0157] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A rights management method, characterized in that: The method comprises: In response to a personnel change message for a target user, extracting user personnel information corresponding to the target user; Based on the user personnel information, determine a target permission scheme from a set of permission schemes; Determine the change permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme; Determine the permission data range corresponding to the target user based on the user personnel information and the permission range definition parameters corresponding to the change permission role; Based on the changed permission role and the permission data range, the user permission corresponding to the target user is determined.

2. The method according to claim 1, characterized in that The step of determining a target permission scheme from a permission scheme set based on the user personnel information includes: Determine the permission scenario based on the change type of the personnel change message, and obtain the permission schemes of each scenario corresponding to the permission scenario as a permission scheme set; the permission scheme set includes at least one permission scheme corresponding to the scheme type; Based on the user personnel information, target authority schemes corresponding to the respective scheme types are determined from the authority scheme set.

3. The method according to claim 2, characterized in that The determining, based on the user personnel information, target authority schemes corresponding to the respective scheme types from the authority scheme set includes: From each permission scheme of the permission allocation type included in the permission scheme set, the permission scheme matching the user personnel information is used as the target permission scheme corresponding to the permission allocation type; From the respective permission schemes of the permission revocation type included in the permission scheme set, the permission scheme that does not match the user personnel information is used as a target permission scheme corresponding to the permission revocation type.

4. The method according to claim 1, characterized in that The step of determining a target permission scheme from a permission scheme set based on the user personnel information includes: Obtain a permission scheme set, classify the permission scheme set by configuration attributes, and obtain an initial permission scheme set corresponding to each configuration attribute; Obtaining a user personnel information set corresponding to the user set, classifying the characteristic attributes of the user personnel information set, and obtaining an initial user set corresponding to each characteristic attribute; Matching each of the configuration attributes with each of the characteristic attributes, and obtaining a matching authority scheme set of an initial user set corresponding to each of the characteristic attributes based on an initial authority scheme set corresponding to the successfully matched configuration attributes; Based on the matching permission scheme set corresponding to the initial user set to which the target user belongs, a target permission scheme corresponding to the target user is determined.

5. The method according to claim 1, characterized in that The scheme types include permission allocation type and permission cancellation type; The determining, based on the scheme type and scheme role of the target permission scheme, the change permission role corresponding to the target user includes: Taking the scheme role in the target permission scheme corresponding to the permission allocation type as the to-be-allocated role corresponding to the target user, and obtaining the change permission role corresponding to the target user; The scheme role in the target permission scheme corresponding to the permission cancellation type is used as the role to be cancelled corresponding to the target user, so as to obtain the changed permission role corresponding to the target user.

6. The method according to claim 1, characterized in that The determining the permission data range corresponding to the target user based on the user personnel information and the permission range definition parameter corresponding to the change permission role includes: Based on the target permission scheme, obtaining permission range definition parameters corresponding to the change permission role; the permission range definition parameters include at least one permission dynamic dimension; Based on the user personnel information, determine the static parameter value corresponding to each dynamic dimension of the authority; Based on the respective permission dynamic dimensions and the static parameter values, the permission data range corresponding to the target user is obtained.

7. The method according to claim 1, characterized in that The method further comprises: Based on the permission data range corresponding to the target user, generating an initial permission data screening condition corresponding to the target user; Supplementary permission data parameters are obtained, and target permission data screening conditions are generated based on the supplementary permission data parameters and the initial permission data screening conditions; the target permission data screening conditions are used to screen business data corresponding to the user permissions of the target user.

8. A rights management device, characterized in that: The device comprises: An information extraction module, configured to extract user personnel information corresponding to a target user in response to a personnel change message for the target user; A scheme determination module, used to determine a target permission scheme from a permission scheme set based on the user personnel information; A role determination module, used to determine the change permission role corresponding to the target user based on the scheme type and scheme role of the target permission scheme; A data range determination module, used to determine the permission data range corresponding to the target user based on the user personnel information and the permission range definition parameters corresponding to the change permission role; The permission determination module is used to determine the user permission corresponding to the target user based on the changed permission role and the permission data range.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images