Role management method and device

Abstract

The invention relates to the technical field of cloud management platforms, and particularly provides a role management method and device, and the method comprises the following steps: S1, role definition and distribution; s2, button level authority control; s3, data level authority control; s4, an authority management engine; s5, system architecture and integration; and S6, performing security auditing and monitoring. Compared with the prior art, along with the continuous development of the government affair cloud technology, a new authority management method based on the block chain, artificial intelligence and other technologies can be further explored, so that a more intelligent and safer authority control system is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud management platforms, and specifically provides a role management method and device. Background Art

[0002] As enterprise IT architecture evolves towards the cloud, more and more companies hope to obtain the service experience brought by large-scale cloud computing in their own data centers due to their own construction requirements such as security compliance, reuse of existing data centers, and localized experience.

[0003] At the same time, by using the resource pool model, resources can be quickly provided even with little management work. As an important part of the cloud platform, the government cloud platform has an increasing demand, and more and more institutions are starting to move to the cloud.

[0004] In the government cloud scenario, with the accelerated advancement of digital transformation, departments at all levels are increasingly dependent on information systems. As an important platform for integrating IT resources and providing efficient services, the government cloud carries a large amount of sensitive data and key business applications. However, traditional permission management systems often have the following problems:

[0005] (1) Coarse granularity of permission control: Traditional permission management is mostly based on functional modules, which cannot achieve fine-grained control over specific buttons or data items on the page, and is difficult to meet security requirements in complex business scenarios.

[0006] (2) Difficulties in data sharing and isolation: In the government cloud environment, data is frequently shared among multiple departments, but how to achieve efficient sharing while ensuring data security has become a major challenge.

[0007] (3) High operation and maintenance costs: As the scale of the system expands, permission configuration and management become increasingly complex. Traditional manual management methods are not only inefficient but also prone to errors.

[0008] Therefore, it is particularly important to develop a role management method based on government cloud scenarios that supports fine-grained permission control (including button level and data level). Summary of the invention

[0009] The present invention aims at solving the above-mentioned deficiencies of the prior art and provides a role management method with strong practicability.

[0010] A further technical task of the present invention is to provide a role management device that is rationally designed, safe and applicable.

[0011] The technical solution adopted by the present invention to solve its technical problem is:

[0012] A role management method comprises the following steps:

[0013] S1. Role definition and allocation;

[0014] S2, button-level permission control;

[0015] S3, data-level permission control;

[0016] S4, rights management engine;

[0017] S5. System architecture and integration;

[0018] S6. Security audit and monitoring.

[0019] Furthermore, in step S1, it includes:

[0020] S1-1. Define multiple roles, each with a different set of permissions;

[0021] S1-2. Establish a mapping relationship between roles and users. When a user logs into the system, he or she automatically obtains the permissions of the role to which he or she belongs. Different menus are displayed through different roles to achieve menu-level control permissions.

[0022] Furthermore, in step S2, it includes:

[0023] S2-1. Uniquely identify and encode each page and each operation button on the page in the system;

[0024] S2-2. In the role configuration, corresponding button operation permissions are assigned to different roles to form a permission matrix and bind the permission button relationship;

[0025] S2-3. When a user accesses a page, the system dynamically loads the buttons that the user has permission to access based on the user's role information, thereby implementing button-level permission control.

[0026] Furthermore, in step S3, it includes:

[0027] S3-1. Design data access control strategies, including row-level data and column-level data display permission control. The row-level data is to control the permission of a single data item, and the column-level data is to control the display of column items.

[0028] S3-2. Set data access scope rules based on user roles and business needs to restrict users to only view, add, edit or delete data within their authority scope;

[0029] S3-3. Implement dynamic data filtering function based on user attributes.

[0030] Furthermore, in step S4, it includes:

[0031] S1. Develop a permission management engine to parse role configurations, generate user permission views, and perform permission verification when users perform operations or access data;

[0032] S2. The permission management engine is dynamically updated and expanded to adapt to business needs and security requirements.

[0033] Furthermore, in step S5, it includes:

[0034] S5-1. Adopt a layered architecture model, including presentation layer, business logic layer and data access layer;

[0035] S5-2, integrate the authority management engine in the business logic layer to achieve docking with the existing government cloud management system;

[0036] S5-3. The data access layer accesses various databases and storage systems.

[0037] Furthermore, in step S6, it includes:

[0038] S6-1. Establish a security audit mechanism to record user operations and permission changes, and provide a basis for security incident tracing and compliance inspection;

[0039] S6-2. Monitor the system operation status and permission usage in real time to promptly identify and handle potential security risks.

[0040] A role management device, comprising: at least one memory and at least one processor;

[0041] The at least one memory is used to store a machine-readable program;

[0042] The at least one processor is used to call the machine-readable program to execute a role management method.

[0043] Compared with the prior art, the role management method and device of the present invention have the following outstanding beneficial effects:

[0044] The present invention realizes accurate management of user operations and data through refined button-level permission control and data permission control. This method not only improves the security of the system, but also improves the user experience and the convenience of system maintenance. In the future, with the continuous development of government cloud technology, new permission management methods based on blockchain, artificial intelligence and other technologies will be further explored to realize a more intelligent and secure permission control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Attached Figure 1 It is a flowchart of a role management method. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] A best embodiment is given below:

[0049] like Figure 1 As shown, a role management method in this embodiment has the following steps:

[0050] S1. Role definition and allocation;

[0051] include:

[0052] S1-1. Define multiple roles, such as system administrator, department head, ordinary user, etc. Each role has a different set of permissions.

[0053] S1-2. Establish a mapping relationship between roles and users. When a user logs into the system, he or she automatically obtains the permissions of the role to which he or she belongs. Different menus are displayed through different roles to achieve menu-level control permissions.

[0054] S2, button-level permission control;

[0055] include:

[0056] S2-1. Uniquely identify and encode each page in the system and each operation button on the page to control buttons and permissions.

[0057] S2-2. In the role configuration, corresponding button operation permissions are assigned to different roles to form a permission matrix and bind the permission button relationship.

[0058] S2-3. When a user accesses a page, the system dynamically loads the buttons that the user has permission to access based on the user's role information, thereby implementing button-level permission control.

[0059] S3, data-level permission control;

[0060] include:

[0061] S3-1. Design data access control strategies, including row-level data and column-level data display permission control. Row-level data controls the permissions of a single piece of data, while column-level data mainly controls the display of column items.

[0062] S3-2. Set data access scope rules based on user roles and business needs to restrict users to only view, add, edit or delete data within their authority scope.

[0063] S3-3. Implement dynamic data filtering based on user attributes to ensure the reliability and security of data during transmission, storage and use.

[0064] S4, rights management engine;

[0065] include:

[0066] S4-1. Develop an efficient permission management engine to parse role configurations, generate user permission views, and perform permission verification when users perform operations or access data.

[0067] S4-2. The permission management engine supports dynamic updates and expansions to adapt to the ever-changing business needs and security requirements in the government cloud environment.

[0068] S5. System architecture and integration;

[0069] include:

[0070] S5-1. Design the system using a layered architecture model, including presentation layer, business logic layer and data access layer;

[0071] S5-2, integrate the authority management engine in the business logic layer to achieve seamless connection with the existing government cloud management system;

[0072] S5-3. The data access layer supports a variety of databases and storage systems to ensure the efficiency and security of data access.

[0073] S6. Security audit and monitoring;

[0074] include:

[0075] S6-1. Establish a security audit mechanism to record user operations and permission changes, and provide a basis for security incident tracing and compliance inspection.

[0076] S6-2. Monitor the system operation status and permission usage in real time to promptly identify and handle potential security risks.

[0077] Through the implementation of the above technical solutions, the present invention can significantly improve the security and usability of the government cloud management system, reduce operation and maintenance costs, promote data sharing and business collaboration, and provide strong support for digital transformation.

[0078] Based on the above method, a role management device in this embodiment includes: at least one memory and at least one processor;

[0079] The at least one memory is used to store a machine-readable program;

[0080] The at least one processor is used to call the machine-readable program to execute a role management method.

[0081] The above-mentioned specific implementations are only specific cases of the present invention. The patent protection scope of the present invention includes but is not limited to the above-mentioned specific implementations. Any technical solutions that conform to the above-mentioned specific implementations of the present invention and any appropriate changes or substitutions made by ordinary technicians in the relevant technical field shall fall within the patent protection scope of the present invention.

[0082] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A role management method, characterized in that: The steps are as follows: S1. Role definition and allocation; S2, button-level permission control; S3, data-level permission control; S4, rights management engine; S5. System architecture and integration; S6. Security audit and monitoring.

2. A role management method according to claim 1, characterized in that: In step S1, it includes: S1-1. Define multiple roles, each with a different set of permissions; S1-2. Establish a mapping relationship between roles and users. When a user logs into the system, he or she automatically obtains the permissions of the role to which he or she belongs. Different menus are displayed through different roles to achieve menu-level control permissions.

3. A role management method according to claim 2, characterized in that: In step S2, it includes: S2-1. Uniquely identify and encode each page and each operation button on the page in the system; S2-2. In the role configuration, corresponding button operation permissions are assigned to different roles to form a permission matrix and bind the permission button relationship; S2-3. When a user accesses a page, the system dynamically loads the buttons that the user has permission to access based on the user's role information, thereby implementing button-level permission control.

4. A role management method according to claim 3, characterized in that: In step S3, it includes: S3-1. Design data access control strategies, including row-level data and column-level data display permission control. The row-level data is to control the permission of a single data item, and the column-level data is to control the display of column items. S3-2. Set data access scope rules based on user roles and business needs to restrict users to only view, add, edit or delete data within their authority scope; S3-3. Implement dynamic data filtering function based on user attributes.

5. A role management method according to claim 4, characterized in that: In step S4, it includes: S1. Develop a permission management engine to parse role configurations, generate user permission views, and perform permission verification when users perform operations or access data; S2. The permission management engine is dynamically updated and expanded to adapt to business needs and security requirements.

6. A role management method according to claim 5, characterized in that: In step S5, it includes: S5-1. Adopt a layered architecture model, including presentation layer, business logic layer and data access layer; S5-2, integrate the authority management engine in the business logic layer to achieve docking with the existing government cloud management system; S5-3. The data access layer accesses various databases and storage systems.

7. A role management method according to claim 6, characterized in that: In step S6, it includes: S6-1. Establish a security audit mechanism to record user operations and permission changes, and provide a basis for security incident tracing and compliance inspection; S6-2. Monitor the system operation status and permission usage in real time to promptly identify and handle potential security risks.

8. A role management device, characterized in that: include: at least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 7.

Images