User permission management and control method and device, equipment, medium and program product

Abstract

The invention provides a user permission management and control method which can be applied to the technical field of information security or other technologies. The method comprises the following steps: in response to a processing request of a target user for service data of an access authority management system, acquiring authority information of the target user, and setting the authority information to be in a first state; on the basis of the permission information of the first state, performing upward recursion on a pre-constructed object tree, and determining an authorization level of the target user; based on the authorization level, the authority information of the target user is graded and adjusted to be in a second state, and the second state is different from the first state; matching an operation authority corresponding to the authority information of the second state through an authority management system; and processing the business data based on the operation authority.

Description

Technical Field

[0001] The present disclosure relates to information security or other technical fields, and more specifically to a user rights management and control method, device, equipment, medium and program product. Background Art

[0002] With the continuous advancement of digital transformation, the importance of data has become increasingly prominent. At the same time, data security protection has also become a focus of attention. Data security breaches such as data leaks often bring huge losses and risks. Especially in the face of increasingly large and complex data sets, involving information interaction and data access between multiple lines, departments and levels, data permission control is crucial. At present, the permission control method usually adopts a role-based access control model, that is, each role corresponds to a set of permissions, and users obtain corresponding permissions by assigning roles to access corresponding data. However, the role-based access control model is a static permission control model. The division of roles is fixed, and role changes require manual authorization and adjustment of roles and permissions, which lacks dynamism. Secondly, when controlling based on roles, a role may have all permissions for the same type of data, and it is impossible to achieve access control of data attribute granularity. In addition, when the existing roles cannot meet the needs, new roles need to be redesigned, which leads to the problem of too many roles. Summary of the invention

[0003] In view of the above problems, embodiments of the present disclosure provide a method, apparatus, device, medium and program product for managing and controlling user rights.

[0004] According to a first aspect of the present disclosure, a method for managing and controlling user permissions is provided, the method comprising: in response to a target user's request for processing business data of an access permission management system, obtaining permission information of the target user and setting the permission information to a first state; based on the permission information of the first state, recursively upward through a pre-constructed object tree to determine the authorization level of the target user; based on the authorization level, hierarchically adjusting the permission information of the target user to a second state, the second state being different from the first state; matching the operation permissions corresponding to the permission information of the second state through the permission management system; and processing the business data based on the operation permissions.

[0005] According to an embodiment of the present disclosure, the permission information based on the first state recursively constructs a pre-built object tree to determine the authorization level of the target user, including: obtaining the associated object of the target user according to the permission information of the target user; based on the associated object, recursively constructing the object tree upward to determine whether the recursive object is a target object, the target object is used to characterize an object category within a preset range; when the recursive object is a target object, determining the authorization level of the target user according to the level of the target object.

[0006] According to an embodiment of the present disclosure, before recursively ascending the object tree based on the associated object and determining whether the current recursive object is the target object, the method includes: determining corresponding group categories for different target users, wherein the group categories are used to characterize the attributes of the target users; and matching corresponding target objects based on the group categories.

[0007] According to an embodiment of the present disclosure, the method also includes: for the target permission in the operation permission, prohibiting the addition of target users with the target permission; in response to changes in the target user with the target permission, transferring the target permission through a permission transfer mechanism, and retaining the historical information of the transfer.

[0008] According to an embodiment of the present disclosure, matching the operation permission corresponding to the permission information of the second state through the permission management system includes: reading a function menu table through the permission management system, the function menu table containing all function modules of the permission management system and their corresponding menu item information; based on the permission information of the second state, checking whether the target user has the permission to access at least one function module in the function menu table; in response to the target user having the permission to access the function module, filtering the business data of all menu items under the function module according to the permission application form of the target user, and obtaining the operation permission of the target user on the filtered business data, wherein the permission application form is used to characterize the scope of data permissions applied for by the target user.

[0009] According to an embodiment of the present disclosure, the method further includes: in response to an operation of changing the function module, integrating the changed function module into the function menu table in an inheritance form, and reloading the function menu table.

[0010] According to an embodiment of the present disclosure, the method further includes: setting a validity period of the operation authority; and preventing the target user from processing the business data when the validity period expires or is terminated in advance.

[0011] The second aspect of the present disclosure provides a user authority management and control device, which includes: an acquisition module, which is used to respond to the target user's request for processing business data of the access authority management system, obtain the authority information of the target user, and set the authority information to a first state; a recursive module, which is used to recursively upward a pre-constructed object tree based on the authority information of the first state to determine the authorization level of the target user; an adjustment module, which is used to hierarchically adjust the authority information of the target user to a second state based on the authorization level, and the second state is different from the first state; a matching module, which is used to match the operation authority corresponding to the authority information of the second state through the authority management system; and a processing module, which is used to process the business data based on the operation authority.

[0012] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0013] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0014] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] According to the user rights management and control method, apparatus, equipment, medium and program product provided by the embodiments of the present disclosure, users do not need to wait for the design, configuration and effectiveness of new roles, and can apply for data rights at any time according to actual needs, thereby achieving simpler and more dynamic management. At the same time, fine-grained permission control is performed on user processing rights based on permission information containing multiple attributes, thereby achieving personalized permission authorization and management. In addition, the pre-built object tree is recursively constructed upward to determine the authorization level, and the permission information of the target user is graded and adjusted from the first state to the second state. Multiple dimensions can be flexibly combined to adapt to different needs, satisfying differentiated permission control, and truly achieving different data processing permissions under the same position or role. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The application scenario diagram of the user rights management method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0018] Figure 2 A flowchart schematically illustrates a method for controlling user rights according to an embodiment of the present disclosure;

[0019] Figure 3 Schematically shows a flow chart of loading menu item information according to an embodiment of the present disclosure;

[0020] Figure 4 A flowchart for filtering business data according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 5 A flowchart of a recursive object tree according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 6 A flowchart schematically shows a target person applying for permission according to an embodiment of the present disclosure;

[0023] Figure 7 A flowchart of an internal auditor application of a subsidiary according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 8 A flowchart schematically shows the application of audit branch personnel and head office audit department personnel according to an embodiment of the present disclosure;

[0025] Fig. 9 A structural block diagram schematically shows a device for managing and controlling user rights according to an embodiment of the present disclosure; and

[0026] Fig.10 A block diagram of an electronic device suitable for implementing a method for managing user rights according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0028] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0029] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0030] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0031] It should be noted that the user rights management method and device disclosed in the present invention can be used in the financial field and the information security field, and can also be used in any field other than the financial field. The application field of the user rights management method and device disclosed in the present invention is not limited.

[0032] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0033] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as permission information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0034] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0035] Embodiments of the present disclosure provide a method, apparatus, device, medium, and program product for managing and controlling user rights.

[0036] Figure 1 The application scenario diagram of the user rights management method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0037] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0038] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0039] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0040] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0041] It should be noted that the user rights control method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the user rights control device provided in the embodiment of the present disclosure can generally be set in the server 105. The user rights control method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the user rights control device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0042] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0043] The following will be based on Figure 1 The scene described by Figures 2 to 8 The method for controlling user rights in an embodiment of the present disclosure is described in detail.

[0044] The inventor has found through research that in the relevant technology, in the field of consolidated management of enterprise groups, the consolidated management system will centrally manage the information scattered in various departments of the parent company and various subsidiaries, build a subsidiary information integration, sharing and analysis center, and form a distribution center for subsidiary information. In particular, with the increasing complexity of group operations and risk factors, the difficulty of specialized research and tracking of corresponding subsidiaries by various audit institutions has increased. By fully sharing the data of the consolidated management system, audit line personnel can grasp the group's consolidated management information and subsidiary business management information to the maximum extent, laying the foundation for normalized tracking of consolidated management, analysis of subsidiary data and conducting audit activities. How to meet compliance requirements, so that various audit users strictly follow the data use principle of "tiered authorization, knowing what is necessary", and realize refined and personalized data authority control in the process of consolidated management audit, subsidiary comprehensive audit, special audit and subsidiary internal audit, is also a problem faced by group data security management. Therefore, the embodiment of the present disclosure provides a method for controlling user rights.

[0045] Figure 2 The flowchart of the method for managing and controlling user rights according to an embodiment of the present disclosure is schematically shown.

[0046] like Figure 2 As shown, the user rights management method of this embodiment includes operations S210 to S250.

[0047] In operation S210, in response to a processing request of a target user for accessing service data of a permission management system, permission information of the target user is acquired, and the permission information is set to a first state.

[0048] In the permission management system, the first state can refer to the initial state or default state of user permissions, such as "no permission" or "pending review", to ensure that sensitive permissions are not granted privately and improve the security of system permissions. Then, permissions can be initialized to users in the corresponding departments according to the actual management needs of the current business.

[0049] In an embodiment of the present disclosure, before obtaining the permission information input by the target user, the user's consent or authorization may be obtained. For example, before operation S210, a request to obtain the permission information input by the target user may be issued to the user. When the user agrees or authorizes that the permission information input by the target user may be obtained, operation S210 is performed.

[0050] In operation S220, based on the permission information of the first state, a pre-constructed object tree is recursively constructed upward to determine the authorization level of the target user.

[0051] In operation S230, based on the authorization level, the permission information of the target user is hierarchically adjusted to a second state, where the second state is different from the first state.

[0052] In operation S240, the permission management system is used to match the operation permission corresponding to the permission information of the second state.

[0053] In the embodiments of the present disclosure, a corresponding operation entry may be provided for the user to choose to agree or reject the automated decision result. That is, before matching the operation permission processing / decision corresponding to the permission information of the second state, the user's instruction to agree or reject the processing / decision input through the corresponding operation entry may be obtained. If the user agrees to process / decision, the operation permission processing / decision corresponding to the permission information of the second state is matched, and step S240 is executed. If the user refuses to process / decision, the expert decision process is entered.

[0054] In operation S250, the business data is processed based on the operation authority.

[0055] The permission management system first receives the business data processing request initiated by the target user, which may include query requests, audit requests, and authorization requests. At the same time, the system obtains the current permission information of the target user, such as the target user's number, position, department, organization, and other attributes. For security reasons, the system can set the permission information of the target user to an initial, restricted first state. In addition, the system pre-builds an object tree that reflects the internal structure and permission hierarchy of the organization. Each node of the object tree can represent an object (such as department, position, etc.) and contains permission information related to the object. By starting from the object node where the target user is located and recursively traversing the object tree upward, the authorization level of the target user can be obtained, such as headquarters authorization management, branch authorization management, and subsidiary authorization management. According to the authorization level of the target user, the system then hierarchically adjusts the permission information of the target user from the first state to the second state, refines the permissions, and enables users to have different query permissions in different dimensions. Among them, the second state can represent the operations that the target user can perform and the resources that can be accessed under the authorization level. Then, through the authority management system, the operation authority corresponding to the authority information of the second state can be matched, and based on the matched operation authority, the target user processes the requested business data.

[0056] It should be noted that the data permission scope can be limited for all business data to ensure that users can only access data within the permission scope to prevent data leakage and abuse.

[0057] In some exemplary embodiments, the target user named "Zhang San" is an employee of the marketing department of a subsidiary, and he needs to query the sales data within the marketing department. In this process, the authority management system first receives the request for querying business data initiated by Zhang San, then obtains Zhang San's authority information (the authority information shows that Zhang San is an employee of the marketing department), and sets the authority information to a restricted first state (no authority state). Then, the system starts from the marketing department employee node where Zhang San is located, and recursively traverses the object tree upward. According to the traversal results, it is determined that Zhang San's department is in the subsidiary query authority agency category, that is, after the authorization level is approved by the user with the subsidiary authorization management authority, Zhang San's query authority can take effect. According to Zhang San's authorization level, the system can adjust his authority information from the first state to the second state, that is, the query authority for the internal data of the marketing department. Finally, the system matches the operation authority corresponding to Zhang San's second state authority information, allowing Zhang San to query the sales data within the marketing department.

[0058] It can be understood that the state adjustment (from the first state to the second state) of the permission information containing multiple attributes is based on the user's authorization level, so that different degrees of access rights can be provided according to the user's role and responsibilities. At the same time, the pre-built object tree is recursively constructed upward to determine the authorization level, and the user's permissions can be flexibly adjusted dynamically according to the organizational structure or hierarchical relationship. That is, the embodiment of the present disclosure performs permission management based on multi-dimensional ideas and attributes, thereby achieving more flexible and fine-grained user permission management and control, and accurately, securely and efficiently meeting various data processing needs such as horizontal and vertical.

[0059] In an embodiment of the present disclosure, the method also includes: for the target permission in the operation permission, prohibiting the addition of target users with the target permission; in response to changes in the target user with the target permission, transferring the target permission through a permission transfer mechanism, and retaining the historical information of the transfer.

[0060] On the basis of the above embodiments, in this embodiment, for specific and sensitive operation permissions (i.e., target permissions), such as authorization and approval permissions, the system can implement strict control strategies and does not allow the addition of such permissions. When a user with target permissions changes (such as leaving the company, transferring positions, etc.), the system transfers the permissions to a person with the same identity through a permission transfer mechanism, such as a person with an audit identity in the audit department, audit branch, or subsidiary audit. During the permission transfer process, the system will record the historical information of the transfer in detail, including the transfer time, transferor, recipient, and reason for the transfer.

[0061] It is understandable that strict control and management of target permissions can effectively prevent abuse of permissions and illegal access, thereby improving the security of the entire system. In addition, by retaining historical traces of handover, it helps with subsequent auditing and tracing, ensuring the transparency and traceability of permission management.

[0062] Furthermore, matching the operation permissions corresponding to the permission information of the second state through the permission management system includes: reading a function menu table through the permission management system, the function menu table containing all function modules of the permission management system and their corresponding menu item information; based on the permission information of the second state, checking whether the target user has the permission to access at least one function module in the function menu table; in response to the target user having the permission to access the function module, filtering the business data of all menu items under the function module according to the permission application form of the target user to obtain the operation permissions of the target user on the filtered business data, wherein the permission application form is used to characterize the scope of data permissions applied for by the target user.

[0063] like Figure 3As shown, through the permission management system, the function menu table is read and parsed, and the menu item information corresponding to each function module is stored in the function menu table. Then, based on the permission information of the second state (i.e., the current actual permission state of the target user), it is checked whether the target user has the permission to access one or some function modules in the function menu table, and all menu items under the function modules with permission are obtained, and the interface rendering menu is performed.

[0064] For each menu item, the system performs data permission control through the background. Figure 4 As shown, according to the permission information of the current user (such as the number), the data permission range in the permission application form (which records in detail the data permission range applied for by the user) can be read, and then the data permission module can be loaded, and the data filter can be applied to filter the business data of the menu item, and finally the target user's operation permission for the filtered business data can be determined.

[0065] For example, all users who participate in this audit only need to apply for the audit post to enter the system and automatically have the audit function menu, including basic functions such as audit menu query and audit authority application. For users with authorization management authority, the system will additionally grant them advanced functions such as audit authority approval and audit authority query. The system reads the audit menu table according to the function module requested by the user and obtains all menu items corresponding to the module. Then, according to the current user number, the data authority range in the audit authority application form is read, and the data is filtered through the data filter, and finally the query results that meet the authority requirements and data range are returned to the user.

[0066] It should be noted that for details not included in this embodiment, please refer to the implementation details of the aforementioned embodiment.

[0067] It should be noted that having the permission to a module is equivalent to having the permission to all menus under the module, but the data permission of the menu items still needs to be controlled through data permission control in the background.

[0068] Furthermore, the target user can add institutional restrictions when querying data. Specifically, the system can obtain the institutional scope approved by the current user from the results of the authorization application process. During the query process, the system checks whether the institutional scope in the query conditions matches the approved institutional scope. If the match is successful, the query operation continues. If the institutional scope in the query conditions does not match the approved institutional scope, or the user does not have the authority to any subsidiary, the default restriction is to use a non-existent institutional scope to ensure that the user cannot query any data.

[0069] It is understandable that by limiting the scope of the function module, it is possible to check whether the target user has the authority to access a specific function module, thereby preventing unauthorized users from accessing sensitive information or performing illegal operations, thereby improving the security of the system. At the same time, by filtering the business data of all menu items under the function module, the target user's operation authority for the filtered business data can be obtained, so that authority management can be accurate to the specific business data level.

[0070] Furthermore, before recursively ascending the object tree based on the associated object and determining whether the current recursive object is the target object, the method includes: determining corresponding group categories for different target users, wherein the group categories are used to characterize the attributes of the target users; and matching corresponding target objects based on the group categories.

[0071] Through the target user's permission information, the target user can be classified, that is, different group categories can be formulated, such as internal auditors of subsidiaries, audit branch personnel and head office audit department personnel, to reflect the differences in user organizational structure and responsibilities. Then, the corresponding target object can be matched according to the user's group category.

[0072] Exemplarily, the target object corresponding to the internal auditors of the subsidiary is the audit authority organization category of the subsidiary, and the target object corresponding to the audit branch personnel and the head office audit department personnel is the head office or audit branch organization category.

[0073] It can be understood that through more detailed user classification, the accuracy of permission matching and target object identification is optimized.

[0074] Furthermore, the permission information based on the first state recursively constructs a pre-built object tree to determine the authorization level of the target user, including: obtaining an associated object of the target user based on the permission information of the target user; based on the associated object, recursively constructing the object tree to determine whether the recursive object is a target object, the target object being used to characterize an object category within a preset range; when the recursive object is a target object, determining the authorization level of the target user based on the level of the target object.

[0075] Figure 5 The flowchart of the recursive object tree according to the embodiment of the present disclosure is schematically shown.

[0076] Specifically, Figure 5As shown, first determine whether there is a position applied for by the target person (such as an audit and consolidated audit position). If not, the process ends. If so, the associated objects of the user, such as the administrative agency, department, and position, can be accurately identified and obtained based on the authority information of the current target user (such as the user number). Then, using the associated object as the starting point, start to recursively traverse the pre-built object tree upward. The object tree is a hierarchical structure, in which each node represents an object (such as a department, position, etc.), and the connection between nodes reflects the subordinate or inclusive relationship between objects. In the recursive process, check one by one whether the obtained parent object is a top-level object. If it is a top-level object, the process ends. Otherwise, determine whether the parent object is a target object. The target object represents a specific object that can determine the user's authorization level, usually representing a specific scope of authority or administrative level. For example, in the context of audit authority, the target object may include a department or position with the function of audit authority approval. If the target object is encountered in the recursive process, the authorization level of the target user is determined according to the level of the target object, and the object category within the preset list range is returned.

[0077] For example, in the specific application of the audit scenario, the personnel involved in the audit need to initiate business authority applications based on actual business needs. The system determines the scope of application authority and process links based on the administrative agencies (i.e., associated objects) corresponding to different personnel, and then the approval personnel with authorization management authority will authorize it.

[0078] Figure 6 The flowchart of a target person applying for permission according to an embodiment of the present disclosure is schematically shown.

[0079] like Figure 6 As shown, when applying for audit authority, click Add, and the system will determine whether the person is an audit staff. If so, the system will determine the specific group category, that is, subsidiary auditor, head office audit branch staff, or audit headquarters staff. Finally, enter different application processes based on the group category.

[0080] Based on the above embodiments, Figure 7 As shown in the figure, the application process for internal auditors of subsidiaries is as follows: when the consolidated audit post of the subsidiary applies for audit authority, click Add. The system obtains the administrative organization through the current logged-in employee number (i.e., authority information), and then recursively searches upward through the administrative organization tree to determine whether the recursive organization is the audit authority organization category of the subsidiary (i.e., the target object). Then, the applicant selects the scope of the functional modules that need to be audited, the scope of the subsidiaries, and the validity period of the authorization, forms the authority application form, saves it, and submits the application process. Finally, after approval by the user with the authorization management authority of the subsidiary, the audit authority takes effect immediately. Figure 8As shown in the figure, the application process for audit branch personnel and head office audit department personnel is as follows: when the head office or audit branch consolidated audit position applies for audit authority, click Add, and the system obtains the administrative organization through the current login employee number, and then recursively searches the organization tree through the administrative organization, and determines that the recursive organization is the head office or audit branch organization category. Then, the applicant selects the functional module scope, subsidiary scope and authorization validity period to be audited, forms the authority application form, saves it, and submits the application process. In the audit branch, after the user with the authorization management authority of the audit branch is approved, the authorization approval by the head office audit department is approved, and the audit authority takes effect immediately. In the head office audit department, after the user with the authorization management authority of the head office is approved, the audit authority takes effect immediately.

[0081] It should be noted that employees with auditing roles do not necessarily have auditing application permissions. The system needs to recursively traverse upwards according to the administrative agency to which the employee belongs to determine the employee's audit identity. Only those with audit identity can apply for permissions to avoid other employees mistakenly applying for permissions and causing permission leakage.

[0082] It can be understood that by obtaining the associated object based on the target user's permission information and recursively traversing the object tree based on the associated object, the user's permission level and scope can be accurately located, avoiding the problems of inaccurate permission allocation and ambiguous permission scope that may occur in traditional permission management, and improving the accuracy of permission management. At the same time, the user's authorization level is determined based on the object category (i.e., the target object) within the preset range, so that the permission management policies and rules can be flexibly adjusted according to different business needs and security requirements. In addition, by recursively determining the user's authorization level through the object tree, the system can effectively prevent permission leakage and misoperation.

[0083] In an embodiment of the present disclosure, the method further includes: in response to an operation of changing the function module, integrating the changed function module into the function menu table in an inheritance form, and reloading the function menu table.

[0084] As the business develops and the needs change, the functional modules in the system may be frequently updated or adjusted. At the same time, since the work scenarios of various types of permission management are all for reviewing and querying the current existing functions, there is a great similarity with the original query functions. If they are redeveloped, it will lead to a waste of resources. Therefore, when a functional module changes (such as addition, deletion, modification, etc.), it can be integrated into the function menu table through inheritance. The inheritance mechanism allows the new functional module to be expanded or customized as necessary while retaining the original functional characteristics. Furthermore, the system can also overload the function menu table, such as updating the display name, icon, access rights and other attributes of the menu item, and adding or modifying the business logic and data processing flow related to the new functional module.

[0085] It is understandable that by adopting the inheritance form of menu functions, the development cycle can be shortened, development costs can be reduced, and function implementation can be more efficient and convenient. At the same time, function overloading can help meet differentiated functional requirements and work scenarios.

[0086] In an embodiment of the present disclosure, the method further includes: setting a validity period of the operation authority; and preventing the target user from processing the business data when the validity period expires or is terminated in advance.

[0087] In order to ensure the timeliness of permissions and avoid abuse of permissions, you can set an effective period for the operation permissions, which represents the time range in which the target user is authorized to access and operate specific business data. The specific time range of the effective period can be a fixed period of time, with mandatory restrictions on the start date and end date, such as one month, three months, etc., or it can be set dynamically according to specific business needs and work plans. When the effective period ends or ends early, the target user's operation permissions can be automatically or manually revoked, for example, by modifying the permission record in the database, sending a notification to the target user, or performing other necessary operations. Once the permissions are revoked, the target user can no longer access or operate the relevant business data.

[0088] It is understandable that by introducing the validity period setting of operating permissions, the timeliness and accuracy of permission management can be ensured, avoiding the problem of work adjustments while permissions are still retained.

[0089] Based on the above user rights management method, the present disclosure also provides a user rights management device. Fig. 9 The device is described in detail.

[0090] Fig. 9 The structural block diagram of the user rights management and control device according to an embodiment of the present disclosure is schematically shown.

[0091] like Fig. 9As shown, the user rights management and control device 900 of this embodiment includes an acquisition module 910, a recursive module 920, an adjustment module 930, a matching module 940 and a processing module 950.

[0092] The acquisition module 910 is used to respond to the target user's request for processing service data of the access authority management system, acquire the target user's authority information, and set the authority information to the first state. In one embodiment, the acquisition module 910 can be used to perform the operation S210 described above, which will not be repeated here.

[0093] The recursive module 920 is used to recursively upwardly construct the pre-built object tree based on the permission information of the first state to determine the authorization level of the target user. In one embodiment, the recursive module 920 can be used to perform the operation S220 described above, which will not be described in detail here.

[0094] The adjustment module 930 is used to hierarchically adjust the target user's permission information to a second state based on the authorization level, and the second state is different from the first state. In one embodiment, the adjustment module 930 can be used to perform the operation S230 described above, which will not be repeated here.

[0095] The matching module 940 is used to match the operation permission corresponding to the permission information of the second state through the permission management system. In one embodiment, the matching module 940 can be used to perform the operation S240 described above, which will not be described in detail here.

[0096] The processing module 950 is used to process the business data based on the operation authority. In one embodiment, the processing module 950 can be used to perform the operation S250 described above, which will not be described in detail here.

[0097] According to an embodiment of the present disclosure, the recursive module 920 is specifically used to: obtain the associated object of the target user according to the permission information of the target user; based on the associated object, recursively upward the object tree to determine whether the recursive object is the target object, and the target object is used to characterize the object category within a preset range; when the recursive object is the target object, determine the authorization level of the target user according to the level of the target object.

[0098] According to an embodiment of the present disclosure, the recursive module 920 may also be used to: determine corresponding group categories for different target users, wherein the group categories are used to characterize the attributes of the target users; and match corresponding target objects based on the group categories.

[0099] According to an embodiment of the present disclosure, the processing module 950 can also be used to: for the target permission in the operation permission, prohibit the addition of target users with the target permission; in response to changes in the target user with the target permission, transfer the target permission through a permission transfer mechanism, and retain the historical information of the transfer.

[0100] According to an embodiment of the present disclosure, the matching module 940 is specifically used to: read a function menu table through the permission management system, the function menu table containing all function modules of the permission management system and their corresponding menu item information; based on the permission information of the second state, check whether the target user has the permission to access at least one function module in the function menu table; in response to the target user having the permission to access the function module, filter the business data of all menu items under the function module according to the permission application form of the target user, and obtain the target user's operation permission for the filtered business data, wherein the permission application form is used to characterize the data permission scope applied for by the target user.

[0101] According to an embodiment of the present disclosure, the matching module 940 may also be used to: in response to an operation of changing the functional module, integrate the changed functional module into the functional menu table in an inheritance form, and reload the functional menu table.

[0102] According to an embodiment of the present disclosure, the processing module 950 may also be used to: set a validity period for the operation authority; and prevent the target user from processing the business data when the validity period expires or is terminated in advance.

[0103] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 910, the recursive module 920, the adjustment module 930, the matching module 940 and the processing module 950 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 910, the recursive module 920, the adjustment module 930, the matching module 940 and the processing module 950 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 910, the recursive module 920, the adjustment module 930, the matching module 940 and the processing module 950 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0104] Fig.10 A block diagram of an electronic device suitable for implementing a method for managing user rights according to an embodiment of the present disclosure is schematically shown.

[0105] like Fig.10 As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 to a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0106] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other via bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0107] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the input / output (I / O) interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the input / output (I / O) interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0108] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0109] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0110] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the user authority management method provided by the embodiment of the present disclosure.

[0111] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1001. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0112] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0113] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0114] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0115] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0117] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for controlling user rights, characterized in that: The method comprises: In response to a processing request of a target user for service data of an access authority management system, obtaining authority information of the target user and setting the authority information to a first state; Based on the permission information of the first state, recursively upwardly through a pre-built object tree to determine the authorization level of the target user; Based on the authorization level, hierarchically adjusting the permission information of the target user to a second state, the second state being different from the first state; Matching, through the authority management system, the operation authority corresponding to the authority information of the second state; Based on the operation authority, the business data is processed.

2. The method according to claim 1, characterized in that The step of recursively traversing the pre-built object tree based on the permission information of the first state to determine the authorization level of the target user includes: Acquire the associated objects of the target user according to the permission information of the target user; Based on the associated object, recursively traverse the object tree upwards to determine whether the recursive object is a target object, where the target object is used to represent an object category within a preset range; When the recursive object is a target object, the authorization level of the target user is determined according to the level of the target object.

3. The method according to claim 2, characterized in that Before recursively ascending the object tree based on the associated object and determining whether the current recursive object is the target object, the method includes: Determining corresponding group categories for different target users, wherein the group categories are used to characterize attributes of the target users; Based on the group category, the corresponding target object is matched.

4. The method according to claim 1, characterized in that The method further comprises: For the target permissions in the operation permissions, it is prohibited to add target users with the target permissions; In response to a change in a target user having the target authority, the target authority is transferred through a authority transfer mechanism, and historical information of the transfer is retained.

5. The method according to claim 1, characterized in that The matching of the operation authority corresponding to the authority information of the second state by the authority management system includes: Through the authority management system, a function menu table is read, wherein the function menu table includes all function modules of the authority management system and their corresponding menu item information; Based on the permission information of the second state, checking whether the target user has permission to access at least one function module in the function menu table; In response to the target user having the authority to access the functional module, the business data of all menu items under the functional module are screened according to the target user's authority application form to obtain the target user's operation authority for the screened business data, wherein the authority application form is used to characterize the scope of data authority applied for by the target user.

6. The method according to claim 5, characterized in that The method further comprises: In response to the operation of changing the function module, the changed function module is integrated into the function menu table in an inheritance form, and the function menu table is reloaded.

7. The method according to claim 1, characterized in that The method further comprises: Setting the validity period of the operation authority; When the validity period expires or is terminated in advance, the target user is prevented from processing the business data.

8. A user rights management and control device, characterized in that: The device comprises: An acquisition module, configured to acquire permission information of a target user in response to a processing request of the target user for the service data of the access permission management system, and set the permission information to a first state; A recursive module, configured to recursively upwardly perform a pre-built object tree based on the permission information of the first state to determine the authorization level of the target user; an adjustment module, configured to hierarchically adjust the permission information of the target user to a second state based on the authorization level, the second state being different from the first state; A matching module, used to match the operation authority corresponding to the authority information of the second state through the authority management system; A processing module is used to process the business data based on the operation authority.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that when the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images