Data access permission management and control method and related equipment
By configuring an authorization system for each business application and finding the target authorization dimension, the problem of inefficient authority management among multiple business applications is solved, and flexible data access permission control is achieved to adapt to the needs of different business applications.
Patent Information
- Application Number
- CN202411897487.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-04-15
AI Technical Summary
The prior art is difficult to be universal among multiple business applications, resulting in inefficient permission management.
By configuring the corresponding authorization system for each business application, and looking up the target authorization dimension associated with the request document type under the authorization system, obtaining the authorization scope of the requesting party under the target authorization dimension, thereby finding the target service data from the business database of the business application.
It realizes data access permission control among multiple business applications, improves the overall data access permission control efficiency, and adapts to the needs of different business applications.
Smart Images
Figure CN119830323A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of rights management, and in particular to a method and related equipment for controlling data access rights. Background Art
[0002] The existing permission management for consolidated report integration and budget management platforms relies on the permission management functions of the business applications to which the business data belongs.
[0003] In order to uniformly obtain the business data called by the consolidated report integration and budget management platform, it is necessary to provide a permission management solution that can be used by different business applications. However, the permission management functions of different business applications are all written by developers. The entire permission management function is closely integrated with the business and business scenarios, and cannot be used across multiple business applications, making permission management inefficient. Summary of the invention
[0004] The embodiments of the present application provide a data access rights management method and related equipment to improve the efficiency of rights management.
[0005] A first aspect of an embodiment of the present application provides a method for controlling data access rights, including:
[0006] Obtaining a data access request initiated by a business application, wherein the data access request has a corresponding requesting party and a request document type;
[0007] Determine the authorization system to which the business application belongs, and search for the target authorization dimension associated with the request document type under the authorization system, and obtain the authorization scope of the requester under the target authorization dimension, where the target authorization dimension is determined based on the business field included in the corresponding request document type;
[0008] Based on the authorization scope of the requesting party under the target authorization dimension, searching for target business data from a business database of the business application;
[0009] The target business data is used as reply information corresponding to the data access request.
[0010] In a specific implementation, before determining the authorization system to which the business application belongs, the method further includes:
[0011] Acquire multiple basic dimensions in the authorization system, where the multiple basic dimensions include preset dimensions and / or custom dimensions, and the basic dimensions are determined based on business fields included in the corresponding request document type;
[0012] A target authorization dimension associated with the request document type determined based on the basic dimension is obtained, where the target authorization dimension includes any of the basic dimensions.
[0013] In a specific implementation manner, obtaining the authorization scope of the requesting party under the target authorization dimension includes:
[0014] Obtaining at least one first-level target role group to which the requesting party belongs;
[0015] Based on a plurality of authorization scopes of each level of the target role group under the target authorization dimension, the authorization scope of the requester under the target authorization dimension is determined.
[0016] In a specific implementation, the determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension of each level of the target role grouping includes:
[0017] Determine each of the basic dimensions in the target authorization dimension as a target basic dimension, and obtain a basic authorization scope of each of the target basic dimensions under the authorization system;
[0018] Grouping the target role at each level into an intersection of multiple authorization scopes under the target authorization dimension, and determining the estimated authorization scope of the requesting party;
[0019] The intersection between the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system is determined as the authorization scope of the requesting party under the target authorization dimension.
[0020] In a specific implementation, before determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension at each level of the target role grouping, the method further includes:
[0021] In response to the control operation for each level of the target role group under the authorization system, the target authorization dimension associated with the request document type under the authorization system is displayed on the authority configuration page;
[0022] For each level of the target role group, obtaining the authorization scope of each basic dimension in the target authorization dimension input by the user;
[0023] The target role groups at any level are grouped, and the authorization scope of each basic dimension in the target authorization dimension is determined as the authorization scope of the target role group at the corresponding level under the target authorization dimension.
[0024] In a specific implementation, the business data in the business database is stored in a columnar manner, the authorization scope of the requester under the target authorization dimension includes the authorization scope of each of the basic dimensions in the target authorization dimension, and searching for target business data from the business database of the business application based on the authorization scope of the requester under the target authorization dimension includes:
[0025] For each of the basic dimensions included in the target authorization dimension, based on the authorization scope of the basic dimension in the target authorization dimension and the data in the data column corresponding to the basic dimension in the business database, determine the initial screening business data;
[0026] The target business data is determined based on the initially screened business data corresponding to each of the basic dimensions included in the target authorization dimension.
[0027] A second aspect of an embodiment of the present application provides a computer device, including:
[0028] An acquisition unit, used to acquire a data access request initiated by a business application, wherein the data access request has a corresponding requester and a request document type;
[0029] a determining unit, configured to determine the authorization system to which the business application belongs, and to search for a target authorization dimension associated with the request document type under the authorization system, and to obtain an authorization scope of the requesting party under the target authorization dimension, wherein the target authorization dimension is determined based on a business field included in the corresponding request document type;
[0030] A searching unit, configured to search for target business data from a business database of the business application based on an authorization scope of the requesting party under the target authorization dimension;
[0031] The reply unit is used to use the target business data as reply information corresponding to the data access request.
[0032] In a specific implementation, before determining the authorization system to which the business application belongs,
[0033] The acquisition unit is further used to acquire a plurality of basic dimensions in the authorization system, wherein the plurality of basic dimensions include preset dimensions and / or user-defined dimensions, and the basic dimensions are determined based on business fields included in a corresponding request document type;
[0034] The acquisition unit is further configured to acquire a target authorization dimension associated with the request document type determined based on the basic dimension, wherein the target authorization dimension includes any of the basic dimensions.
[0035] In a specific implementation, the acquisition unit is specifically used to acquire at least one first-level target role group to which the requesting party belongs;
[0036] Based on a plurality of authorization scopes of each level of the target role group under the target authorization dimension, the authorization scope of the requester under the target authorization dimension is determined.
[0037] In a specific implementation manner, the determining unit is specifically configured to determine each of the basic dimensions in the target authorization dimension as a target basic dimension, and obtain a basic authorization scope of each of the target basic dimensions under the authorization system;
[0038] Grouping the target role at each level into an intersection of multiple authorization scopes under the target authorization dimension, and determining the estimated authorization scope of the requesting party;
[0039] The intersection between the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system is determined as the authorization scope of the requesting party under the target authorization dimension.
[0040] In a specific implementation, before determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension at each level of the target role grouping, the computer device further includes: a display unit;
[0041] The display unit is configured to display the target authorization dimension associated with the request document type under the authorization system on the authority configuration page in response to the authority control operation for each level of the target role group under the authorization system;
[0042] The acquisition unit is further configured to acquire, for each level of the target role group, the authorization scope of each basic dimension in the target authorization dimension input by the user;
[0043] The determining unit is further used to group the target roles at any level and determine the authorization scope of each basic dimension in the target authorization dimension as the authorization scope of the target role group at the corresponding level under the target authorization dimension.
[0044] In a specific implementation, the business data in the business database is stored in a columnar manner, the authorization scope of the requesting party under the target authorization dimension includes the authorization scope of each of the basic dimensions in the target authorization dimension, and the search unit is specifically configured to determine the preliminary screening business data for each of the basic dimensions included in the target authorization dimension based on the authorization scope of the basic dimension in the target authorization dimension and the data in the data column corresponding to the basic dimension in the business database;
[0045] The target business data is determined based on the initially screened business data corresponding to each of the basic dimensions included in the target authorization dimension.
[0046] A third aspect of an embodiment of the present application provides a computer device, including:
[0047] CPU, memory and input / output interface;
[0048] The memory is a short-term storage memory or a persistent storage memory;
[0049] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method described in the first aspect.
[0050] A fourth aspect of the embodiments of the present application provides a computer program product comprising instructions, and when the computer program product is run on a computer, the computer is caused to execute the method described in the first aspect.
[0051] A fifth aspect of an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores instructions, and when the instructions are executed on a computer, the computer executes the method described in the first aspect.
[0052] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages: a corresponding authorization system is configured for each business application, and under each authorization system, the request document type has a corresponding authorization dimension, and the requesting party has a corresponding authorization scope under the authorization dimension corresponding to the request document type, wherein the authorization dimension is determined based on the business field contained in the corresponding request document type. The above multi-level data access permission management method can adapt well to different business applications and improve the overall data access permission management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0053] Figure 1 A system architecture diagram of the data access rights management method disclosed in the embodiment of the present application;
[0054] Figure 2 A schematic diagram of a flow chart of a method for controlling data access rights disclosed in an embodiment of the present application;
[0055] Figure 3 A schematic diagram of the structure of a computer device disclosed in an embodiment of the present application;
[0056] Figure 4 Another structural schematic diagram of the computer device disclosed in the embodiment of the present application. DETAILED DESCRIPTION
[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0058] The embodiments of the present application provide a data access rights management method and related equipment to improve the efficiency of rights management.
[0059] In order to better implement the data access rights management method of the present application, the present application embodiment provides a data access rights management framework, such as Figure 1 As shown. At least one authorization system can be configured under the control framework of the data access rights, and each authorization system contains different basic dimensions. Since different authorization systems are targeted at specific business scenarios, and the document types that may be involved in each business scenario are relatively fixed, different authorization dimensions will be configured for the corresponding document types in each authorization system, that is, the authorization dimensions associated with the corresponding document types under the authorization system. On this basis, under each authorization system, the corresponding authorization scope can be configured for each requester based on the authorization dimensions associated with the document type. Among them, a specific business scenario may be related to a business application or multiple business applications, so it is also necessary to assign a corresponding authorization system to each business application.
[0060] In practical applications, data access permissions configured based on the above data access permission management framework can be uniformly deployed in a certain system to form a permission management module. When it is necessary to obtain business data that can be accessed by any requesting party under the corresponding data application, the corresponding authorization scope can be obtained from the permission management module to perform controllable access to business data. The present invention can be applied to various information management systems, such as enterprise resource planning systems (ERP, enterprise resource planning), financial systems, human resources systems, tax systems, supply chain systems, etc.
[0061] See also Figure 2 The present application provides a method for controlling data access rights, including the following steps:
[0062] 201. Obtain a data access request initiated by a business application. The data access request has a corresponding requester and a request document type.
[0063] Generally, the business data of different businesses are usually provided by the corresponding business applications, that is, different business data are usually directly obtained by the corresponding business applications. Therefore, no matter which device actually obtains the business data, it is necessary to obtain the real business data through the data access request initiated by the business application.
[0064] It is understandable that the business scenario of the embodiment of the present application is the control access to users or users in the system, so a data access request should have a corresponding requester, which is the user. Specifically, it can be the source that enables the business application to initiate the data access request. In addition, in the application scenario of the embodiment of the present application, the data access request also has a corresponding request document type, which is to achieve more refined data access control.
[0065] 202. Determine the authorization system to which the business application belongs, and search for the target authorization dimension associated with the request document type under the authorization system, and obtain the authorization scope of the requester under the target authorization dimension. The target authorization dimension is determined based on the business fields included in the corresponding request document type.
[0066] like Figure 1 It can be seen from the illustrated embodiment that each business application has a corresponding authorization system. In general, each business application can have one or more corresponding authorization systems. If a business application has multiple corresponding authorization systems, only one authorization system will be effective at the same time (that is, it will be determined as the authorization system corresponding to the business application), or different authorization systems control different types of documents, or different authorization systems belong to different business scenarios. Among them, the division of business scenarios can be configured as needed and is not limited here.
[0067] Furthermore, since different document types are associated with different authorization dimensions under each authorization system, and different requesters have corresponding authorization scopes under different authorization dimensions, it is also necessary to find the target authorization dimension associated with the requested document type under the authorization system and obtain the authorization scope of the requester under the target authorization dimension.
[0068] The target authorization dimension includes the business fields in the document corresponding to the requested document type, or the calculated fields determined based on the business fields in the document corresponding to the requested document type. The calculated fields are obtained by performing certain logical or mathematical operations on the field values of any business fields, which are not limited at this time.
[0069] 203. Based on the authorization scope of the requester under the target authorization dimension, search for target business data from the business database of the business application.
[0070] If the authorization scope of the requesting party under the target authorization dimension is obtained, combined with the request document type corresponding to the target authorization dimension (under the aforementioned authorization system), the business data that meets the aforementioned authorization scope in the business document corresponding to the request document type in the business database of the user's business application can be obtained as the target business data.
[0071] 204. Send the target business data as reply information corresponding to the data access request to the business application.
[0072] Since the target business data is obtained based on the data acquisition request in step 201, the business data that is within the visible scope of the requesting party in step 201 can be used as the reply information corresponding to the data access request.
[0073] In the embodiment of the present application, a corresponding authorization system is configured for each business application, and under each authorization system, the request document type has a corresponding authorization dimension, and the requester has a corresponding authorization scope under the authorization dimension corresponding to the request document type, wherein the authorization dimension is determined based on the business field contained in the corresponding request document type. The above multi-level data access permission management method can be well adapted to different business applications and improve the overall data access permission management efficiency.
[0074] On the basis of the aforementioned embodiment, before the aforementioned step 202, the embodiment of the present application also includes: obtaining multiple basic dimensions in the authorization system, the multiple basic dimensions include preset dimensions and / or custom dimensions; obtaining a target authorization dimension associated with the request document type determined based on the basic dimension, the target authorization dimension includes any basic dimension.
[0075] Specifically, all data in the business scenarios involved in each authorization system will be open to users according to the document type of the document to which it belongs. At the same time, different document types have corresponding associated authorization dimensions, and the basic dimensions that make up the authorization dimensions are determined based on the business fields contained in the corresponding document type. In this way, it can be considered that the authorization dimensions associated with different document types are determined based on the business fields contained in the corresponding document type. In other words, the target authorization dimension contains multiple basic dimensions that need to be used to filter the readable data in the document corresponding to the requested document type.
[0076] Among them, for different document types, the business fields contained in the corresponding documents have the same part and different parts, and the same part is the preset dimension in the embodiment of the present application, and the different part can be configured through the custom dimension. The introduction of the custom dimension in the embodiment of the present application realizes the improvement of the scalability of the data access permission management method in the embodiment of the present application
[0077] It is understandable that the target authorization dimension associated with different request document types can be one or more, which can be configured as needed.
[0078] Furthermore, the aforementioned step 202 may be specifically implemented by referring to the following steps: obtaining at least one level of target role grouping to which the requester belongs; and determining the authorization scope of the requester under the target authorization dimension based on multiple authorization scopes of each level of target role grouping under the target authorization dimension.
[0079] Specifically, each user who may request business data in the business application of the embodiment of the present application can be assigned multiple target role groups, and if the users under different target role groups (such as the requesting party of the embodiment of the present application) are uniformly controlled. In actual applications, multi-level role groups can also be set. For example, based on the group scenario dimension, it can be divided into multiple levels such as group level, company level, and organization level from top to bottom, and each employee under the group will be divided into a role group in one or more role groups at each level. Among them, the subordinate role group will inherit the entire authorization scope of the superior role group to which it belongs. Therefore, the authorization scope corresponding to the superior role group is usually smaller than the authorization scope corresponding to the subordinate role group.
[0080] Furthermore, based on the multiple authorization scopes of each level of target role grouping under the target authorization dimension, the authorization scope of the requester under the target authorization dimension is determined, including: determining each basic dimension in the target authorization dimension as the target basic dimension, and obtaining the basic authorization scope of each target basic dimension under the authorization system; determining the intersection of the multiple authorization scopes of each level of target role grouping under the target authorization dimension as the estimated authorization scope of the requester; determining the intersection between the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system as the authorization scope of the requester under the target authorization dimension.
[0081] Specifically, in the embodiment of the present application, a corresponding authorization scope can also be configured for each basic dimension under the authorization system, and the restriction of this authorization scope is applicable to all role groups. However, considering that when configuring the corresponding authorization scope for each basic dimension under the authorization system, it is not closely integrated with the different specific application scenarios under the authorization system, therefore, there may be a conflict between configuring the corresponding authorization scope for each basic dimension under the authorization system and the multiple authorization scopes under the target authorization dimension of each target role group to which the requester belongs, that is, the authorization scopes of the two are not exactly the same. At this time, considering that the multiple authorization scopes under the target authorization dimension of each target role group are closely integrated with the request document type under the specific business scenario, therefore, the intersection between the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system is selected to be determined as the authorization scope of the requester under the target authorization dimension.
[0082] In some specific implementations, before determining the authorization scope of the requesting party under the target authorization dimension based on multiple authorization scopes of each level of target role grouping under the target authorization dimension, the method of the embodiment of the present application also includes: in response to the control operation for each level of target role grouping under the authorization system, displaying the target authorization dimension associated with the request document type under the authorization system on the permission configuration page; for each level of target role grouping, obtaining the authorization scope of each basic dimension in the target authorization dimension input by the user; determining the authorization scope of each basic dimension in the target authorization dimension for any level of target role grouping as the authorization scope of the corresponding first-level target role group under the target authorization dimension.
[0083] Specifically, the authorization scope of each target role group under any authorization dimension in any authorization system can be configured by the method of the embodiment of the present application. In the authorization system faced by the embodiment of the present application, there will be at least one target role group, and a control operation can be initiated on a certain target role group when performing data permission configuration. In addition, in actual applications, there are a large number of documents in the business database to be configured with data access rights, and the authorization dimension usually corresponds to a specific document type, so the authority management personnel usually perform control operations for different document type matching. Taking the request document type as an example, the target authorization dimension associated with the request document type is displayed on the permission configuration page, and then the user can enter the authorization scope of each basic dimension in the target authorization dimension for each target role group through the displayed content. Finally, the union of the authorization scope of each basic dimension in the target authorization dimension of any level of target role group is used as the authorization scope of the corresponding first-level target role group under the target authorization dimension.
[0084] On the basis of the aforementioned embodiment, in actual applications, the business data in the business database is stored in columns, and the authorization scope of the requesting party under the target authorization dimension includes the authorization scope of each basic dimension in the target authorization dimension. The aforementioned step 203 includes: for each basic dimension included in the target authorization dimension, based on the authorization scope of the basic dimension in the target authorization dimension, and the data in the data column corresponding to the basic dimension in the business database, determining the preliminary screening business data; based on the preliminary screening business data corresponding to each basic dimension included in the target authorization dimension, determining the target business data.
[0085] Specifically, in existing data control schemes, business data all adopts a row storage structure, which means that when parsing single-column data, all fields in all rows need to be traversed. The embodiment of the present application enables business data in a business database to be stored in columns, so that when filtering business data based on each basic dimension, all preliminary screening business data that meets the requirements can be extracted from the data column corresponding to the basic dimension at one time, reducing the time loss caused by row parsing, and in scenarios with large amounts of data, data acquisition efficiency can be greatly improved.
[0086] On the basis of the foregoing embodiments, in some specific implementations, the various information relied on by the embodiments of the present application in the process of querying the target business data can be divided into two parts for storage: authorization settings and permission settings, and the storage container can be any type of database. The authorization settings record the authorization system, basic dimensions, authorization dimensions under different business scenarios, and role groups, etc., while the permission settings record the authorization scopes of different basic dimensions, the authorization scopes of different authorization dimensions in different business scenarios, and the authorization scopes of different role groups in different business scenarios in a certain authorization system. Specifically, when querying various information in the authorization settings, multi-dimensional bit operations can be used for fast hits, and various information in the permission settings can be stored in columns, so that the data parsing engine can parse and process complex authorization scopes more efficiently.
[0087] In actual applications, a business system that deploys the data access permission management method and data access permission management framework of the embodiment of the present application can provide a unified permission interface to different requesting parties (i.e., different business applications), and process data access requests initiated by business applications through the unified permission interface, and return reply information containing corresponding business data to the corresponding business application.
[0088] In summary, the data access rights management and control framework provided in the embodiment of the present application can be compatible with the control of data access rights required for different businesses or different business scenarios. The data access rights management and control of multiple businesses are realized through a set of statistical data access rights management and control frameworks, which reduces the user's learning cost and can flexibly adapt and expand different business scenarios. Secondly, the present application provides multi-level authorization scope control such as basic dimension layer, business scenario layer and role grouping layer, that is, the business data visible to the user is jointly determined according to the authorization scope of the role group to which the user currently belongs, the authorization scope of the current business scenario and the authorization scope of the adopted authorization dimension. This multi-level authorization design can better support various complex business scenarios and reduce the difficulty of management and control. Then, a data parsing engine is used to parse and read the authorization dimension, authorization scope and business data, and a column storage structure is introduced to greatly reduce the performance bottleneck of data parsing.
[0089] See also Figure 3 According to a second aspect of an embodiment of the present application, a computer device is provided, including:
[0090] An acquisition unit 301 is used to acquire a data access request initiated by a business application, where the data access request has a corresponding requester and a request document type;
[0091] The determining unit 302 is used to determine the authorization system to which the business application belongs, and to search for the target authorization dimension associated with the request document type under the authorization system, and to obtain the authorization scope of the requester under the target authorization dimension, where the target authorization dimension is determined based on the business field included in the corresponding request document type;
[0092] A search unit 303 is used to search for target business data from a business database of a business application based on the authorization scope of the requester under the target authorization dimension;
[0093] The reply unit 304 is configured to use the target business data as reply information corresponding to the data access request.
[0094] In a specific implementation, before determining the authorization system to which the business application belongs,
[0095] The acquisition unit 301 is further used to acquire multiple basic dimensions in the authorization system, where the multiple basic dimensions include preset dimensions and / or user-defined dimensions, and the basic dimensions are determined based on business fields included in the corresponding request document type;
[0096] The acquisition unit 301 is further used to acquire a target authorization dimension associated with the request document type determined based on the basic dimension, where the target authorization dimension includes any basic dimension.
[0097] In a specific implementation, the acquisition unit 301 is specifically used to acquire at least one first-level target role group to which the requesting party belongs;
[0098] Based on multiple authorization scopes of each level of target role grouping under the target authorization dimension, the authorization scope of the requester under the target authorization dimension is determined.
[0099] In a specific implementation, the determination unit 302 is specifically configured to determine each basic dimension in the target authorization dimension as a target basic dimension, and obtain a basic authorization scope of each target basic dimension under the authorization system;
[0100] The intersection of multiple authorization scopes under the target authorization dimension is grouped into target roles at each level to determine the estimated authorization scope of the requesting party;
[0101] The intersection of the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system is determined as the authorization scope of the requesting party under the target authorization dimension.
[0102] In a specific implementation, before determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension for each level of target role grouping, the computer device further includes: a display unit;
[0103] A display unit, for responding to the control operation for each level of target role group under the authorization system, and displaying the target authorization dimension associated with the request document type under the authorization system on the authority configuration page;
[0104] The acquisition unit 301 is further used to acquire, for each level of target role grouping, the authorization scope of each basic dimension in the target authorization dimension input by the user;
[0105] The determination unit 302 is further configured to determine the authorization scope of each basic dimension of any first-level target role group in the target authorization dimension as the authorization scope of the corresponding first-level target role group under the target authorization dimension.
[0106] In a specific implementation, the business data in the business database is stored in a columnar manner, the authorization scope of the requesting party under the target authorization dimension includes the authorization scope of each basic dimension in the target authorization dimension, and the search unit 303 is specifically used to determine the preliminary screening business data for each basic dimension included in the target authorization dimension based on the authorization scope of the basic dimension in the target authorization dimension and the data in the data column corresponding to the basic dimension in the business database;
[0107] Based on the initially screened business data corresponding to each basic dimension included in the target authorization dimension, the target business data is determined.
[0108] Figure 4 It is a schematic diagram of a computer device structure provided in an embodiment of the present application. The computer device 400 may include one or more central processing units (CPU) 401 and a memory 405. The memory 405 stores one or more application programs or data.
[0109] The memory 405 may be a volatile storage or a persistent storage. The program stored in the memory 405 may include one or more modules, each of which may include a series of instruction operations in the computer device. Furthermore, the central processor 401 may be configured to communicate with the memory 405 and execute a series of instruction operations in the memory 405 on the computer device 400.
[0110] The computer device 400 may also include one or more power supplies 402, one or more wired or wireless network interfaces 403, one or more input and output interfaces 404, and / or one or more operating systems, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.
[0111] The CPU 401 can execute the aforementioned Figures 1 to 3 The operations performed by the computer device in the illustrated embodiment will not be described in detail here.
[0112] It should be noted that, although the steps in the flowcharts involved in the embodiments are drawn in sequence according to the instructions of the arrows, unless otherwise clearly stated in this document, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0113] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.
[0114] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.
[0115] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0116] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.
[0118] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the data access rights management method as described above.
Claims
1. A method for controlling data access rights, characterized in that: include: Obtaining a data access request initiated by a business application, wherein the data access request has a corresponding requesting party and a request document type; Determine the authorization system to which the business application belongs, and search for the target authorization dimension associated with the request document type under the authorization system, and obtain the authorization scope of the requester under the target authorization dimension, where the target authorization dimension is determined based on the business field included in the corresponding request document type; Based on the authorization scope of the requesting party under the target authorization dimension, searching for target business data from a business database of the business application; The target business data is used as reply information corresponding to the data access request.
2. The method according to claim 1, characterized in that Before determining the authorization system to which the business application belongs, the method further includes: Acquire multiple basic dimensions in the authorization system, where the multiple basic dimensions include preset dimensions and / or custom dimensions, and the basic dimensions are determined based on business fields included in the corresponding request document type; A target authorization dimension associated with the request document type determined based on the basic dimension is obtained, where the target authorization dimension includes any of the basic dimensions.
3. The method according to claim 2, characterized in that The obtaining the authorization scope of the requesting party under the target authorization dimension includes: Obtaining at least one first-level target role group to which the requesting party belongs; Based on a plurality of authorization scopes of each level of the target role group under the target authorization dimension, the authorization scope of the requester under the target authorization dimension is determined.
4. The method according to claim 3, characterized in that The determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension of each level of the target role grouping includes: Determine each of the basic dimensions in the target authorization dimension as a target basic dimension, and obtain a basic authorization scope of each of the target basic dimensions under the authorization system; Grouping the target role at each level into an intersection of multiple authorization scopes under the target authorization dimension, and determining the estimated authorization scope of the requesting party; The intersection between the estimated authorization scope and the basic authorization scope of each target basic dimension under the authorization system is determined as the authorization scope of the requesting party under the target authorization dimension.
5. The method according to claim 3, characterized in that: Before determining the authorization scope of the requester under the target authorization dimension based on the multiple authorization scopes under the target authorization dimension grouped according to each level of the target role, the method further includes: In response to the control operation for each level of the target role group under the authorization system, the target authorization dimension associated with the request document type under the authorization system is displayed on the authority configuration page; For each level of the target role group, obtaining the authorization scope of each basic dimension in the target authorization dimension input by the user; The target role groups at any level are grouped, and the authorization scope of each basic dimension in the target authorization dimension is determined as the authorization scope of the target role group at the corresponding level under the target authorization dimension.
6. The method according to claim 3, characterized in that The business data in the business database are stored in a columnar manner, the authorization scope of the requester under the target authorization dimension includes the authorization scope of each of the basic dimensions in the target authorization dimension, and searching the business database of the business application for target business data based on the authorization scope of the requester under the target authorization dimension includes: For each of the basic dimensions included in the target authorization dimension, based on the authorization scope of the basic dimension in the target authorization dimension and the data in the data column corresponding to the basic dimension in the business database, determine the initial screening business data; The target business data is determined based on the initially screened business data corresponding to each of the basic dimensions included in the target authorization dimension.
7. A computer device, characterized in that: include: An acquisition unit, used to acquire a data access request initiated by a business application, wherein the data access request has a corresponding requester and a request document type; a determining unit, configured to determine the authorization system to which the business application belongs, and to search for a target authorization dimension associated with the request document type under the authorization system, and to obtain an authorization scope of the requesting party under the target authorization dimension, wherein the target authorization dimension is determined based on a business field included in the corresponding request document type; A searching unit, configured to search for target business data from a business database of the business application based on an authorization scope of the requesting party under the target authorization dimension; The reply unit is used to use the target business data as reply information corresponding to the data access request.
8. A computer device, characterized in that: include: CPU, memory and input / output interface; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 6.
9. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.
10. A computer storage medium, characterized in that: The computer storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.