Permission management method and system of PLM system

Abstract

The invention discloses an authority management method and system of a PLM system. Distributing identity information of the user in the PLM system according to the user role and the project in which the user participates; and according to the identity information of the user and the security dimension label of each product data object, determining the authority of the user to each product data object, and distributing the access and / or operation authority of each product data object to the user by the PLM system according to the authority. According to the invention, accurate control of the data authority is realized by replacing a role management mode with an environment context background management mode, the system operation authority of each user is ensured to be controlled within the own service range, and the shareability, confidentiality and security of product data are ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of project authority management, and in particular relates to an authority management method and system for a PLM system. Background Art

[0002] There are various data types and formats in the PLM (Product Lifecycle Management) system, and there are also various types of users who provide and use these data. The function of the product data system is to regularly manage the corresponding data usage rights of various users, and grant different access and operation rights to various users, so that various users can access the data they need and operate these data.

[0003] Traditional PLM systems all use role control methods to implement data access and operation permissions, such as Figure 2 As shown in the figure. As the division of labor in PLM product data becomes more and more refined, more and more professional, and the number of vehicle models increases, the partners and cooperation methods are also diverse, but the project development progress requirements are getting higher and higher. Relying solely on roles to allocate access and operation permissions for product system data will lead to more "overstepping" behaviors: content that should not be seen is seen, objects that should not be operated are operated, and it may be impossible to track who operated it. This is a very serious problem for the PLM system, which is specifically manifested in the following aspects:

[0004] (1) Product data security

[0005] The traditional role permission control method of product information system can only control the interface function menu and interface function button operation, and cannot accurately restrict data permissions. For example, in our current system, a professional designer can see the objects of all designers and modify the objects of other professional designers, such as the body designer can see and modify the product data of the chassis. Similarly, the designer of one project can modify the product data of another project.

[0006] This problem is not so obvious when the amount of data in the product system is small, but as the amount of data in the product system increases, if data security issues are not controlled, they may cause major technical or quality accidents.

[0007] (2) Product data security and availability

[0008] Using traditional function menu and function button control, each component requires a set of role permission configuration management, which is repetitive and error-prone. For example, the user roles in a company's product management system and product design system need to be managed separately.

[0009] Under normal circumstances, the users used by two related systems may be different, but most of the product data runs through the two systems. Product data information needs to interact, and role authorization will be carried out separately in the two systems. There are differences and consistencies in the roles of the two systems. For example, the product management system has the roles of product designer, approver, queryer, and product data engineer, but the product design system only has the roles of designer, queryer, DMU engineer, etc. The inconsistency of roles between systems will bring about a series of system application disorders due to the complexity of authorization management and product data availability, etc., which may lead to system failure in severe cases. Summary of the invention

[0010] In order to solve the problem that product data in the system is accessed by other irrelevant personnel or even modified by mistake and the problem of product data availability for multiple systems and multiple roles, the present invention proposes a permission management method and system for a PLM system.

[0011] A method for managing rights of a PLM system to achieve one of the objectives of the present invention includes:

[0012] Assigning identity information of users in the PLM system according to user roles and projects in which users participate; the identity information includes: user roles and security dimensions of users;

[0013] Determine the user's authority over each product data object based on the user's identity information and the security dimension label of each product data object, and the PLM system assigns the user access and / or operation authority for each product data object based on the authority;

[0014] The security dimension of the user includes the project involved by the user and / or the organization where the project involved by the user is located;

[0015] The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

[0016] Furthermore, the method for allocating identity information of a user in a PLM system includes:

[0017] Establish a security dimension matrix for product data, where each product data corresponds to a security dimension label consisting of a project and the organization to which the project belongs; the security dimension matrix is ​​used to control user access rights to data;

[0018] Adding user roles to the security dimension matrix to obtain the user's environmental context; the user role is used to control the user's operation authority over the data;

[0019] The environmental context is distributed to each user according to business needs as the user's identity information in the PLM system.

[0020] Furthermore, the method for determining the access rights of the user to each product data object includes:

[0021] Users log into the PLM system with the context of the environment;

[0022] When the security dimension tag of the product data object matches the environmental context background carried by the user, the user can access the product data;

[0023] The methods for determining compliance include:

[0024] The level of the organization and / or project in the user's environmental context is greater than or equal to the level of the organization and / or project to which the product data object to be accessed belongs.

[0025] Furthermore, the method for determining the operation authority of the user in the authority of each product data object includes:

[0026] Users log into the PLM system with the context of the environment;

[0027] When the security dimension label of a product data object matches the environmental context carried by the user, and the user role matches the product data object, the user can operate the product data object.

[0028] Furthermore, the matching determination method includes:

[0029] When the role in the user's environmental context matches the development progress of the product data object, the user can operate on the product data object.

[0030] Furthermore, when the role in the user's environmental context is the first role, and the development progress of the product data object includes: in progress or released, the user is considered to match the product data object;

[0031] When the role in the user's environmental context is the first role, and the development progress of the product data object includes: frozen or pending approval, it is considered that the user does not match the product data object.

[0032] If the development progress of a product data object is in the "Work in Progress" status, it means that the product data object is in the stage of active development, modification or testing. At this stage, the development team or relevant users can create, edit, update, test or other related work on the product data object; the product data object may contain incomplete or unverified information and may change frequently.

[0033] The development progress of a product data object is in the "Release" state, which means that the product data object has completed all necessary development, testing, and verification work and has been officially released or delivered to end users or customers. At this stage, the product data object is generally considered stable and complete, and no large-scale modifications are made.

[0034] The development progress of the product data object is in a "frozen" state, which means that the product data object has been locked for some reason (such as the upcoming release of a new version, maintenance, etc.), and no modification or update is allowed; at this stage, the product data object is protected to prevent accidental or unauthorized changes.

[0035] The development progress of a product data object is in the "pending approval" state, which means that the product data object has been developed or modified, but has not yet gone through the necessary approval process, so it has not yet been officially released or delivered for use. At this stage, the product data object may still need to go through internal review, compliance checks, or other approval steps.

[0036] When the role in the user's environment context is the first role, the user can perform a first operation on a product data object whose development progress is in progress; the first operation includes modification, version upgrade or deletion; the user can perform a second operation on a product data object whose development progress is in release, the second operation includes cloning and version upgrade;

[0037] When the role in the user's environment context is the first role, the user cannot perform any operations on product data objects whose maturity is frozen or pending approval.

[0038] The first roles include: roles involved in project design, project development, project acceptance, and project release processes; such as designer roles.

[0039] The rights management system of the PLM system for achieving the second objective of the present invention includes:

[0040] Allocation module: used to allocate user identity information in the PLM system according to user roles and projects in which users participate; the identity information includes: user roles and user security dimensions;

[0041] Permission determination module: used to determine the user's permission for each product data object based on the user's identity information and the security dimension label of each product data object. The PLM system allocates access and / or operation permissions for each product data object to the user based on the permissions;

[0042] The security dimension of the user includes the project involved by the user and / or the organization where the project involved by the user is located;

[0043] The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

[0044] The present invention uses an environment context management method instead of a role management method to achieve precise control of data permissions, which brings the following beneficial effects:

[0045] 1. Sharing and confidentiality: By managing access rights through Context, you can more accurately control each user in the relevant product information system to see the product data they should see and not see the data they should not see, thus ensuring the sharing and confidentiality of product data.

[0046] 2. Accurate operation permissions: Context management of operation permissions ensures that each user's system operation permissions are controlled within their business scope, ensuring the security of product data.

[0047] 3. Accurately budget the number of system licenses: By uniformly authorizing and managing Context permissions and tracking the actual use of Context, combined with the number of future running projects and the number of people involved in the projects, it is very convenient to calculate the number of system licenses required for procurement in the next few years and save license fees. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a schematic diagram of the process of the method of the present invention;

[0049] Figure 2 This is a schematic diagram of a traditional PLM system;

[0050] Figure 3 It is a schematic diagram of a matrix organizational structure;

[0051] Figure 4 It is a schematic diagram for determining the user's product data access rights;

[0052] Figure 5 It is a schematic diagram for determining the user's product data operation authority;

[0053] Figure 6 It is a schematic diagram of determining the operation authority of parts according to the user context;

[0054] Figure 7 This is a conceptual diagram of a multi-product system. DETAILED DESCRIPTION

[0055] The following specific implementations are used to explain the technical solutions of the claims of the present invention so that those skilled in the art can understand the claims. The protection scope of the present invention is not limited to the following specific implementation structures. The technical solutions of the claims of the present invention made by those skilled in the art but different from the following specific implementations are also within the protection scope of the present invention.

[0056] Example 1

[0057] A permission management method for a PLM system, such as Figure 1 As shown, including:

[0058] S1. Assigning identity information of users in the PLM system according to user roles and projects in which users participate; the identity information includes: user roles and security dimensions of users;

[0059] User roles can be divided into different roles such as system administrator, project manager, designer, engineer, quality personnel, purchaser, etc., and detailed responsibilities and authority ranges can be set for each role;

[0060] According to business needs, user roles can be further subdivided, such as senior designer, junior engineer, etc., to control permissions more accurately. In addition to internal organizations (such as R&D, production, sales, etc.), external organizations such as partner organizations, outsourced organizations, and supplier organizations are also included. Set a unique organization ID for each organization and clarify its data access scope and permission level in the PLM system.

[0061] At the same time, a project ID is set for each project and associated with a specific organization.

[0062] Project authority is further subdivided according to project stages (such as conceptual design, detailed design, production preparation, production implementation, etc.) and project types (such as new product development, improvement projects, etc.).

[0063] Each user is assigned unique identity information based on their role, organization, and project, including user ID, role ID, organization ID, and project ID. Identity information should be updated regularly to ensure consistency with the user's actual responsibilities and permissions. Details are as follows:

[0064] In some embodiments, a method for assigning identity information of a user in a PLM system includes:

[0065] Establish a security dimension matrix for product data, where each product data corresponds to a security dimension label consisting of a project and the organization to which the project belongs; the security dimension matrix is ​​used to control user access rights to data;

[0066] Adding user roles to the security dimension matrix to obtain the user's environmental context; the user role is used to control the user's operation authority over the data;

[0067] The environmental context is distributed to each user according to business needs as the user's identity information in the PLM system.

[0068] In some embodiments, a method for assigning identity information of a user in a PLM system includes:

[0069] Establish a two-dimensional security matrix for product data: organization + project, forming the core elements of data authority control, such as Figure 3 As shown, a role dimension is added to the two-dimensional security matrix to form a complete environmental context background for logging into the product system. The environmental context background in this embodiment is: Context = role + organization + project, wherein the organization dimension and the project dimension are used for data permission control, and the role dimension is used for operation permission control. The three are combined to form the environmental context background for logging into the product system, which is independently packaged and distributed to different account users according to business needs.

[0070] S2. Determine the user's authority over each product data object based on the user's identity information and the security dimension label of each product data object, and the PLM system assigns the user access and / or operation authority for each product data object based on the authority;

[0071] The security dimension of the user includes the project involved by the user and / or the organization where the project involved by the user is located;

[0072] The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

[0073] In some embodiments, the method of determining the access rights of the user to each product data object includes:

[0074] Users log into the PLM system with the context of the environment;

[0075] When the security dimension tag of the product data object matches the environmental context background carried by the user, the user can access the product data;

[0076] The methods for determining compliance include:

[0077] The level of the organization and / or project in the user's environmental context is greater than or equal to the level of the organization and / or project to which the product data object to be accessed belongs; the level is defined according to the actual project, for example, the level sizes of the following four organizations are set in the order of: horizontal > electrical > chassis > power; the present invention does not limit this and is set based on the actual situation of the project.

[0078] In some embodiments, the method of determining the access rights of the user to each product data object includes:

[0079] In some embodiments, after a user logs into the product system with the context of the environment (i.e., Context), the created product data is automatically labeled with the security dimension label in the user's Context, i.e., organization + project. All product data in the system carries the user account and security dimension attributes. After other users log into the system with their own Context, the system automatically calculates the product data access rights of the user, and the algorithm is as follows: Figure 4 As shown in the figure, the product data access function f(x, y) is determined according to the company's business needs; determine whether the adaptation of the product data object security dimension label and the environmental context background of the login system account meets the requirements. If so, the account can access the data, otherwise it cannot. For example, set the organizational permission rule: horizontal> electrical> chassis> power. If the level of "organization" in the security dimension label of the login account is >= a certain product data organization, the account can access the product data. Therefore, if the "organization" in the security dimension label of the logged-in account is the chassis organization, the account can access the product data organized as "chassis" and "power", but cannot access the product data of "horizontal" and "electrical". Similarly, you can also define rules for projects, or define them using the relationship of organization + project. In short, the specific definition requirements are finally determined according to the business needs of the company itself.

[0080] At the same time, "organization" can also be extended to the company's partner organizations, outsourced organizations, supplier organizations, etc. By formulating the organization's data access strategy, the scope of access to data by each external company can be accurately controlled.

[0081] S3. Determine the operation authority control mode of the product data object

[0082] Based on the strategy pattern and state pattern in the methodology "Design Patterns - Foundations of Reusable Object-Oriented Software", the state pattern allows an object to change its behavior when its internal state changes; define a series of algorithms, encapsulate them one by one, and make them interchangeable. This pattern allows the algorithm to change independently of the clients who use it.

[0083] In some embodiments, the method for determining the operation rights of the user in the rights for each product data object includes:

[0084] Users log into the PLM system with the context of the environment;

[0085] When the security dimension label of the product data object matches the environmental context of the user, and the user role matches the product data object, the user can operate the product data object. The matching judgment method includes:

[0086] When the role in the user's environmental context matches the development progress of the product data object, the user can operate on the product data object.

[0087] When the role in the user's environmental context is the first role, and the development progress of the product data object includes: in progress or released, the user is considered to match the product data object;

[0088] When the role in the user's environmental context is the first role, and the development progress of the product data object includes: frozen or pending approval, it is considered that the user does not match the product data object.

[0089] When the role in the user's environment context is the first role, the user can perform a first operation on a product data object whose development progress is in progress; the first operation includes modification, version upgrade or deletion; the user can perform a second operation on a product data object whose development progress is in release, the second operation includes cloning and version upgrade;

[0090] When the role in the user's environment context is the first role, the user cannot perform any operations on product data objects whose maturity is frozen or pending approval.

[0091] The first role is a role involved in the project design, project development, project acceptance, and project release processes.

[0092] In certain embodiments, such as Figure 5 The product data operation function g(x, y) receives the security dimension label of the product data object and the environmental context information of the login person and then calculates the operation authority of the product data object for the login person. For example, Figure 6 As shown. Figure 6 It can be seen that under the constraints of the part maturity strategy, through simple calculation, user 0011 has obtained the operation permissions of modifying, upgrading, and deleting part 1, the operation permissions of cloning and upgrading part 2, and has no operation permissions for part 3.

[0093] Of course, the product data operation function g(x, y) can be based on the company's actual business needs, taking into account other contexts (other roles, other organizations, and other projects) of logging into the product system and the security dimension attributes of the target product data, and establishing a more detailed control algorithm to ensure that any user has the corresponding correct operation permissions for all data in the system.

[0094] At the same time, the organization can also be expanded to the company's partner organizations, outsourced organizations, supplier organizations, etc. By formulating the organization's data access strategy, the scope of each external company's data operations can be accurately controlled.

[0095] Traditional product information systems are generally composed of two basic systems: PDM + CAD, and the authority management is relatively simple. However, in the future, due to the need for collaborative work, multiple systems such as CAE and CAPP will be added. The same data will flow in multiple systems, and the authority management needs to consider a simpler and more convenient way to centrally manage various users, such as the attached Figure 7 As shown in the figure: Each user has different responsibilities in each system, so he always has his own Context. Since the Context is independently encapsulated, the Context is always associated with the account. The Context is also adapted to each PLM system, so the Context of each PLM system logged in by the same account is the same. You only need to select the Context of the corresponding PLM system to log in to the corresponding PLM system. There is no need to develop various Contexts for each PLM system separately, which is very convenient for users to use. The Context of the PLM system is created and cancelled uniformly by the administrator. According to business needs, the administrator assigns these Contexts to different user accounts, and the Context is associated with the license. In this way, by counting the number of various Contexts, the number of various system licenses required can be estimated, and by counting the number of Contexts actually used, the actual number of licenses used can be calculated, so as to more accurately purchase the appropriate number of licenses.

[0096] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0097] Example 2

[0098] A rights management system for a PLM system, comprising:

[0099] Allocation module: used to allocate user identity information in the PLM system according to user roles and projects in which users participate; the identity information includes: user roles and user security dimensions;

[0100] Permission determination module: used to determine the user's permission for each product data object based on the user's identity information and the security dimension label of each product data object. The PLM system allocates access and / or operation permissions for each product data object to the user based on the permissions;

[0101] The security dimension of the user includes the project involved by the user and / or the organization where the project involved by the user is located;

[0102] The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

[0103] Example 3

[0104] A non-transitory computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the various steps of the method described in the present invention are implemented, which will not be repeated here.

[0105] The computer-readable storage medium may be the data transmission device provided in any of the aforementioned embodiments or the internal storage unit of the computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (smartmedia card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc., provided on the computer device.

[0106] Furthermore, the computer-readable storage medium may include both an internal storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data to be output or has been output.

[0107] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0108] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0111] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0112] Example 4

[0113] A computer program product includes a computer program / instruction, which implements any step of the rights management method of the PLM system when executed by a processor.

Claims

1. A method for managing rights of a PLM system, characterized in that: include: Assign user identity information in the PLM system based on user roles and the projects in which the user is involved; Determine the user's authority over each product data object based on the user's identity information and the security dimension label of each product data object, and the PLM system assigns the user access and / or operation authority for each product data object based on the authority; The identity information includes the projects involved by the user and / or the organization to which the projects involved by the user belong; The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

2. The method for managing the rights of a PLM system according to claim 1, characterized in that: Methods for assigning user identity information in the PLM system include: Establishing a security dimension matrix for product data, wherein the security dimension matrix is ​​used to control user access rights to data; Adding user roles to the security dimension matrix to obtain the user's environmental context; the user role is used to control the user's operation authority over the data; The environmental context is distributed to each user as the user's identity information in the PLM system.

3. The method for managing the rights of a PLM system according to claim 2, characterized in that: The method for determining the access rights of the user to each product data object includes: The user logs into the PLM system with the environmental context; When the security dimension tag of the product data object matches the environmental context background carried by the user, the user can access the product data; The methods for determining compliance include: The level of the organization and / or project in the user's environmental context is greater than or equal to the level of the organization and / or project to which the product data object to be accessed belongs.

4. The method for managing the rights of a PLM system according to claim 2, wherein: The method for determining the operation rights of the user in the rights for each product data object includes: Users log into the PLM system with the context of the environment; When the security dimension label of a product data object matches the environmental context carried by the user, and the user role matches the product data object, the user can operate the product data object.

5. The method for managing the rights of a PLM system according to claim 4, characterized in that: Methods for determining whether a user role matches a product data object include: When the role in the user's environmental context matches the development progress of the product data object, the user can operate on the product data object.

6. The method for managing the rights of a PLM system according to claim 5, characterized in that: When the role in the user's environmental context is the first role, and the development progress of the product data object includes: in progress or released, the user is considered to match the product data object; When the role in the user's environmental context is the first role, and the development progress of the product data object includes: frozen or pending approval, it is considered that the user does not match the product data object.

7. The method for managing the rights of a PLM system according to claim 6, wherein: When the role in the user's environmental context is the first role, the user can perform a first operation on a product data object whose development progress is working; the first operation includes modification, version upgrade or deletion; the user can perform a second operation on a product data object whose development progress is releasing, and the second operation includes cloning and version upgrade.

8. A rights management system for a PLM system for implementing the method according to claim 1, characterized in that: include: Allocation module: used to allocate user identity information in the PLM system according to user roles and projects in which users participate; The identity information includes: user role, user security dimension; Permission determination module: used to determine the user's permission for each product data object based on the user's identity information and the security dimension label of each product data object. The PLM system allocates access and / or operation permissions for each product data object to the user based on the permissions; The security dimension of the user includes the project involved by the user and / or the organization where the project involved by the user is located; The security dimension tag of the product data object includes the project and / or the organization to which the project belongs.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for managing rights of a PLM system according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, any step of the rights management method of the PLM system according to claims 1 to 7 is implemented.

Images