Permission cross-system management method and system

Abstract

The invention belongs to the technical field of authority management. The invention provides an authority cross-system management method and system. The method comprises the following steps: a subsystem management module is communicated with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; the menu management module receives each menu and button information, generates a comprehensive authority management interface based on each menu and button information, and receives an authority management action of an administrator on the comprehensive authority management interface; the role management module generates a user role based on the authority management action of the administrator, the generated user role relates to authority configuration information of the plurality of authority management subsystems, and the subsystem management module sends the authority configuration information to the corresponding authority management subsystems. According to the scheme of the invention, the administrator can conveniently carry out cross-system permission configuration.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a cross-system authority management method and system thereof. Background Art

[0002] At present, most enterprises have multiple information systems, each with its own permission management mechanism. This model has the following main disadvantages: 1. Decentralized authority management leads to inefficiency. Each system often has its own authority control mechanism, which requires IT management departments to independently create user accounts, allocate and adjust authority on multiple platforms. This is not only time-consuming and labor-intensive, but also prone to confusion in authority or security vulnerabilities due to human operational errors.

[0003] 2. The problem of inconsistent permissions is prominent. Due to the lack of a unified permission management system, there may be differences in the definition of permissions for similar positions or responsibilities between different systems, resulting in different operating experiences for employees between different systems, and even affecting the continuity of business processes and data consistency.

[0004] 3. Difficulty in authority review and tracing. Authority changes in a multi-system environment are frequent and complex. The lack of a centralized audit function makes it extremely difficult to track authority change history and analyze abnormal access behaviors, increasing compliance risks and internal security threats.

[0005] 4. Role and permission mapping is complex. With the changes in organizational structure and personnel turnover, how to quickly and accurately map organizational roles to specific permissions in each system has become a major problem, which often requires a lot of manual adjustments, affecting the speed at which enterprises respond to market changes.

[0006] 5. Rising training and support costs. Multiple systems mean that employees need to master multiple operating interfaces and permission rules, which increases the training burden, reduces work efficiency, and also brings greater pressure to the IT support team.

[0007] It can be seen that how to achieve more convenient and efficient cross-system permission management is a technical problem that needs to be solved urgently. Summary of the invention

[0008] In this regard, the present invention provides a cross-system management method, system, electronic device, computer storage medium and computer program product for permissions to solve the above technical problems.

[0009] The present invention discloses a cross-system management method for permissions, the method comprising the following steps: The subsystem management module communicates with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module receives the menu and button information, generates a comprehensive authority management interface based on the menu and button information, and receives the authority management action of the administrator on the comprehensive authority management interface; The role management module generates a user role based on the permission management action of the administrator. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

[0010] In some embodiments, the permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

[0011] In some embodiments, the role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

[0012] In some embodiments, the method further comprises: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

[0013] In some embodiments, obtaining the historical information of the user's permission configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

[0014] The embodiment of the present invention also discloses a cross-system management system of permissions, the system comprising a subsystem management module, a menu management module, and a role management module; The subsystem management module is used to communicate with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module is used to receive the menu and button information, generate a comprehensive authority management interface based on the menu and button information, and receive the authority management actions of the administrator on the comprehensive authority management interface; The role management module is used to generate a user role based on the administrator's permission management action. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

[0015] In some embodiments, the permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

[0016] In some embodiments, the role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

[0017] In some embodiments, the role management module is further configured to: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

[0018] In some embodiments, obtaining the historical information of the user's permission configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

[0019] The present invention also discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method described in any of the preceding items.

[0020] The present invention also discloses a computer storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above methods.

[0021] The present invention also discloses a computer program product. When the computer program product is run on a terminal, the terminal implements any of the above methods when executing the computer program product.

[0022] The beneficial effects of the present invention are: The solution of the present invention does not require different administrators to configure permissions for specific users in each permission management subsystem. Instead, operations can be performed on the comprehensive permission management interface of the unified permission management system to configure specific permissions for the specific user in multiple permission management subsystems, and then the configured permissions are fed back to the corresponding permission management subsystems one by one, thereby achieving efficient cross-system permission configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a flowchart of a cross-system management method of permissions disclosed in an embodiment of the present invention; Figure 2 is a schematic diagram of a comprehensive authority management interface disclosed in an embodiment of the present invention; Figure 3 It is a schematic diagram of the structure of a cross-system management system of permissions disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following is a description of the implementation of the present application by specific specific embodiments. People familiar with the technology can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0026] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0027] like Figure 1 As shown, an embodiment of the present invention discloses a cross-system management method for permissions, the method comprising the following steps: The subsystem management module communicates with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module receives the menu and button information, generates a comprehensive authority management interface based on the menu and button information, and receives the authority management action of the administrator on the comprehensive authority management interface; The role management module generates a user role based on the permission management action of the administrator. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

[0028] The present invention constructs a unified permission management system, which mainly includes a subsystem management module, a menu management module, and a role management module. First, the subsystem management module can receive permission association information, menu and button information of each permission management subsystem that needs to be integrated and managed, and the menu management module can realize the generation and configuration of the comprehensive permission management interface of the unified permission management system based on the permission association information, menu and button information, and the generated comprehensive permission management interface contains sub-interfaces / plates, permission configuration buttons, etc. of multiple permission management subsystems; the administrator can perform permission management actions on the comprehensive permission management interface to complete the creation and maintenance of a certain user role, and the user role association configuration has permission configuration information involving multiple permission management subsystems that is suitable for the aforementioned permission management actions; finally, these permission configuration information are sent to the corresponding permission management subsystems respectively, and at this time, the specific user obtains the permissions in multiple permission management subsystems, so that the corresponding permission-related operations can be freely implemented when entering each permission management subsystem.

[0029] Therefore, the solution of the present invention does not require different administrators to configure permissions for specific users in each permission management subsystem. Instead, operations can be performed on the comprehensive permission management interface of the unified permission management system to configure specific permissions for the specific user in multiple permission management subsystems, and then the configured permissions are fed back to the corresponding permission management subsystems one by one, thereby achieving efficient cross-system permission configuration.

[0030] In some embodiments, the permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

[0031] In an embodiment of the present invention, each permission management subsystem will upload its own system name / ID, system key, and permission distribution URL address to the unified permission management system. The unified permission management system can specifically implement classified management of each permission management subsystem, and can also subsequently distribute permission configuration information through the permission distribution URL address, but it needs to be verified by the system key. Each permission management subsystem will also upload its own menu and button information to the unified permission management system, including the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID. Based on this information, the unified permission management system can know the applicable scope of each permission in the permission management subsystem, the nested relationship of permissions, etc., and can thereby implement the creation of the above-mentioned comprehensive permission management interface.

[0032] Generally speaking, the permission management subsystem only needs to upload the above information when the unified permission management system is initialized. However, if the permission-related information, menu and button information in each permission management subsystem changes, the above information also needs to be uploaded so that the unified permission management system can maintain the comprehensive permission management interface.

[0033] In some embodiments, the role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

[0034] In an embodiment of the present invention, the administrator first initiates a user role configuration request on the comprehensive authority management interface, and the unified authority management system assigns a user role to a specific user in response to the request. Next, the administrator clicks on the authority configuration sub-interfaces of the required multiple authority management subsystems on the comprehensive authority management interface in turn, selects a number of required authorities in the authority configuration interface, and clicks to confirm and submit. At this point, the unified authority management system can group the selected authority information into user roles according to the authority management subsystems to which they belong, that is, multiple authority groups are associated with the user role, each authority group corresponds to a authority management subsystem, and each authority group includes multiple authorities selected by the administrator.

[0035] In some embodiments, the method further comprises: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

[0036] In an embodiment of the present invention, when the number of displayed permission configuration sub-interfaces is too large, it is easy for the administrator to make operational errors. For example, the administrator originally wanted to configure the "core area access control" permission for the user in the permission configuration sub-interface B1 of the permission management subsystem A1, but due to accidental touch or other reasons, the permission configuration sub-interface B2 of the permission management subsystem A2 was actually opened, and the permission configuration sub-interface B2 also includes a button for configuring the "core area access control" permission for the user. At this time, the administrator is likely to mistakenly configure the user's permissions to the permission management subsystem A2.

[0037] Therefore, the present invention sets the number of displayed permission configuration sub-interfaces of the permission management subsystem in the comprehensive permission management interface to be dynamically adjusted. Specifically, based on the permission configuration history information of the user with configuration permission in a preset recent period (e.g., one year, six months), the first number of permission management subsystems involved in the user's single permission configuration and the number of permission configurations in the preset recent period can be extracted. For example, in the preset recent period, the administrator performed 3 permission configurations for the user. The first permission configuration involved 3 permission management subsystems, the second permission configuration involved 5 permission management subsystems, and the third permission configuration involved 4 permission management subsystems. Then, the average number of permission management subsystems involved in these three permission configurations is further calculated to be 4. Figure 2 As shown, four permission configuration sub-interfaces are set up and displayed in the comprehensive permission management interface.

[0038] According to the first number and the number of permission configurations obtained above, the second number of permission configuration sub-interfaces on the comprehensive permission management interface can be determined, that is, the display area on the comprehensive permission management interface that only displays the second number of permission configuration sub-interfaces is controlled, and each display area contains one permission configuration sub-interface. The administrator can click on the permission configuration sub-interface in each display area to activate it, and then select and configure the permissions in the activated permission configuration sub-interface. If the actual number of permission management subsystems involved in the permissions that the administrator needs to configure for the user this time exceeds the second number, then after completing the permission configuration operations in the second number of permission configuration sub-interfaces, the administrator can set one or more of the permission configuration sub-interfaces to a hidden state, so that a part of the display area can be in an "empty" state, that is, there is no permission configuration sub-interface to be activated; then, the administrator can retrieve other permission management subsystems that he needs to call them out to the "empty" display area, so that activation and permission configuration operations can be performed.

[0039] It should be noted that when the first number is larger and the number of times of permission configuration is larger, it indicates that the administrator has configured the permission of the user more frequently, and correspondingly, the configuration experience of the user is richer, and the second number can be set larger accordingly, that is, more permission configuration sub-interfaces are configured in the comprehensive permission management interface, which can reduce the number of outgoing operations of the administrator's permission configuration sub-interface, thereby improving the efficiency of its permission configuration. Conversely, fewer permission configuration sub-interfaces are configured in the comprehensive permission management interface, which can reduce the probability of permission configuration errors caused by administrators' misoperation and other reasons.

[0040] In addition, a comparison table may be pre-established, which includes a plurality of corresponding relationships between first quantity ranges, permission configuration number ranges, and second quantities, and the details are not repeated here.

[0041] In some embodiments, obtaining the historical information of the user's permission configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

[0042] In the embodiment of the present invention, since the unified rights management system includes multiple administrators, and different administrators have different times of rights configuration for the same user, which leads to different richness of their rights configuration experience for the user. Therefore, in order to ensure the accuracy of the above second number, the present invention is set to further obtain the identity information of the currently logged-in administrator, and only obtain the rights operation records performed by the administrator for the user, that is, the historical information of the user's rights configuration in a preset recent period.

[0043] like Figure 3 As shown, the embodiment of the present invention also discloses a cross-system management system of permissions, the system comprising a subsystem management module, a menu management module, and a role management module; The subsystem management module is used to communicate with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module is used to receive the menu and button information, generate a comprehensive authority management interface based on the menu and button information, and receive the authority management actions of the administrator on the comprehensive authority management interface; The role management module is used to generate a user role based on the administrator's permission management action. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

[0044] In some embodiments, the permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

[0045] In some embodiments, the role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

[0046] In some embodiments, the role management module is further configured to: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

[0047] In some embodiments, obtaining the historical information of the user's permission configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

[0048] An embodiment of the present invention further discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method described in the above embodiment.

[0049] An embodiment of the present invention further discloses a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is executed by a processor to implement the method described in the above embodiment.

[0050] The embodiment of the present invention further discloses a computer program product. When the computer program product is run on a terminal, the terminal implements the method described in the above embodiment.

[0051] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0052] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0053] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0054] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A cross-system management method for permissions, characterized in that , the method comprises the following steps: The subsystem management module communicates with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module receives the menu and button information, generates a comprehensive authority management interface based on the menu and button information, and receives the authority management action of the administrator on the comprehensive authority management interface; The role management module generates a user role based on the permission management action of the administrator. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

2. A cross-system management method for permissions according to claim 1, characterized in that: The permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

3. A cross-system management method for permissions according to claim 2, characterized in that: The role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

4. A cross-system management method for permissions according to claim 3, characterized in that: The method further comprises: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

5. A cross-system management method for permissions according to claim 4, characterized in that: The obtaining of the historical information of the user's authority configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

6. A cross-system management system for permissions, characterized in that The system includes a subsystem management module, a menu management module, and a role management module; The subsystem management module is used to communicate with each authority management subsystem to obtain authority association information, menu and button information of each authority management subsystem; The menu management module is used to receive the menu and button information, generate a comprehensive authority management interface based on the menu and button information, and receive the authority management actions of the administrator on the comprehensive authority management interface; The role management module is used to generate a user role based on the administrator's permission management action. The generated user role involves permission configuration information of multiple permission management subsystems. The subsystem management module sends the permission configuration information to the corresponding permission management subsystems respectively.

7. A cross-system management system for permissions according to claim 6, characterized in that: The permission association information includes the system name / ID of the permission management subsystem, the system key, and the URL address of the permission distribution; the menu and button information includes the menu route of the permission management subsystem, the menu unique ID, the ID of the permission management subsystem to which it belongs, and the association between the permission operation button and the menu route and the menu unique ID.

8. A cross-system management system for permissions according to claim 7, characterized in that: The role management module generates a user role based on the permission management action of the administrator, and the generated user role involves permission configuration information of multiple permission management subsystems, including: The role management module assigns a user role to a user in response to the administrator's user role application operation on the comprehensive authority management interface, identifies multiple permissions corresponding to the administrator's permission selection action on the comprehensive authority management interface, and groups the multiple permissions into the user role according to the permission management subsystem to which they belong.

9. A cross-system management system for permissions according to claim 8, characterized in that: The role management module is also used for: Acquire the historical information of the user's authority configuration in a preset recent period, wherein the historical information of the authority configuration includes a first number of the authority management subsystems involved in a single authority configuration of the user and the number of authority configurations; The second number of permission configuration sub-interfaces on the comprehensive permission management interface is determined based on the first number and the number of permission configuration times; wherein each of the permission configuration sub-interfaces corresponds to one of the permission management subsystems.

10. A cross-system management system for permissions according to claim 9, characterized in that: The obtaining of the historical information of the user's authority configuration within a preset recent period includes: The identity information of the currently logged-in administrator is determined, and the permission configuration history information of the user associated with the identity information within a preset recent period is obtained.

Images