Cross-platform authority unified management method and system based on multiple WEB systems

Abstract

The invention discloses a cross-platform authority unified management method and system based on a multi-WEB system, and the key point of the technical scheme is that the method comprises the steps: obtaining organization structure data of an enterprise system, analyzing the organization structure data, constructing a multi-level tree topology network, forming organization entity topology parameters, analyzing the organization entity topology parameters, and storing the analyzed organization entity topology parameters into a database; according to the scheme, post authority baseline parameters are generated, dynamic optimization of channel selection is achieved by constructing a dual-channel transmission decision maker and combining real-time network state data and an inter-system interaction characteristic score table, and compared with a traditional static configuration mode, the mechanism can achieve dynamic optimization of channel selection according to parameters such as department communication strength, system transmission performance and safety scores. According to the method, the optimal transmission path is automatically selected, network congestion or high-delay nodes are avoided, cross-system adaptation rules are generated through mapping calculation of an authority interface strategy and post authority baseline parameters, the problem of authority granularity difference between different systems is solved, and the accuracy and consistency of authority distribution are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of WEB systems, and particularly to a cross-platform permission unified management method and system based on multiple WEB systems. Background Art

[0002] In the process of enterprise informatization construction, with the diversified development of business, it is often necessary to deploy multiple independent WEB systems to meet the needs of different business scenarios. The permission control of a WEB system means that a user can only access resources with permissions. In a company where there are multiple WEB systems, permission control and management become particularly important and complex. Due to the unique business function requirements and user groups of each business system, it is necessary to independently maintain their respective permission models. When personnel permissions change, the operation and maintenance personnel of each system need to be notified to configure permission data.

[0003] Multiple independent WEB systems are mainly applied to medium and large-sized enterprises or group organizations with complex organizational structures and diversified business systems. Often, there are multi-level department divisions within these enterprises, frequent cross-departmental collaborations, and each business system is developed by different technical teams or purchased from different suppliers, with significant differences in technical architectures, permission models, and data formats. And for such enterprises in the use of multiple WEB systems, there is often an urgent need to solve the problem of unified management of permissions for multiple WEB systems.

[0004] In the existing multi-WEB system permission management technologies, static configuration methods or direct data synchronization are often adopted. When using static configuration, it is often impossible to dynamically adjust according to the real-time network status and the interaction characteristics between systems. And when directly performing data synchronization, the synchronization results are usually not verified, resulting in the situation that in both of these two methods, it is easy to have the situation that the permissions of some systems are not updated in a timely manner or updated incorrectly, leading to inconsistent permissions of users in different systems and affecting the normal progress of business operations. Summary of the Invention

[0005] Aiming at the deficiencies of the prior art, the present invention provides a cross-platform permission unified management method and system based on multiple WEB systems, which solves the above problems.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions: A cross-platform permission unified management method based on multiple WEB systems, the method includes: S1: Obtain the organizational structure data of the enterprise system, parse the organizational structure data, construct a multi-level tree-shaped topology network, and form organizational entity topology parameters; S2: Parse the organizational entity topology parameters to generate position permission baseline parameters; S3: Extract the API gateways of each WEB system to generate permission interface policies, calculate the baseline parameters of position permissions, and generate cross-system adaptation rule parameters; S4: Construct a dual-channel transmission decision maker based on the organizational structure data, the interaction characteristics between WEB systems, and the cross-system adaptation rule parameters, and generate channel selection decision parameters in combination with real-time network status data; S5: Trigger the synchronization engine to execute cross-system permission configuration based on the channel selection decision parameters, and at the same time generate timestamped permission propagation path parameters by associating the organizational entity topology parameters through the permission tracker; S6: Deploy a policy executor at the permission management terminals of each WEB system, and collect the permission effective status based on the timestamped permission propagation path parameters to generate distributed verification parameters; S7: Perform multimodal verification on the distributed verification parameters to generate global permission synchronization achievement identification parameters; S8: If the global permission synchronization achievement identification parameter is false, generate a compensation instruction queue, and generate permission panoramic situation parameters based on the compensation instruction queue.

[0007] Preferably, the obtaining of the organizational structure data of the enterprise system, the parsing of the organizational structure data, the construction of a multi-level tree topology network, and the formation of organizational entity topology parameters include: Perform standardization processing on the organizational structure data, where the organizational structure data includes: department identifier, name, parent department identifier, hierarchical code, and cross-system identifier; Extract the core fields from the organizational structure data, establish department subordination relationships, and generate cross-system mapping rules with department subordination relationships as the link; Starting from the root node of the organizational structure, recursively generate a multi-level tree network; Analyze the multi-level tree network to form organizational entity topology parameters describing the full-dimensional characteristics of the organization.

[0008] Preferably, the parsing of the organizational entity topology parameters to generate baseline parameters of position permissions includes: Parse the organizational entity topology parameters to establish initial position-permission association data; Integrate department subordination relationships and cross-system mapping rules to generate a position relationship network diagram with permission weights; Traverse the position relationship network diagram, calculate the position permission inheritance relationship layer by layer to form a complete permission set; Perform permission elimination on the complete permission set and perform matrix conversion on it to generate baseline parameters of position permissions.

[0009] Preferably, extracting the API gateways of each WEB system to generate permission interface policies, and calculating the baseline parameters of position permissions to generate cross-system adaptation rule parameters, including: Extracting the routing rules, authentication information, and permission control policies of the API gateways of each WEB system to generate preliminary permission interface policies; Using cross-system mapping rules to map and transform the preliminary permission interface policies to generate permission interface policies adapted to multiple systems; Matching the baseline parameters of position permissions with the set of permission interface policies to generate permission mapping relationships; Analyzing the differences in permission granularity and usage frequencies among WEB systems to generate a permission adaptation priority rule table; Integrating the permission mapping relationships, the permission adaptation priority rule table, and the constraint condition table to generate cross-system adaptation rule parameters.

[0010] Preferably, constructing a dual-channel transmission decision maker based on the organizational structure data, the interaction characteristics among each WEB system, and the cross-system adaptation rule parameters, and combining with the real-time network status data to generate channel selection decision parameters, including: Decomposing the organizational structure data to generate a table of communication requirement intensities among departments; Scoring the interaction characteristics among each WEB system to form a table of transmission performance and security scores among systems; Based on the cross-system adaptation rule parameters and the table of transmission performance and security scores among systems, generating channel constraint weight factors; Fusing the table of communication requirement intensities among departments, the table of transmission performance and security scores among systems, and the channel constraint weight factors in multiple dimensions, and constructing a dual-channel transmission decision maker with dynamic decision-making capabilities through the preset policy priorities; Calculating the dual-channel transmission decision maker and the real-time network status data to generate channel selection decision parameters.

[0011] Preferably, triggering the synchronization engine to execute cross-system permission configuration based on the channel selection decision parameters, and at the same time, associating the organizational entity topology parameters through the permission tracker to generate timestamped permission propagation path parameters, including: Eliminating the policy conflicts of the cross-system adaptation rule parameters to generate enhanced permission descriptors; Decomposing the enhanced permission descriptors and generating an atomic permission operation queue according to the dependency relationships among each WEB system; Encapsulating the atomic permission operation queue into a distributed configuration instruction set carrying a unique ID, and triggering the synchronization engine to execute the final submission operation when the API gateway of the WEB system feeds back a ready confirmation signal; Mapping the submitted distributed configuration instruction set with the organizational entity topology parameters to generate an initial propagation path framework; Analyze the initial propagation path framework to generate a sequence of propagation path nodes with version tags; Associate the sequence of propagation path nodes with channel selection decision parameters and organizational entity topology parameters to generate timestamped permission propagation path parameters.

[0012] Preferably, deploy a policy executor at the permission management terminals of each WEB system, and collect the permission effective status based on the timestamped permission propagation path parameters to generate distributed verification parameters, including: Analyze the timestamped permission propagation path parameters to generate timestamped propagation path tuples; Parse the propagation path tuples to form a node hash chain; Poll the permission status of the WEB system to generate a verification snapshot; Combine the node hash chain with the verification snapshot to generate distributed verification parameters with a Merkle root signature.

[0013] Preferably, perform multimodal verification on the distributed verification parameters to generate a global permission synchronization achievement identification parameter, including: Perform verification analysis on the distributed verification parameters to establish two modes, namely: Real-time mode: Use the policy executor to collect the Merkle root value of the current permission data at the permission management terminals of each WEB system to obtain the core input parameter Merkle root value of the real-time mode; Compare the Merkle root values of all WEB systems by traversing the hash tree nodes layer by layer to obtain the number of different nodes with inconsistent hash values among the systems; Judge whether the number of different nodes is 0. If it is 0, mark the permission as a real-time mode true synchronization status identifier, otherwise mark it as a real-time mode false synchronization status identifier; Batch mode: Use the policy executor to collect the version snapshot WAL logs generated during the permission synchronization of each WEB system to obtain the core input parameter WAL logs of the batch mode. Concatenate the WAL logs of each WEB system in chronological order, identify the missing time segments in the log sequence, and obtain the log fault rate; Judge whether the log fault rate is ≤0.1%. If it is ≤0.1%, mark the permission as a batch mode true synchronization status identifier, otherwise mark it as a batch mode false synchronization status identifier; Associate and compare the real-time mode synchronization status identifier with the batch mode synchronization status identifier. When both modes are true, generate a global permission true synchronization achievement identification parameter; If any one of the synchronization achievement identification parameters of the two modes is false, generate a global permission false synchronization achievement identification parameter.

[0014] Preferably, when the global permission synchronization completion identification parameter is false, a compensation instruction queue is generated, and based on the compensation instruction queue, a permission panoramic situation parameter is generated, including: Extract the permission propagation path parameter with timestamp and the distributed verification parameter to generate the root cause feature vector of the fault conduction path; Perform rule mapping on the root cause feature vector and the cross-system adaptation rule parameter, and generate a compensation instruction queue containing a repair action sequence based on the permission interface policy; Generate a permission panoramic situation parameter based on the compensation instruction queue; Based on the permission panoramic situation parameter, encapsulate the post permission baseline parameter and the cross-system adaptation rule parameter into the policy library of the self-service application interface; When a user initiates a permission application, the global permission synchronization completion identification parameter is called through a real-time status query algorithm; If the global permission synchronization completion identification parameter is true, indicating that the permission statuses of all WEB systems are consistent, then trigger the permission life cycle generator, match the user request with the post permission baseline, generate a permission life cycle parameter, and mark the "synchronization validity" in the permission life cycle parameter as passed; If the identification is false, indicating that there are inconsistent permission statuses in all WEB systems, then terminate the process through an exception interception algorithm, generate a permission life cycle parameter, and mark the "synchronization validity" in the permission life cycle parameter as rejected.

[0015] A cross-platform permission unified management system for multiple WEB systems, including: Parsing module: Obtain the organizational structure data of the enterprise system, parse the organizational structure data, construct a multi-level tree topology network, and form an organizational entity topology parameter; Post permission module: Parse the organizational entity topology parameter to generate a post permission baseline parameter; Permission interface module: Extract the API gateways of each WEB system to generate a permission interface policy, calculate the post permission baseline parameter, and generate a cross-system adaptation rule parameter; Channel selection module: Construct a dual-channel transmission decision maker according to the organizational structure data, the interaction characteristics between WEB systems, and the cross-system adaptation rule parameter, and generate a channel selection decision parameter in combination with real-time network status data; Permission propagation module: Trigger the synchronization engine to perform cross-system permission configuration based on the channel selection decision parameter, and at the same time generate a permission propagation path parameter with timestamp by associating the organizational entity topology parameter through a permission tracker; Permission effect module: Deploy a policy executor at the permission management terminal of each WEB system, collect the permission effect status based on the timestamped permission propagation path parameters, and generate distributed verification parameters; Permission synchronization module: Perform multimodal verification on the distributed verification parameters to generate a global permission synchronization achievement identification parameter; Panoramic module: If the global permission synchronization achievement identification parameter is false, generate a compensation instruction queue, and based on the compensation instruction queue, generate a permission panoramic situation parameter.

[0016] In summary, the present invention mainly has the following beneficial effects: By constructing a dual-channel transmission decision maker, combining real-time network status data and an interaction characteristic scoring table between systems, dynamic optimization of channel selection is achieved. Compared with the traditional static configuration method, this mechanism can automatically select the optimal transmission path according to parameters such as department communication intensity, system transmission performance, and security score, avoid network congestion or high-latency nodes, and significantly improve the cross-system permission configuration efficiency. At the same time, through the mapping calculation between the permission interface policy and the post permission baseline parameters, cross-system adaptation rules are generated to solve the problem of permission granularity differences between different systems and ensure the accuracy and consistency of permission allocation.

[0017] By introducing distributed verification parameters and a global permission synchronization achievement identification parameter, a dual-verification mechanism is constructed. In the real-time mode, through Merkle tree hash comparison, the consistency of the permission status of each system is quickly detected. In the batch mode, the WAL log fault rate is analyzed to identify the synchronization integrity within a long time span. The two modes complement each other, can capture instantaneous state differences, and can also track historical synchronization trajectories, forming a "time-space" dual-verification coverage to achieve the effect of verifying the synchronization result.

[0018] When synchronization fails, the system automatically generates a compensation instruction queue based on the permission propagation path parameters and the root cause of the failure feature vector, and constructs an interactive permission panoramic situation parameter. This parameter not only intuitively displays the permission distribution status, but also encapsulates the post permission baseline and cross-system rules into a self-service application interface policy library, forming a closed-loop management of "monitoring-diagnosis-repair-prevention". When a user initiates a permission application, abnormal processes are intercepted through a real-time status query algorithm to avoid the spread of errors. Brief Description of the Drawings

[0019] Figure 1 is the flowchart of the steps of the cross-platform permission unified management method based on multiple WEB systems of the present invention; Figure 2 is the block diagram of the cross-platform permission unified management system based on multiple WEB systems of the present invention. Detailed Embodiments

[0020] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0021] Reference Figure 1 , a cross-platform permission unified management method based on a multi-WEB system, including: S1: Obtain the organizational structure data of the enterprise system, parse the organizational structure data, construct a multi-level tree-shaped topological network, and form organizational entity topological parameters; S2: Parse the organizational entity topological parameters to generate job permission baseline parameters; S3: Extract the API gateways of each WEB system to generate permission interface policies, calculate the job permission baseline parameters, and generate cross-system adaptation rule parameters; S4: Construct a dual-channel transmission decision maker according to the organizational structure data, the interaction characteristics between each WEB system, and the cross-system adaptation rule parameters, and combine the real-time network status data to generate channel selection decision parameters; S5: Trigger the synchronization engine to execute cross-system permission configuration based on the channel selection decision parameters, and at the same time, associate the organizational entity topological parameters through the permission tracker to generate timestamped permission propagation path parameters; S6: Deploy a policy executor at the permission management terminal of each WEB system, and collect the permission effective status based on the timestamped permission propagation path parameters to generate distributed verification parameters; S7: Perform multi-modal verification on the distributed verification parameters to generate a global permission synchronization achievement identification parameter; S8: If the global permission synchronization achievement identification parameter is false, generate a compensation instruction queue, and based on the compensation instruction queue, generate a permission panoramic situation parameter.

[0022] In the embodiments of the present invention, through the construction of a multi-level tree-shaped topological network and cross-system adaptation rules, the automated modeling and dynamic configuration of the enterprise permission system are realized. On the one hand, based on the job permission baseline parameters generated by the organizational structure analysis, combined with the interface policies extracted by the API gateway, the error risk of manual permission configuration is effectively eliminated, ensuring the strong consistency between permission allocation and the business architecture; on the other hand, the dual-channel transmission decision maker dynamically selects the optimal channel in combination with the real-time network status, significantly improving the permission synchronization efficiency. Especially in complex heterogeneous systems, the configuration cycle can be shortened, and the timestamped permission propagation path parameters provide a traceable audit basis for the full life cycle management of permissions, strengthening the compliance control ability.

[0023] By deploying a distributed verification mechanism and a multi-modal verification algorithm, the system forms a closed-loop management chain of "configuration-verification-repair", which can perform verification in a timely manner during permission synchronization. When the identification parameter is abnormal during global permission synchronization, the automatically triggered compensation instruction queue can quickly locate the failed nodes. Combined with the spatio-temporal dimension aggregation analysis of the visual console, the administrator can quickly complete fault location. This proactive monitoring not only shortens the permission exception response time, but also realizes real-time early warning of potential permission risks through continuous status collection of the policy executor, building an intelligent permission governance system with self-optimization ability for enterprises and ensuring unified management of permissions in multiple WEB systems.

[0024] In one case of this embodiment, the method for obtaining the organizational structure data of the enterprise system, parsing the organizational structure data, constructing a multi-level tree-shaped topology network, and forming organizational entity topology parameters includes: Performing standardization processing on the organizational structure data, where the organizational structure data includes: department identifier, name, parent department identifier, hierarchical code, and cross-system identifier; Extracting the core fields from the organizational structure data, establishing department subordination relationships, and generating cross-system mapping rules with department subordination relationships as the link. Specifically, it includes: extracting core fields such as department identifier, name, and parent department identifier, and cleaning the data to ensure the validity of the parent department identifier. Using the parent department identifier as the association key, constructing a tree structure, recursively querying from the root node to the associated sub-departments, and then determining the subordination relationship through recursive query to form department subordination relationships. Using the department identifier and the parent department identifier as the link, establishing the corresponding relationship between departments in different systems, forming cross-system data conversion and synchronization mapping rules, and then generating cross-system mapping rules; Starting from the root node of the organizational structure, recursively generating a multi-level tree-shaped network, specifically including: starting from the root node of the organizational structure, recursively querying its sub-departments, adding the sub-departments to the tree structure, and repeating this process for each sub-department, traversing layer by layer downward until all department levels are covered, forming a complete multi-level tree-shaped network; Analyzing the multi-level tree-shaped network to form organizational entity topology parameters describing the full-dimensional characteristics of the organization, specifically including: performing a depth-first traversal on the multi-level tree-shaped network, calculating topological characteristics such as network depth, number of nodes, and sub-department distribution, analyzing the department subordination relationship path and hierarchical structure, generating topological parameters such as the number of organizational levels, department concentration, and subordination chain length, and combining multiple topological parameters into organizational entity topology parameters describing the full-dimensional characteristics of the organization; By standardizing and cleaning organizational structure data, we ensure data quality and consistency, and provide a reliable basis for subsequent analysis; clarifying the hierarchy and reporting relationships between departments and establishing departmental affiliations will help understand the overall picture of the organizational structure and provide support for decision-making; using departmental affiliations as a link, we generate cross-system mapping rules to achieve the correspondence and conversion of departmental information between different systems, promote data sharing and system integration, and improve work efficiency; starting from the root node of the organizational structure, we recursively generate a multi-level tree network to intuitively display the hierarchical structure of the organizational structure, facilitate analysis and decision-making, and help discover potential problems; we analyze the multi-level tree network to form organizational entity topology parameters that describe the full-dimensional characteristics of the organization, comprehensively describe the characteristics of the organizational structure, provide a basis for organizational optimization and change, and help organizational development.

[0025] In one case of this embodiment, parsing the organizational entity topology parameters to generate the position authority baseline parameters includes: Analyze the topological parameters of the organizational entity and establish the initial correlation data between the position and the authority, including: analyze the organizational entity topological parameters including the organizational structure characteristics such as departmental level and affiliation, and establish the initial correlation between the position and the authority based on the position and function of the position in the organizational structure. At the same time, allocate the corresponding authority according to the departmental function, refine the matching degree between the authority and the position responsibility, and then form the initial correlation data between the position and the authority; Integrate department affiliation and cross-system mapping rules to generate a position relationship network diagram with authority weights; specifically, extract the position information in the department affiliation and cross-system mapping rules as nodes of the network diagram, use the affiliation between departments and the mapping relationship between systems as the edges connecting the nodes, build an initial position relationship network diagram, and then calculate the authority weight of each position according to the level and function of the position in the organizational structure, and add the weight to the corresponding edge, finally forming a position relationship network diagram with authority weights; Traverse the position relationship network diagram, calculate the position authority inheritance relationship layer by layer, and form a complete authority set, specifically including: traverse the position relationship network diagram, starting from the root node position, visit all its direct child node positions, calculate the authority inheritance relationship of the child node positions according to the authority weights in the position relationship network diagram, form the authority set of the child node positions, and repeat the above process for each child node position, traverse downward layer by layer until all position levels are covered, and finally form a complete authority set of all positions; Eliminate permissions from the complete permission set and convert it into a matrix to generate the position permission baseline parameters, including: setting a preset rule based on position responsibilities, security policies and compliance requirements, eliminating redundant permissions according to the preset rules, retaining core permissions, and then constructing a matrix with positions as rows and permissions as columns, and filling in the matrix elements according to the strength of the association between positions and permissions, and finally generating the position permission baseline parameters; By parsing the topological parameters of organizational entities to generate baseline parameters for post permissions, the refinement and systematization of permission management are achieved. First, an initial association between posts and permissions is established based on the characteristics of the organizational structure, ensuring a high degree of matching between permission allocation and job responsibilities, and improving the accuracy and efficiency of permission allocation. Second, by integrating departmental subordination relationships and cross-system mapping rules, a network diagram of post relationships with permission weights is constructed, intuitively showing the permission flow and inheritance relationships between posts, and enhancing the system integration and data sharing capabilities. Finally, by traversing the network diagram to calculate the permission inheritance relationships, a complete set of permissions is formed, redundant permissions are eliminated, and matrix-based baseline parameters for post permissions are generated, providing a standardized and quantifiable basis for permission management, enhancing the depth of organizational structure analysis and decision-making support. Overall, it promotes the standardization and compliance of permission management in multiple WEB systems and achieves efficient and secure permission control.

[0026] In one case of this embodiment, extracting the API gateways of each WEB system to generate permission interface policies and calculating baseline parameters for post permissions to generate cross-system adaptation rule parameters includes: Extracting the routing rules, authentication information, and permission control policies of the API gateways of each WEB system to generate preliminary permission interface policies, specifically including: collecting gateway configuration information, parsing routing rules such as API endpoints, request methods, path parameters, etc., obtaining authentication mechanisms for permission interfaces such as API keys and OAuth tokens, and associating and matching the three based on role-based access control rules to clarify the access permission requirements for each interface and generate preliminary permission interface policies to provide a basis for permission management; Using cross-system mapping rules to map and transform the preliminary permission interface policies to generate permission interface policies adapted to multiple systems, specifically including: through cross-system mapping rules, converting the department identifiers of each system into the corresponding identifiers of the target system, establishing the corresponding relationships between departments, traversing the permission interface policies at the same time, replacing the original department roles with the mapped identifiers, adjusting routing rules, authentication methods, and access control parameters, and automatically adjusting according to the priority of the mapping rules in case of policy conflicts. By batch-converting the preliminary permission interface policies, permission interface policies adapted to multiple systems are generated, and the effectiveness of cross-system permission control is ensured through consistency verification; Match the job permission baseline parameters with the permission interface policy set to generate a permission mapping relationship, which specifically includes: first, parse the job permission baseline parameters to extract the core permissions and associated strength values of each job; then traverse the permission interface policy set, parse the permission requirements of each API endpoint, and precisely match the interface permissions with the permission items. If the permissions exist and the associated strength meets the requirements, establish the mapping relationship between the job and the interface. Finally, generate a structured mapping table containing metadata such as job identifiers, interface identifiers, permission items, and validity periods, and extend the inherited permissions of sub-jobs based on the structured mapping table to form an executable permission mapping relationship across the system; Analyze the permission granularity differences and usage frequencies among WEB systems to generate a permission adaptation priority rule table, which specifically includes: collect the permission levels and usage data among each WEB system, evaluate the granularity of permissions based on the permission levels, and count the number of times the permissions are called. Divide the permission levels into n levels, set the initial permission level as n1 and evaluate it as 1 point. When the permission level is n2, evaluate it as 2 points, and so on. The higher the permission level score, the finer the granularity. Each time a permission is called, it is evaluated as 1 point. The higher the permission call frequency, the higher the usage frequency. Assign high priorities to the permissions with high usage frequencies and fine granularities, and lower the priorities for low-frequency or coarse-grained permissions, thus generating a permission adaptation priority rule table; Integrate the permission mapping relationship and the permission adaptation priority rule table to generate cross-system adaptation rule parameters, which specifically includes: match each record in the permission mapping relationship with the permission adaptation priority rule table, sort the permission mapping relationship according to the priority scores of the permission items in the rule table, and for each permission mapping relationship, combine the associated job identifier, interface identifier, and validity period data to generate cross-system adaptation rules. Form the score of the adaptation rules according to the sum of the scores of each permission mapping relationship and the permission adaptation priority rule table, sort them from high to low according to the scores of the adaptation rules, and integrate all the adaptation rules into a structured parameter table in the order of the scores to form cross-system adaptation rule parameters; By systematically integrating multi-system permission management elements, the intelligence and collaboration of permission control are significantly enhanced. Routes, authentication, and permission policies are extracted from the API gateways of each WEB system to generate preliminary policies, unifying the permission description standards for multi-source heterogeneous interfaces and establishing a basic data framework for cross-system permission governance. The policies are subjected to identity conversion and parameter optimization using cross-system mapping rules, not only solving the problem of incompatible department identities between systems but also automatically resolving policy conflicts through a priority mechanism to ensure the consistency of permission control. Moreover, by matching the baseline parameter of the position permission with the interface policy, a two-way mapping relationship between the position and the interface is established, and the inherited permission of the sub-position is extended to achieve refined and dynamic expansion of permission allocation. Further analyzing the permission granularity and usage frequency to generate priority rules, promoting high-frequency fine-grained permissions to the forefront of the adaptation queue to optimize system resource allocation, and finally integrating and forming structured adaptation rule parameters to provide a quantitative basis for permission automated decision-making, cross-system risk control, and compliance auditing, driving the leap of multi-WEB systems from isolated permission management to global collaborative control and providing technical support for building a secure and efficient digital organization.

[0027] In one case of this embodiment, a dual-channel transmission decision-maker is constructed based on the organizational structure data, the interaction characteristics between each WEB system, and the cross-system adaptation rule parameters, and combined with the real-time network status data to generate channel selection decision parameters, including: Decompose the organizational structure data to generate a table of the intensity of communication requirements between departments, specifically including: cleaning the core fields such as department identifiers, names, parent department identifiers, and hierarchical codes in the organizational structure data, and then analyzing department functions, levels, and cross-system collaboration requirements based on departmental subordination relationships and cross-system mapping rules. Use a 1-5 scoring system to evaluate the intensity of communication requirements between departments, where 1 point represents extremely low requirements and 5 points represent extremely high requirements. Set a communication frequency threshold. If the communication frequency of this department is less than the communication frequency threshold, it proves that this department has independent functions and a relatively high level, and is rated 1 to 2 points. If the communication frequency of this department is equal to the communication frequency threshold, it proves that this department mainly conducts internal communication and is rated 3 to 4 points. If the communication frequency of this department is greater than the communication frequency threshold, it proves that this department has frequent cross-departmental collaboration and is rated 5 points. Sort according to the scores from high to low to construct a table of the intensity of communication requirements between departments, providing a quantitative basis for subsequent decision-making and analysis; Score the interaction characteristics between each WEB system to form a table of transmission performance and security scores between systems, specifically including: collecting the transmission delays and encryption methods of each WEB system. Set the transmission delay to a total of 1 to 5 points. If the transmission delay is less than 100ms, it is rated 5 points, 100ms - 200ms is rated 4 points, and so on. For the encryption method, AES-256 is rated 5 points, other methods are rated 3 points, and no encryption is rated 1 point. Finally, sort according to the sum of the scores of the transmission delay and the encryption method from high to low and construct a table of transmission performance and security scores between systems, providing a quantitative basis for subsequent decision-making and analysis; Based on the cross-system adaptation rule parameters and the inter-system transmission performance and security score table, generate the channel constraint weight factor, which specifically includes: using the priority scores in the permission adaptation priority rule table as the basis for weight calculation, obtaining the transmission performance score and encryption method score of each system from the inter-system transmission performance and security score table, taking these two scores as the weight factors for the two dimensions of transmission performance and security respectively, and then combining the communication demand score in the inter-department communication demand intensity table as the weight factor for the communication demand dimension. Finally, fuse the weight factors of these three dimensions through the weighted average method to generate the channel constraint weight factor. The calculation method of the weight factor is: channel constraint weight factor = (permission adaptation priority score × 0.5) + (transmission performance score × 0.2) + (encryption method score × 0.1) + (communication demand score × 0.2); Perform multi-dimensional fusion on the inter-department communication demand intensity table, the inter-system transmission performance and security score table, and the channel constraint weight factor, and construct a dual-channel transmission decision maker with dynamic decision-making ability through the preset policy priorities, which specifically includes: taking the inter-department communication demand intensity table, the inter-system transmission performance and security score table, and the channel constraint weight factor as inputs, and using the decision tree algorithm for multi-dimensional fusion calculation according to each priority to construct the dual-channel transmission decision maker. The dual-channel transmission decision maker will dynamically select the optimal transmission channel according to the current channel constraint weight factor and policy priorities. Among them, when the performance priority is the highest, the decision maker will give priority to selecting the channel with the highest transmission performance score; when the security priority is the highest, the decision maker will give priority to selecting the channel with the highest encryption method score; when the communication demand priority is the highest, the decision maker will give priority to selecting the channel with the highest communication demand score; Calculate the dual-channel transmission decision maker and the real-time network status data to generate the channel selection decision parameters, which specifically includes: the dual-channel transmission decision maker will obtain the network status data in real time, such as network bandwidth, latency, packet loss rate, etc., combine these data with the channel constraint weight factor, and use the dynamic programming algorithm for calculation to generate the channel selection decision parameters. The decision parameters include channel selection, transmission priority, encryption method, etc. Among them, when the network bandwidth is sufficient and the latency is low, the decision maker selects the channel with a higher transmission performance score and sets a higher transmission priority; when the network bandwidth is tight or the latency is high, the decision maker will select the channel with a higher communication demand score and set a lower transmission priority to ensure the smoothness of critical communications; Through multi-dimensional quantitative analysis and dynamic decision-making algorithms, the intelligent level of data transmission between systems is significantly improved. By constructing a three-weight quantitative evaluation system (department communication intensity, system transmission performance, security encryption level), the organizational structure characteristics are transformed into computable decision-making factors, enabling channel allocation to shift from empirical judgment to data-driven. Moreover, an innovative channel constraint weight model is developed, integrating four dimensions of permission priority, transmission performance, security level, and business requirements. Through the weighted average algorithm, multi-objective decision-making balance is achieved, ensuring both the smoothness of high-frequency cross-departmental collaboration and taking into account data encryption requirements. Finally, a real-time network status feedback mechanism is introduced to dynamically adjust transmission priorities and channel selection strategies. When the network is congested, it automatically opens priority channels for critical services, and when the bandwidth is sufficient, it preferentially selects high-performance links, forming a "business demand-driven + network adaptive" two-wheel optimization mechanism. This decision-making device not only improves cross-system transmission efficiency but also achieves an accurate match between security policies and business requirements through quantitative scoring, providing quantifiable decision-making support for multi-system collaboration under complex organizational structures.

[0028] In one case of this embodiment, the synchronization engine is triggered to execute cross-system permission configuration based on the channel selection decision parameters. At the same time, the permission tracker associates the organizational entity topology parameters to generate timestamped permission propagation path parameters, including: Eliminate the policy conflicts of cross-system adaptation rule parameters to generate enhanced permission descriptors, specifically including: by constructing a rule parameter conflict detection engine, automatically parse the conditional expressions, resource identifiers, and operation constraints in the permission policies of each system to generate a standardized policy fingerprint map. Identify overlapping rules through fingerprint comparison, and combine the conflict resolution principle of the primary system priority to rank the conflict rules by priority. Then inject the resolved rules into the permission descriptor to generate an enhanced permission descriptor; Decompose the enhanced permission descriptor and generate an atomic permission operation queue according to the dependency relationship between each WEB system, specifically including: identify the composite permission declarations in the enhanced permission descriptor through a semantic parsing engine, decompose them into atomic operation sequences, establish a WEB system dependency relationship map, analyze the service call chain, data flow, and permission inheritance relationship between each system to determine the priority of permission operations. Based on the dependency relationship map, incorporate the decomposed atomic operations into the priority queue according to the topological sorting rules, and add system identifiers, pre-dependency markers, and retry mechanisms to each operation. When the queue is generated, automatically filter redundant operations and merge non-dependent operations that can be executed in parallel, and finally generate an efficient and deadlock-free atomic permission operation queue; Encapsulate the atomic permission operation queue into a distributed configuration instruction set with a unique ID. When the WEB system API gateway sends a ready confirmation signal, trigger the synchronization engine to perform the final submission operation, which specifically includes: after the atomic permission operation queue is generated, the system packages it into an instruction set with a unique identifier, clarifying the specific type, target system, and permission parameters of each operation. These instructions are shared in a distributed environment through a reliable transmission mechanism, and the API gateway of the WEB system is used as the permission configuration hub to monitor the status of each service in real time. After all associated systems are initialized and send a ready signal, immediately trigger the synchronization engine to start the submission process; Among them, the synchronization engine adopts a two-step strategy of "verify first and then execute": first send a pre-submission request to each system to confirm the feasibility of the operation; after all systems confirm that there is no error, then uniformly execute the formal submission to update the permission configuration. The entire process is monitored by the permission tracker, which records the time and result of each permission change in real time. If a system fails to execute, the system will quickly locate the problem instruction according to the unique identifier and automatically retry or prompt manual processing to ensure the overall consistency of cross-system permission configuration; Map the submitted distributed configuration instruction set to the organizational entity topology parameters to generate an initial propagation path framework, which specifically includes: after the distributed configuration instruction set is submitted, the system automatically associates each operation with the organizational structure data, first parses the target system and permission parameters in the instruction, matches the corresponding departments, roles, and resources in the organizational topology library, forms an association relationship graph between the operation and the entity, and then generates an initial propagation path framework including the starting point (original instruction), intermediate nodes (approval system, resource gateway), and end point (target permission table) according to rules such as permission inheritance and exclusion, and adds a timestamp and dependency label to each link. If the operation involves multi-system linkage, the path will clearly show the trigger order and data flow of each system in the form of a flowchart.

[0029] Analyze the initial propagation path framework to generate a sequence of propagation path nodes with version tags, which specifically includes: first extract the timestamps, dependency relationships, and operation parameters of each node in the initial propagation path framework, construct a node dependency relationship graph, and then determine the execution order through a sorting algorithm to ensure that preconditions such as permission approval are executed first. Subsequently, generate version tags for the nodes. The major version number reflects major adjustments to the organizational structure, and the minor version number corresponds to changes in permission rules. Trigger a major version upgrade when the department structure is adjusted, and update the revision number when the permission validity period is modified. Finally, synthesize a sequence of propagation path nodes with version tags, which not only clarifies the execution path but also supports version comparison and fault rollback. This sequence makes the permission propagation process traceable and ensures the stability and reliability of the system; Associate the propagation path node sequence with the channel selection decision parameters and the organizational entity topology parameters to generate timestamped permission propagation path parameters, specifically including: First, match the version tag, execution order, and dependency relationship of the node sequence with the priority and channel type in the channel selection parameters. For example, emergency nodes preferably select message queues, and regular nodes use API interfaces. At the same time, refer to the department hierarchy and role relationship in the organizational structure data to match specific propagation paths for the nodes, and automatically add approval nodes during cross-departmental operations. During the association, the system adds a millisecond-level timestamp to each node and compares it with the channel timeout threshold. Finally, generate timestamped permission propagation path parameters to form an auditable full-link record.

[0030] Achieve policy conflict resolution by constructing a standardized policy fingerprint map, significantly improve the consistency management efficiency of permission rules, form an enhanced permission descriptor in combination with the main system priority principle, effectively avoid permission redundancy or omission caused by policy overlap between multiple systems. Based on the atomic operation queue generation mechanism of the semantic parsing engine, optimize the execution sequence through topological sorting rules, and cooperate with the system dependency map to realize the coupling analysis of service call chains and data flows, making the priority allocation of permission operations more accurate. The redundant operation filtering and parallel execution merging mechanism can improve the configuration efficiency. The synchronization engine adopts a pre-verification - execution two-phase commit strategy, combined with the API gateway status monitoring mechanism, to reduce the risk of execution failure while ensuring the integrity of distributed transactions. The full-link audit record formed by the permission tracker meets compliance requirements such as SOX, and the version tag system uses a three-segment identifier of major version number - minor version number - revision number to achieve accurate traceability of organizational structure adjustments, permission rule changes, and parameter modifications. In combination with the channel selection parameter matching algorithm, automatically inject timestamps and dependency tags during the generation of cross-system propagation paths to form time series data with millisecond-level accuracy, providing multi-dimensional decision-making basis for permission propagation performance analysis and root cause fault location.

[0031] In one case of this embodiment, deploy a policy executor at the permission management terminal of each WEB system, and collect the permission effective status based on the timestamped permission propagation path parameters to generate distributed verification parameters, including: Analyze the timestamped permission propagation path parameters to generate a propagation path tuple with a timestamp; Parse the propagation path tuple to form a node hash chain, specifically including: Extract the four elements of the propagation path tuple, and the four elements include person, location, time, and relationship. Convert the four elements into numerical nodes through a hash algorithm and generate a time series graph sorted by time. The hash value of each node is calculated by the current tuple hash + the previous node hash to form a node hash chain; Poll the permission status of the WEB system to generate a verification snapshot, which specifically includes: enabling the client to obtain permission updates in real time through the long polling mechanism of the WEB system. The client sends a request to the server every 5 seconds, carrying the timestamp of the last check. The server will then detect whether there are any changes in the permissions. If changes are found, it will return a snapshot containing only the changed part; Combine the node hash chain with the verification snapshot to generate distributed verification parameters with a Merkle root signature, which specifically includes: slicing the hash chain by time window, constructing a Merkle tree for each slice, taking the root hash as the summary for that period, then performing an exclusive OR operation on the summaries of each period and the corresponding verification snapshots to generate intermediate verification parameters. Then, using the BLS aggregate signature algorithm, aggregate all the intermediate parameters into a global root signature, and thus generate distributed verification parameters with a Merkle root signature. This signature supports batch verification, and the verifier only needs to save the latest root hash to complete the verification of the entire chain; Realize the intelligent upgrade of multi-system permission management by constructing a distributed permission verification system. First, establish an anti-tampering audit link. Extract the four elements of person, place, time, and relationship based on the propagation path tuple, generate a time-series graph through the hash algorithm, and combine the exclusive OR operation of the Merkle tree shard root hash and the verification snapshot to form an immutable permission change record chain. The BLS aggregate signature technology enables the verifier to only need to save the latest root hash to complete the verification of the entire chain, improving the audit efficiency and reducing the compliance cost. Moreover, it can achieve real-time status perception. The long polling mechanism is used to trigger the permission status detection every 5 seconds, and the server only returns the incremental change snapshot, reducing a large amount of invalid data transmission compared with traditional polling. Combining with the timestamp propagation path parameter, the effective time point of the permission can be accurately located, and the abnormal response delay is compressed from the minute level to the second level. Finally, improve the cross-system collaboration efficiency. The distributed verification parameters are automatically deployed on each terminal through the policy executor, and dynamically adapt to the network status in combination with the channel selection decision parameter, improving the success rate of permission configuration. Moreover, the Merkle root signature supports batch verification, and the verification time for millions of permission changes is shortened from the hour level to the millisecond level, providing quantifiable decision support for multi-system permission governance under complex organizational structures.

[0032] In one case of this embodiment, the multi-modal verification of the distributed verification parameters to generate a global permission synchronization achievement identification parameter includes: Conduct a verification analysis on the distributed verification parameters to establish two modes, namely: Real-time mode: Use the policy executor to collect the Merkle root value of the current permission data at each WEB system permission management terminal to obtain the core input parameter of the real-time mode, the Merkle root value; By traversing the hash tree nodes layer by layer, the Merkle root values of all WEB systems are compared to obtain the number of different nodes with inconsistent hash values among systems. Specifically, it includes: First, obtain the Merkle root hash values of each WEB system. If there are different root values, mark the existence of global differences and trigger the next-layer comparison. The comparison process starts from the root node. The hash value of the current layer is split into a set of child node hashes by the binary method. For example, if the root node hash corresponds to the Kth layer, it is split into the sub-tree hashes of the (K - 1)th layer. The hash values of each split child node are compared across systems. When it is found that the hash value of a certain child node is inconsistent among at least two systems, record this node as a different node and enter its next-layer child nodes to continue splitting and comparing. For the child node hashes that are exactly the same, there is no need to continue splitting and they are directly regarded as having no differences in this branch. Eventually, the different paths will converge to the specific leaf node layer. At this time, the position of the inconsistent hash of the permission data block can be determined. Each leaf node corresponds to an original permission record. Furthermore, the number of different nodes with inconsistent hash values among systems can be obtained, and breadth-first traversal can be used to avoid repeated calculations. At the same time, when multiple systems share the same sub-tree hash, the deep comparison of this branch can be skipped to improve the comparison efficiency; Judge whether the number of different nodes is 0. If it is 0, mark this permission as the real-time mode true synchronization status identifier; otherwise, mark it as the real-time mode false synchronization status identifier; Batch mode: Use the policy executor to collect the version snapshot WAL logs generated during the permission synchronization process of each WEB system to obtain the core input parameter WAL logs of the batch mode. Concatenate the WAL logs of each WEB system in chronological order and identify the missing time segments in the log sequence to obtain the log fault rate. Specifically, when the core input parameter WAL logs of the batch mode are obtained, the awk tool can be used to sort and compare the concatenated logs to find discontinuous timestamps or sequence numbers, so as to identify the missing log segments. After identifying the missing segments, calculate the log fault rate through the following formula: Log fault rate = number of missing segments / total number of segments * 100%, where the number of missing segments refers to the number of identified missing log segments, and the total number of segments refers to the concatenated logs; Judge whether the log fault rate is ≤ 0.1%. If it is ≤ 0.1%, mark this permission as the batch mode true synchronization status identifier; otherwise, mark it as the batch mode false synchronization status identifier; Associate and compare the real-time mode synchronization status identifier with the batch mode synchronization status identifier. When both modes are true, generate the global permission true synchronization achievement identifier parameter; If any one of the synchronization achievement identifier parameters of the two modes is false, generate the global permission false synchronization achievement identifier parameter.

[0033] By integrating real-time and batch verification modes, the accuracy and reliability of the permission synchronization system are significantly improved. The real-time mode is based on layer-by-layer hash comparison of the Merkle tree, quickly locating the nodes with permission differences across systems, and optimizing the comparison efficiency by combining the binary search splitting strategy to ensure second-level response to anomalies. The batch mode uses WAL log splicing analysis to accurately identify a log fault rate within 0.1% and form a historical synchronization audit chain. The dual-mode complementary mechanism not only ensures the consistency of the current state but also realizes long-term data integrity verification. By constructing a tamper-proof audit link through the BLS aggregation signature technology, this solution upgrades the traditional passive verification to an active defense system, supports intelligent decision-making in a dynamic network environment, provides a quantitative and traceable synchronization guarantee for the permission governance of complex organizational structures, and effectively balances security and operational efficiency.

[0034] In one case of this embodiment, when the global permission synchronization completion identification parameter is false, a compensation instruction queue is generated, and based on the compensation instruction queue, a permission panoramic situation parameter is generated, including: Extract the timestamped permission propagation path parameter and the distributed verification parameter to generate the root cause feature vector of the fault conduction path, specifically including: extract the timestamp sequence, node hash value, and propagation path tuple from the permission propagation path parameter, and combine the Merkle tree root hash, node hash chain, and verification snapshot in the distributed verification parameter to construct a multi-dimensional feature vector, and generate a root cause feature vector including error types by analyzing the timestamp deviation, hash value conflict point, and abnormal segment in the verification snapshot. The error types include configuration timeout, hash conflict, influence range, and time window; Perform rule mapping on the root cause feature vector and the cross-system adaptation rule parameter, and generate a compensation instruction queue including a repair action sequence based on the permission interface policy, specifically including: match the error type in the root cause feature vector with the permission priority and transmission channel constraint weight in the cross-system adaptation rule. If the configuration timeout is caused by network latency, automatically select a standby high-performance channel according to the transmission performance score in the channel constraint weight factor. If the permission fails to take effect due to a hash conflict, trigger the retry mechanism of the atomic permission operation queue, and combine the API endpoint, request method, and authentication information in the permission interface policy to generate an instruction queue including specific repair actions to ensure that the instruction can be accurately mapped to the fault node.

[0035] Based on the compensation instruction queue, generate a permission panoramic situation parameter, specifically including: associate the repair action sequence, timestamp deviation, hash conflict point, and other root cause features in the compensation queue with the permission propagation path metadata to construct a three-dimensional situation model including the distribution of fault nodes, influence range heat map, and repair timeliness. Use the time series analysis algorithm to monitor the channel switching and retry mechanism trigger frequency in the instruction queue in real time to generate the permission panoramic situation parameter; Based on the permission panoramic situation parameters, the post permission baseline parameters and cross-system adaptation rule parameters are encapsulated into the policy library of the self-service application interface, specifically including: converting the fault characteristics, repair actions, channel performance, etc. in the permission panoramic situation parameters into standardized data, establishing the mapping relationship between the permission status and the policy rules, adopting the policy-as-code mode, orthogonally combining the post permission baseline and the cross-system adaptation rules, dynamically generating a logic tree containing conditional judgments, and then embedding the conflict resolution rules. When multiple rules are triggered, decisions are made based on the three-level priorities of business criticality, system compatibility, and execution efficiency, where business criticality > system compatibility > execution efficiency, to ensure the feasibility of the policy. Then, the policy library is encapsulated as a RESTful API service, providing policy query, pre-check, and execution endpoints. When the user applies, the interface dynamically calculates the available policy set and returns a policy package containing specific parameters and a compliance proof chain; When the user initiates a permission application, the global permission synchronization achievement identification parameter is called through the real-time status query algorithm; If the global permission synchronization achievement identification parameter is true, indicating that the permission statuses of all WEB systems are consistent, the permission lifecycle generator is triggered to match the user request with the post permission baseline, generate the permission lifecycle parameters, and mark the "synchronization validity" in the permission lifecycle parameters as passed; If the identification is false, indicating that there are inconsistent permission statuses in all WEB systems, the process is terminated through the exception interception algorithm, the permission lifecycle parameters are generated, and the "synchronization validity" in the permission lifecycle parameters is marked as rejected.

[0036] The collaborative and self-healing capabilities of multi-WEB system permission management are significantly enhanced through the intelligent fault handling and policy encapsulation mechanism. When the global permission synchronization is abnormal, the system can automatically extract key verification parameters such as timestamps and hash chains in the propagation path tuple, construct a multi-dimensional root cause feature vector to accurately identify fault types such as configuration timeouts and hash conflicts; based on the cross-system adaptation rules, a compensation instruction queue is dynamically generated to ensure that the repair instructions are accurately mapped to the fault nodes. The system drives the generation of a three-dimensional situation model through the compensation queue, quantifies the fault distribution, impact range, and repair progress in real time, and generates visual decision support such as heat maps; further, the situation parameters are fused and encapsulated with the permission baseline and adaptation rules into a self-service API policy library, and a logic tree containing conditional judgments is generated in the policy-as-code mode, and a three-level priority conflict resolution mechanism is embedded, enabling the permission application interface to have context awareness capabilities. The returned policy package not only meets the compliance requirements but also adapts to complex multi-system environments, significantly enhancing the permission control resilience under complex organizational structures.

[0037] Reference Figure 2 Based on the cross-platform permission unified management system for multi-WEB systems, including: Parsing Module: Obtain the organizational structure data of the enterprise system, parse the organizational structure data, construct a multi-level tree-shaped topology network, and form organizational entity topology parameters; Position Permission Module: Parse the organizational entity topology parameters to generate position permission baseline parameters; Permission Interface Module: Extract the API gateways of each WEB system to generate permission interface policies, calculate the position permission baseline parameters, and generate cross-system adaptation rule parameters; Channel Selection Module: Construct a dual-channel transmission decision maker based on the organizational structure data, the interaction characteristics between WEB systems, and the cross-system adaptation rule parameters, and generate channel selection decision parameters in combination with real-time network status data; Permission Propagation Module: Trigger the synchronization engine to execute cross-system permission configuration based on the channel selection decision parameters, and at the same time generate timestamped permission propagation path parameters by associating the organizational entity topology parameters through the permission tracker; Permission Effectiveness Module: Deploy a policy executor at the permission management terminal of each WEB system, and collect the permission effectiveness status based on the timestamped permission propagation path parameters to generate distributed verification parameters; Permission Synchronization Module: Perform multi-modal verification on the distributed verification parameters to generate a global permission synchronization achievement identification parameter; Panorama Module: If the global permission synchronization achievement identification parameter is false, generate a compensation instruction queue, and generate permission panorama situation parameters based on the compensation instruction queue.

[0038] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A cross-platform unified authority management method based on multiple WEB systems, characterized in that: The method comprises: S1: Obtain the organizational structure data of the enterprise system, parse the organizational structure data, build a multi-level tree topology network, and form organizational entity topology parameters; S2: Analyze the organizational entity topology parameters and generate the position authority baseline parameters; S3: Extract the API gateways of each WEB system, generate permission interface policies, calculate the baseline parameters of job permissions, and generate cross-system adaptation rule parameters; S4: Construct a dual-channel transmission decision maker based on organizational structure data, interaction characteristics between various WEB systems, and cross-system adaptation rule parameters, and generate channel selection decision parameters in combination with real-time network status data; S5: trigger the synchronization engine to execute cross-system permission configuration based on the channel selection decision parameters, and generate permission propagation path parameters with timestamps by associating the organization entity topology parameters through the permission tracker; S6: deploy a policy executor on the permission management terminal of each WEB system, collect the permission effectiveness status based on the permission propagation path parameters with timestamps, and generate distributed verification parameters; S7: Perform multi-modal verification on the distributed verification parameters to generate global authority synchronization achievement identification parameters; S8: If the global permission synchronization achievement identification parameter is false, a compensation instruction queue is generated, and based on the compensation instruction queue, a permission panoramic situation parameter is generated.

2. The cross-platform unified authority management method based on multiple WEB systems according to claim 1 is characterized in that: The obtaining of the organizational structure data of the enterprise system, parsing the organizational structure data, constructing a multi-level tree topology network, and forming organizational entity topology parameters include: Standardize organizational structure data, including department ID, name, parent department ID, level code, and cross-system ID; Extract core fields from organizational structure data, establish department affiliations, and use department affiliations as a link to generate cross-system mapping rules; Starting from the root node of the organizational structure, a multi-level tree network is recursively generated; The multi-level tree network is analyzed to form the organizational entity topology parameters that describe the full-dimensional characteristics of the organization.

3. The cross-platform unified authority management method based on multiple WEB systems according to claim 2 is characterized in that: The analysis of the organizational entity topology parameters to generate the position authority baseline parameters includes: Analyze the topological parameters of organizational entities and establish initial position-authority association data; Integrate department affiliation and cross-system mapping rules to generate a job relationship network diagram with authority weights; Traverse the job relationship network diagram, calculate the job authority inheritance relationship layer by layer, and form a complete authority set; Eliminate permissions from the complete permission set and transform it into a matrix to generate position permission baseline parameters.

4. The cross-platform unified authority management method based on multiple WEB systems according to claim 3 is characterized in that: The API gateways of various WEB systems are extracted, permission interface policies are generated, position permission baseline parameters are calculated, and cross-system adaptation rule parameters are generated, including: Extract the routing rules, authentication information and permission control strategies of each WEB system API gateway, and generate preliminary permission interface strategies; Use cross-system mapping rules to map and convert the preliminary permission interface strategy to generate a permission interface strategy that is suitable for multiple systems; Match the position authority baseline parameters with the authority interface policy set to generate the authority mapping relationship; Analyze the differences in permission granularity and usage frequency between WEB systems, and generate a permission adaptation priority rule table; Integrate the permission mapping relationship, permission adaptation priority rule table and constraint condition table to generate cross-system adaptation rule parameters.

5. The cross-platform unified authority management method based on multiple WEB systems according to claim 4 is characterized in that: The dual-channel transmission decision maker is constructed according to the organizational structure data, the interaction characteristics between each WEB system and the cross-system adaptation rule parameters, and the channel selection decision parameters are generated in combination with the real-time network status data, including: Disassemble the organizational structure data and generate a table of inter-departmental communication demand intensity; Score the interaction characteristics between each WEB system to form a transmission performance and security score table between systems; Generate channel constraint weight factors based on cross-system adaptation rule parameters and inter-system transmission performance and security score tables; The inter-departmental communication demand intensity table, the inter-system transmission performance and security score table, and the channel constraint weight factor are integrated in multiple dimensions, and a dual-channel transmission decision maker with dynamic decision-making capabilities is constructed through preset policy priorities. The dual-channel transmission decision maker and real-time network status data are calculated to generate channel selection decision parameters.

6. The cross-platform unified authority management method based on multiple WEB systems according to claim 5 is characterized in that: The synchronization engine is triggered to execute cross-system permission configuration based on the channel selection decision parameter, and the permission propagation path parameter with timestamp is generated by associating the organization entity topology parameter through the permission tracker, including: Eliminate policy conflicts of cross-system adaptation rule parameters and generate enhanced permission descriptors; Decompose the enhanced permission descriptor and generate an atomic permission operation queue based on the dependencies between various WEB systems; The atomic permission operation queue is encapsulated as a distributed configuration instruction set with a unique ID. When the WEB system API gateway feedbacks the ready confirmation signal, the synchronization engine is triggered to perform the final submission operation. Map the submitted distributed configuration instruction set with the organizational entity topology parameters to generate an initial propagation path framework; Analyze the initial propagation path framework and generate a propagation path node sequence with version tags; The propagation path node sequence is associated with the channel selection decision parameters and the organizational entity topology parameters to generate the permission propagation path parameters with timestamp.

7. The cross-platform unified authority management method based on multiple WEB systems according to claim 6 is characterized in that: The policy executor is deployed on the permission management terminal of each WEB system, and the permission effectiveness status is collected based on the permission propagation path parameters with timestamps to generate distributed verification parameters, including: Analyze the permission propagation path parameters with timestamps and generate propagation path tuples with timestamps; Parse the propagation path tuple to form a node hash chain; Poll the WEB system permission status and generate verification snapshots; Combine the node hash chain with the verification snapshot to generate distributed verification parameters with the Merkle tree root signature.

8. The cross-platform unified authority management method based on multiple WEB systems according to claim 7 is characterized in that: The multi-modal verification of the distributed verification parameters to generate the global authority synchronization achievement identification parameters includes: The distributed verification parameters are verified and analyzed to establish two modes: Real-time mode: The policy executor is used to collect the Merkle tree root value of the current permission data in each WEB system permission management terminal to obtain the Merkle tree root value of the core input parameter of the real-time mode; By traversing the hash tree nodes layer by layer, the Merkle tree root values ​​of all WEB systems are compared to obtain the number of nodes with different hash values ​​between the systems. Determine whether the number of difference nodes is 0. If it is 0, mark the permission as a real-time mode true synchronization state flag, otherwise mark it as a real-time mode false synchronization state flag; Batch mode: The policy executor is used to collect the version snapshot WAL logs generated during the permission synchronization process of each WEB system, obtain the WAL logs, the core input parameter of the batch mode, splice the WAL logs of each WEB system in chronological order, identify the missing time segments in the log sequence, and obtain the log fault rate; Determine whether the log fault rate is ≤0.1%. If it is ≤0.1%, mark the permission as a batch mode true synchronization state flag, otherwise mark it as a batch mode false synchronization state flag; The real-time mode synchronization status flag is associated and compared with the batch mode synchronization status flag. When both modes are true at the same time, a global permission true synchronization achievement flag parameter is generated. If the synchronization achievement identification parameter of any of the two modes is false, a global permission false synchronization achievement identification parameter is generated.

9. The cross-platform unified authority management method based on multiple WEB systems according to claim 8 is characterized in that: If the global permission synchronization achievement identification parameter is false, a compensation instruction queue is generated, and based on the compensation instruction queue, a permission panoramic situation parameter is generated, including: Extract the timestamped permission propagation path parameters and distributed verification parameters to generate the root cause feature vector of the fault conduction path; Map the root cause feature vector and the cross-system adaptation rule parameters, and generate a compensation instruction queue containing a repair action sequence based on the permission interface strategy; Generate permission panoramic situation parameters based on the compensation instruction queue; Based on the permission panoramic situation parameters, the position permission baseline parameters and cross-system adaptation rule parameters are encapsulated into a policy library for the self-service application interface; When a user initiates a permission application, the global permission synchronization is called through the real-time status query algorithm to achieve the identification parameters; If the global permission synchronization achieved indicator parameter is true, indicating that the permission status of all WEB systems is consistent, the permission lifecycle generator is triggered to match the user request with the position permission baseline, generate permission lifecycle parameters, and mark the "Synchronization Validity" in the permission lifecycle parameters as passed; If the flag is false, it means that there is inconsistency in the permission status in all WEB systems. In this case, the process is terminated through the exception interception algorithm, the permission lifecycle parameters are generated, and the "synchronization validity" in the permission lifecycle parameters is marked as rejected.

10. A cross-platform unified authority management system based on multiple WEB systems, applied to a cross-platform unified authority management method based on multiple WEB systems as claimed in any one of claims 1 to 9, characterized in that: include: Parsing module: obtains the organizational structure data of the enterprise system, parses the organizational structure data, builds a multi-level tree topology network, and forms organizational entity topology parameters; Position authority module: parses the topological parameters of organizational entities and generates baseline parameters for position authority; Permission interface module: extracts the API gateways of various WEB systems, generates permission interface policies, calculates the baseline parameters of job permissions, and generates cross-system adaptation rule parameters; Channel selection module: builds a dual-channel transmission decision maker based on organizational structure data, interaction characteristics between various WEB systems, and cross-system adaptation rule parameters, and generates channel selection decision parameters in combination with real-time network status data; Permission propagation module: triggers the synchronization engine to execute cross-system permission configuration based on channel selection decision parameters, and generates permission propagation path parameters with timestamps by associating organizational entity topology parameters through the permission tracker; Permission validation module: deploys policy executors on the permission management terminals of each WEB system, collects permission validation status based on permission propagation path parameters with timestamps, and generates distributed verification parameters; Permission synchronization module: performs multi-modal verification on distributed verification parameters and generates global permission synchronization achievement identification parameters; Panoramic module: If the global permission synchronization is achieved identification parameter is false, a compensation instruction queue is generated, and based on the compensation instruction queue, permission panoramic situation parameters are generated.

Images