Communication software information access control method, computer device and medium

Abstract

The invention discloses a communication software information access control method, a computer device and a medium. The method comprises the following steps: in response to a communication software information access request, determining an access user ID, a to-be-queried organization ID and an access personnel permission type, if the access user ID exists in communication software, obtaining the organization ID to which the access user ID belongs, and combining the access user ID and the to-be-queried organization ID into an organization ID list; obtaining a preset organization identifier of each organization ID in the list, and adding the preset organization identifiers to obtain a query organization identifier; if the identifier is consistent with an organization identifier transmitted by the client, calling an organization structure and personnel information corresponding to the to-be-queried organization ID from a local data storage library of the client and feeding back the organization structure and personnel information to the requester; if not, obtaining the on-off state of the organization strategy to be inquired, and feeding back access information according to the first access strategy when the on-off state of the on-off state; and when the switch is turned on, feeding back access information according to the second access strategy. According to the method, high-flexibility, high-security, efficient and accurate access control can be realized.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, specifically to the field of information access control and security management technology for enterprise-level communication software, and in particular to a communication software information access control method, computer device, and medium. Background Art

[0002] In the field of enterprise communication and collaboration software, current organizational structures and personnel visibility control technologies suffer from significant deficiencies in flexibility and security, severely impacting the efficiency and security of enterprise communication and collaboration. Specifically, most software utilizes a fixed permissions management model. When setting personnel visibility, only simple operations such as opening or restricting information by department are possible. It's impossible to specifically open information about certain teams or specific individuals within a department to other departments based on specific business needs. This "one-size-fits-all" approach struggles to adapt to complex enterprise business collaboration scenarios. When employees collaborate across departments, they either experience reduced work efficiency due to a lack of access to sufficient personnel information or increased information screening costs due to excessive irrelevant information.

[0003] In addition, existing software generally lacks refined management of permissions for viewing personnel contact information and initiating chats. Generally, after a user is granted permission to view personnel information, he or she automatically obtains permission to view contact information and initiate chats. However, in scenarios involving commercial secrets, preliminary business negotiations, etc., this situation poses a greater security risk. For example, in a commercial secret project, non-project team members obtaining the contact information of project members may lead to the leakage of confidential information; opening up chat permissions too early in the preliminary business negotiation stage may disrupt the business process and affect the progress of cooperation. Summary of the Invention

[0004] In view of this, the embodiments of the present disclosure provide a communication software information access control method, computer device, and medium, which can solve the problems existing in the prior art of poor flexibility and security of enterprise communication and collaboration software in terms of organizational structure and personnel visibility control.

[0005] In a first aspect, an embodiment of the present disclosure provides a communication software information access control method, characterized by comprising:

[0006] In response to a communication software information access request, determine the access user ID, the organization ID to be queried, and the permission type of the access person;

[0007] When the access user ID exists in the communication software, obtaining the organization ID corresponding to the access user ID;

[0008] Combine the organization ID and the organization ID to be queried to form an organization ID list;

[0009] Obtaining the preset organization identifier for each organization ID in the organization ID list, adding up all the preset organization identifiers to obtain a sum of identifier values, which is recorded as the query organization identifier; when the query organization identifier is consistent with the organization identifier input by the client, retrieving the organizational structure and personnel information corresponding to the organization ID to be queried from the client's local data repository, and feeding back the information to the accessing user;

[0010] When the query organization identifier is inconsistent with the organization identifier input by the client, obtaining the policy switch status of the organization to be queried;

[0011] When the switch state of the organization policy to be queried is off, feeding back access information to the accessing user according to the called first access policy;

[0012] When the switch state of the organization policy to be queried is on, access information is fed back to the accessing user according to the called second access policy.

[0013] Optionally, when the switch state of the organization policy to be queried is off, feeding back access information to the accessing user according to the called first access policy includes:

[0014] When the switch state of the organization policy to be queried is off, calling the first access policy, and feeding back access information to the accessing user according to the first access policy;

[0015] The first access strategy includes: determining target name information of the access request, obtaining first information corresponding to the target name information, and feeding back the first information to the accessing user;

[0016] The target name information includes the organizational structure information requested for query and the corresponding personnel information; the first information is the actual detailed information corresponding to the target name information.

[0017] Optionally, when the switch state of the organization policy to be queried is on, feeding back access information to the accessing user according to the called second access policy includes:

[0018] Determine the department to which the accessing user ID described in the communication software belongs;

[0019] Obtain all organizations in the department whose organization policy switch status is on, record them as target organizations, and store the organization IDs of all target organizations in the target set;

[0020] Determine whether the data exists in the target set. If so, invoke the first sub-strategy and feedback access information to the accessing user according to the first sub-strategy;

[0021] If not, the second sub-strategy is called, and access information is fed back to the accessing user according to the second sub-strategy.

[0022] Optionally, when the target set is empty, determine whether the organization ID to be queried is a root organization ID; if so, determine whether the organization to be queried is the organization to which the accessing user ID belongs; if so, obtain the first-level node information corresponding to the organization ID to be queried, and feed back the first-level node information to the accessing user;

[0023] The root organization is the top-level structure configured in the communication software, and the root organization includes a first-level node; when the organization ID to be queried is the root organization ID, the organization corresponding to the access user ID is the first-level node;

[0024] If the organization to be queried is not the organization corresponding to the access user ID, the associated organization information corresponding to the organization corresponding to the access user ID is obtained, and the associated organization information is fed back to the access user.

[0025] Optionally, when the target set is empty and the organization ID to be queried is not a root organization ID, determining whether the organization to be queried is a child organization of the organization corresponding to the accessing user ID; if so, obtaining non-first-level node information corresponding to the organization ID to be queried, and feeding back the non-first-level node information to the accessing user;

[0026] If the organization to be queried is not a sub-organization under the organization corresponding to the access user ID, a prompt indicating that no access rights are available is fed back to the access user;

[0027] When the organization ID to be queried is not the root organization ID, the child organization under the organization is a non-first-level node in the root organization.

[0028] Optionally, when the target set is not empty, determine whether the organization ID to be queried is a root organization ID; if so, determine whether the organization to be queried belongs to the target set; if so, determine whether the organization to be queried is a child organization under the organization corresponding to the access user ID; if not, determine the target node corresponding to the organization ID to be queried from the target set according to a preset node code; obtain the associated organization information of the first-level node corresponding to the target node, and feed back the associated organization information of the first-level node to the access user;

[0029] If the target set is not empty, the organization ID to be queried is the root organization ID, the organization to be queried belongs to the target set, and the organization to be queried is a child organization under the organization corresponding to the accessing user ID, obtain the associated organization information of the first-level node corresponding to the organization ID to be queried, and feedback the associated organization information of the first-level node to the accessing user;

[0030] The preset node code is a unique code corresponding to each node in the organizational structure of the communication software;

[0031] The target node is another organization in the target set that the organization corresponding to the access user ID has visibility permission to.

[0032] Optionally, when the target set is not empty, the organization ID to be queried is a root organization ID, and the organization to be queried does not belong to the target set, determine whether there is a child node organization under the organization to be queried in the target set; if so, obtain the associated organization information of the child node organization under the organization to be queried and feedback it to the accessing user;

[0033] If not, a prompt indicating that the access permission is not available will be fed back to the accessing user.

[0034] Optionally, when the target set is not empty, the organization ID to be queried is not a root organization ID, and the organization to be queried belongs to the target set, determining the target node corresponding to the organization ID to be queried from the target set according to a preset node code; obtaining the associated organization information of the non-first-level node corresponding to the target node, and feeding back the associated organization information of the non-first-level node to the accessing user;

[0035] When the target set is not empty, the organization ID to be queried is not the root organization ID, and the organization to be queried does not belong to the target set, a prompt indicating that there is no access permission is fed back to the accessing user.

[0036] In a second aspect, the embodiments of the present disclosure further provide a computer device that adopts the following technical solution:

[0037] The computer device comprises:

[0038] at least one processor; and,

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any of the above-mentioned communication software information access control methods.

[0041] In a third aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned communication software information access control methods.

[0042] In a fourth aspect, an embodiment of the present disclosure further provides a computer program product, comprising a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0043] The communication software information access control method disclosed in the present application responds to the communication software information access request, determines the access user ID, the organization ID to be queried and the permission type of the access person, and when the access user ID exists in the communication software, obtains the organization ID corresponding to the access user ID, combines the organization ID with the organization ID to be queried to form an organization ID list, which enables the system to handle the information access relationship between different organizations more meticulously; obtains the preset organization identifier of each organization ID in the organization ID list, adds up all the preset organization identifiers to obtain the total identifier value, and records it as the query organization identifier; when the query organization identifier is consistent with the organization identifier passed in by the client, calls the organization ID corresponding to the organization ID to be queried from the client's local data repository The information of the organization structure and personnel is obtained and fed back to the accessing user; when the organization identifier to be queried is inconsistent with the organization identifier passed in by the client, the switch status of the organization policy to be queried is obtained; when the switch status of the organization policy to be queried is off, the access information is fed back to the accessing user according to the called first access policy. This flexible policy selection mechanism can dynamically adjust the access scope of information according to different business needs. For example, in some daily collaboration scenarios, the switch of the organization policy to be queried is turned off, and the first access policy can provide a wider range of information, making it convenient for employees to obtain sufficient personnel information to improve work efficiency; when sensitive projects are involved, the switch is turned on, and the second access policy can limit access to information, avoid employees from obtaining too much irrelevant information, and reduce the cost of information screening. The information access control method for communication software proposed in this application significantly improves the flexibility and security of enterprise communication and collaboration software through flexible information opening methods, multi-policy information feedback mechanisms, organization identifier verification, and sophisticated permission management, improves work efficiency, and ensures information security.

[0044] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0046] Figure 1 A flowchart of a communication software information access control method provided in an embodiment of the present disclosure.

[0047] Figure 2 A flowchart of a method for feeding back access information to an accessing user according to a called second access policy provided in an embodiment of the present disclosure.

[0048] Figure 3 A flowchart of an analysis method provided in an embodiment of the present disclosure when the target set is empty and the organization ID to be queried is the root organization ID.

[0049] Figure 4 A flowchart of an analysis method provided in an embodiment of the present disclosure when the target set is empty and the organization ID to be queried is not the root organization ID.

[0050] Figure 5 A flowchart of an analysis method provided in an embodiment of the present disclosure when the target set is not empty, the organization ID to be queried is the root organization ID, and the organization to be queried belongs to the target set.

[0051] Figure 6 A flowchart of an analysis method provided in an embodiment of the present disclosure when the target set is not empty, the organization ID to be queried is the root organization ID, and the organization to be queried does not belong to the target set.

[0052] Figure 7 A flowchart of an analysis method provided in an embodiment of the present disclosure when the target set is not empty and the organization ID to be queried is not the root organization ID.

[0053] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0054] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0055] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0056] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0057] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0058] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0059] Reference Figure 1 , this application discloses a communication software information access control method, comprising:

[0060] S100, in response to a communication software information access request, determining an access user ID, an organization ID to be queried, and a permission type of the access person.

[0061] Suppose a company uses a communication software, and employee A needs to access information from the R&D department. Employee A initiates a request to access the communication software information. After receiving the request, the system identifies the access user ID as employee A's work number (such as 001) and the organization ID to be queried as the unique identifier of the R&D department (such as 1001). At the same time, based on employee A's permission settings in the system, the permission type is determined to be ordinary employee permission. The key information of the access request is clarified to provide a basis for subsequent permission verification and information query, ensuring that the system can accurately process user requests.

[0062] S200: When there is an access user ID in the communication software, obtain the organization ID corresponding to the access user ID.

[0063] For example, searching for the access user ID (001) in the user information database of the communication software reveals that the organization ID to which employee A belongs is the marketing department's ID (e.g., 2001). Obtaining information about the access user's organization helps determine the relationship between the user and the organization being queried, providing a basis for subsequent permission control.

[0064] S300: Combine the organization ID to which the user belongs with the organization ID to be queried to form an organization ID list.

[0065] For example, combine the marketing department organization ID (2001) to which employee A belongs and the R&D department organization ID (1001) to be queried to form the organization ID list [2001,1001]. Integrating related organization IDs facilitates subsequent unified processing of organizational information and improves system processing efficiency.

[0066] S400 , obtaining a preset organization identifier of each organization ID in the organization ID list, adding up all the preset organization identifiers to obtain a total identifier value, which is recorded as the query organization identifier.

[0067] For example, each organization ID is pre-assigned an organization ID. Assume that the preset organization ID of the marketing department (2001) is 10, and the preset organization ID of the R&D department (1001) is 20. Adding these two preset organization IDs, 10 + 20 = 30, yields a query organization ID of 30. By calculating the query organization ID, a comparable standard is provided for subsequent organization ID verification, increasing the security of information access and the accuracy of verification.

[0068] S500: When the queried organization ID is consistent with the organization ID input by the client, the organizational structure and personnel information corresponding to the queried organization ID are retrieved from the client's local data repository and fed back to the accessing user.

[0069] For example, the organization ID passed in by the client when initiating the request is also 30, which is consistent with the query organization ID calculated by the system. At this time, the system retrieves the organizational structure (such as the hierarchical relationship of department leaders, team leaders, etc.) and personnel information (such as employee names, contact information, etc.) corresponding to the R&D department (1001) from the client's local data repository, and feeds this information back to the accessing user where employee A is located. When the organization ID verification is passed, the information is directly obtained and fed back from the local data repository, effectively reducing the time for data transmission and processing and improving the response speed of information access.

[0070] S600: When the queried organization identifier is inconsistent with the organization identifier input by the client, obtain the switch status of the organization policy to be queried.

[0071] For example, if the organization ID passed in by the client is 40, which is inconsistent with the query organization ID calculated by the system (30), the system will further obtain the policy switch status of the query organization (R&D department, 1001). If the organization ID verification fails, the policy switch status is introduced as a further permission control method, increasing the flexibility and security of the system.

[0072] S700: When the switch status of the organization policy to be queried is off, access information is fed back to the accessing user according to the called first access policy.

[0073] For example, if the query finds that the policy switch status of the R&D department is closed, the system calls the first access policy; assuming that the first access policy stipulates that ordinary employees can only obtain some public information of the R&D department, such as the department name, main business direction, etc., the system will feedback this information to employee A.

[0074] When the policy switch is turned off, limited access information is provided according to the preset first access policy, which protects the organization's sensitive information while meeting some of the user's needs.

[0075] S800: When the switch status of the organization policy to be queried is on, access information is fed back to the accessing user according to the called second access policy.

[0076] For example, if the R&D department's policy switch is on, the system invokes the second access policy. Assuming the second access policy stipulates that ordinary employees can access the R&D department's detailed organizational structure and some non-sensitive personnel information, the system will feedback this information to employee A. When the policy switch is on, the second access policy provides richer access information, meeting user needs while ensuring information security to a certain extent. Access permissions can be flexibly adjusted based on the different policy switch states.

[0077] The communication software information access control method disclosed in S100-S800 responds to the communication software information access request, determines the access user ID, the organization ID to be queried and the permission type of the access person, and when the access user ID exists in the communication software, obtains the organization ID corresponding to the access user ID, combines the organization ID with the organization ID to be queried to form an organization ID list, which enables the system to handle the information access relationship between different organizations more meticulously; obtains the preset organization identifier of each organization ID in the organization ID list, adds up all the preset organization identifiers to obtain the sum of the identifier values, and records it as the query organization identifier; when the query organization identifier is consistent with the organization identifier passed in by the client, calls the organization ID to be queried from the client's local data repository The corresponding organizational structure and personnel information are fed back to the accessing user; when the queried organization identifier is inconsistent with the organization identifier passed in by the client, the switch status of the organization policy to be queried is obtained; when the switch status of the organization policy to be queried is off, the access information is fed back to the accessing user based on the called first access policy. This flexible policy selection mechanism can dynamically adjust the access scope of information according to different business needs. For example, in some daily collaboration scenarios, the organization policy to be queried is turned off, and the first access policy can provide a wider range of information, making it convenient for employees to obtain sufficient personnel information to improve work efficiency; when sensitive projects are involved, the switch is turned on, and the second access policy can limit access to information, preventing employees from obtaining too much irrelevant information and reducing information screening costs. The communication software information access control method proposed in this application significantly improves the flexibility and security of enterprise communication and collaboration software through flexible information opening methods, multi-strategy information feedback mechanisms, organizational identifier verification, and sophisticated permission management, thereby improving work efficiency and ensuring information security.

[0078] S700, "When the switch status of the organization policy to be queried is off, feeding back access information to the accessing user based on the invoked first access policy," specifically includes: when the switch status of the organization policy to be queried is off, invoking the first access policy, and feeding back access information to the accessing user based on the first access policy. The first access policy includes: determining the target name information of the access request, obtaining first information corresponding to the target name information, and feeding back the first information to the accessing user.

[0079] The target name information includes the organizational structure information requested for query and the corresponding personnel information; the first information is the actual detailed information corresponding to the target name information.

[0080] In this embodiment, the first access policy can clearly define the information content that users can obtain; for example, ordinary employees can only obtain some public information of the R&D department, such as the department name, main business direction, etc. This means that sensitive information within the organization, such as core technical details, undisclosed project plans, employees' private contact information, etc., will not be leaked at will. Through this precise information restriction, the risk of sensitive information being improperly obtained and disseminated is effectively reduced, thereby ensuring the security of organizational information.

[0081] Different organizations or departments may have different security level requirements. For some departments involving core business secrets, the first access policy can strictly limit the disclosure of information; while for relatively open departments, the scope of information provision can be appropriately relaxed. This method of flexibly adjusting information access according to security levels enables organizations to better manage their own information assets and ensure that important information is properly protected.

[0082] Even when the policy switch is turned off, users can still obtain some basic information about the target organization, such as organizational structure information and actual detailed information in the corresponding personnel information (within the scope permitted by the first access policy). This information is helpful for users to understand the basic situation of the organization, conduct general work exchanges or cross-departmental collaboration. For example, by obtaining the name and main business direction of the R&D department, employee A can have a preliminary understanding of the department, which facilitates better communication and cooperation with the department at work. This method not only protects the organization's sensitive information, but also meets the user's demand for information to a certain extent, achieving a balance between information security and user needs. Users do not need to be completely unable to obtain any relevant information due to the policy switch being turned off, thereby avoiding the problem of low work efficiency caused by lack of information.

[0083] The first access policy can be dynamically adjusted according to different business scenarios and needs. For example, in certain specific periods or projects, the organization may need to impose stricter restrictions on information access. In this case, the first access policy can be modified to reduce the scope of public information. In other cases, in order to promote team collaboration and information sharing, the policy can be appropriately relaxed to provide more information. This flexibility enables organizations to better adapt to the ever-changing business environment.

[0084] Different types of users may have different information access needs; the first access policy can be customized for different user roles (such as ordinary employees and management). For example, management may need to access more detailed organizational structure and personnel information, while ordinary employees can only access a portion of public information. This customized policy setting can meet the diverse needs of different users, improving user experience and work efficiency.

[0085] Reference Figure 2S800, “When the switch state of the organization policy to be queried is on, feeding back access information to the access user according to the invoked second access policy,” i.e., a method of feeding back access information to the access user according to the invoked second access policy, specifically includes:

[0086] A100 determines the department to which the access user ID in the communication software belongs.

[0087] For example, the access user ID is employee A, whose employee number is 001. The communication software's user information database stores detailed information about each user, including their department. By querying this database, the system determines that employee A belongs to the Marketing department, whose department ID is 2001. Clarifying the user's department is essential for subsequent processing. Different departments may have different organizational policies and data access permissions. By identifying the department, appropriate access policies can be formulated and implemented based on the department's characteristics, ensuring more precise permission control.

[0088] A200 obtains all organizations in the department whose organizational policy switch status is on, records them as target organizations, and stores the organization IDs of all target organizations in the target set.

[0089] For example, the Marketing department (department ID 2001) may contain multiple organizations, such as the Marketing Promotion Group (organization ID 200101) and the Market Research Group (organization ID 200102). The system will traverse all organizations under the Marketing department and check the policy switch status of each organization. Assuming the Marketing Promotion Group's policy switch status is on, while the Market Research Group's policy switch status is off, the Marketing Promotion Group is the target organization, and its organization ID 200101 is stored in the target collection.

[0090] Filter out organizations with policy switches turned on in their departments, providing a clear scope for subsequent policy calls. Only organizations with policy switches turned on can be provided with additional access rights. This allows for centralized processing of organizations with open permissions, improves system processing efficiency, and better controls the scope of information access.

[0091] A300 determines whether data exists in the target set. If so (i.e., the target set is not empty), invokes the first sub-strategy and feeds back access information to the accessing user according to the first sub-strategy.

[0092] If not, the second sub-strategy is called, and access information is fed back to the accessing user according to the second sub-strategy.

[0093] Assume that the target set stores the marketing group's organization ID 200101, indicating that there is an organization with the policy switch turned on. At this time, the system calls the first sub-policy. The system extracts this information from the corresponding database or storage based on this policy and feeds it back to the access user of employee A.

[0094] If, after checking, the policy switch status of all organizations under the marketing department is off and the target set is empty, the system calls the second sub-policy, and the system obtains and feeds back the corresponding information to the accessing user according to this policy.

[0095] Different sub-strategies are called based on whether there is data in the target set, which increases the flexibility and adaptability of the system; when an organization opens access rights, more detailed information is provided; when no organization opens access rights, some basic general information is provided, which not only meets the information needs of users in different situations, but also ensures the security and reasonable access of information.

[0096] The method disclosed by A100-A300, which feeds access information back to the accessing user based on the invoked second access policy, determines the user's department, filters out organizations with policy switches enabled, and finally invokes different sub-policies based on the organizational situation. This achieves precise control over user information access rights. Information access for different departments and organizations can be flexibly configured based on actual conditions, preventing abuse of permissions. The information provided to users can be dynamically adjusted based on the status of the organizational policy switches within their departments. Whether there are organizations with open permissions or all organizations with permissions closed, appropriate information can be provided to meet information access needs in various business scenarios. Throughout the entire process, only organizations and information that meet specific conditions are provided to users, strictly controlling the scope of information dissemination. Even when the policy switch is enabled, sub-policies further restrict access content to ensure the security of organizational information.

[0097] Reference Figure 3 When the target set is empty and the organization ID to be queried is the root organization ID, the analysis method specifically includes: determining whether the organization to be queried is the organization corresponding to the accessing user ID; if the organization to be queried is the organization corresponding to the accessing user ID, obtaining the first-level node information corresponding to the organization ID to be queried, and feeding back the first-level node information to the accessing user.

[0098] Among them, the root organization is the top-level structure configured in the communication software, and the root organization includes a first-level node; when the organization ID to be queried is the root organization ID, the organization corresponding to the access user ID is a first-level node.

[0099] If the organization to be queried is not the organization corresponding to the access user ID, the associated organization information corresponding to the organization corresponding to the access user ID is obtained, and the associated organization information is fed back to the access user.

[0100] In the context of information access control within communication software, when the target set is empty and the organization ID being queried is the root organization ID, specific analysis and processing are required. The root organization is the top-level structure configured within the communication software, containing first-level nodes. When the root organization ID is queried, the organization corresponding to the accessing user ID is a first-level node.

[0101] First, the system determines whether the organization being queried is the organization corresponding to the accessing user's ID. If so, the system retrieves the first-level node information corresponding to the queried organization ID. Since the root organization contains a first-level node, and the accessing user's organization is a first-level node, the first-level node information is retrieved and fed back to the accessing user. For example, in an enterprise's communication software, the root organization is the entire enterprise, and the first-level nodes are the major departments (such as R&D, Marketing, etc.). When an employee queries the root organization information and their department is a first-level node (such as R&D), the system will feed back the information of the R&D department's first-level node (such as the department structure and key personnel).

[0102] If the organization being queried is not the organization corresponding to the accessing user's ID, the system will retrieve the associated organizational information for the corresponding organization and provide it to the accessing user. This associated organizational information may be information about organizations that have business dealings, partnerships, or other relationships with the user's organization. For example, if an employee belongs to the Marketing department and the root organization information they are querying for is related to the R&D department, the system will retrieve the organizational information associated with the Marketing department (such as information about R&D teams that frequently collaborate with the Marketing department) and provide it to the employee.

[0103] Different types of information are provided based on the relationship between the user's organization and the organization to be queried. When a user queries the information of a first-level node to which they belong, the first-level node information is directly fed back, allowing the user to quickly obtain detailed information about the organization closely related to them, satisfying their needs for their own department information. When the query is not about the organization to which they belong, providing information about related organizations also allows users to obtain valuable information that may be relevant to their work, avoiding the provision of irrelevant or excessive information and improving the accuracy of information acquisition. This personalized information feedback method takes into account the actual situation and needs of users. When users query root organization information, whether they are querying their own organization or other organizations, they can obtain information that meets their needs, reducing the time and energy users spend filtering irrelevant information, enabling them to obtain the required content more efficiently, thereby improving the user experience in the communication software.

[0104] When users can access information about related organizations, it helps strengthen understanding and communication between different departments. For example, after learning about related R&D groups, marketing staff can better collaborate with the R&D team, promote cross-departmental projects, and ultimately improve work efficiency and collaboration across the entire organization. This method does not arbitrarily provide all the information of the root organization, but instead provides targeted feedback based on the user's organization. This ensures the security of internal organizational information to a certain extent and prevents excessive leakage of sensitive information. At the same time, it allows users to obtain necessary information within a reasonable range, achieving a balance between information security and information flow.

[0105] Reference Figure 4 When the target set is empty and the organization ID to be queried is not the root organization ID, the analysis method specifically includes:

[0106] Determine whether the organization to be queried is a sub-organization under the organization corresponding to the accessing user ID. If so, obtain the non-first-level node information corresponding to the organization ID to be queried and feedback the non-first-level node information to the accessing user;

[0107] If the organization being queried is not a sub-organization under the organization corresponding to the accessing user ID, a prompt indicating that no access rights are granted will be fed back to the accessing user.

[0108] When the organization ID to be queried is not the root organization ID, the child organizations under the organization are non-first-level nodes in the root organization.

[0109] In the context of information access control in communication software, when there's no matching data in the target set and the organization ID being queried isn't the root organization ID, specific logic is required to process the access request. The root organization is the top-level structure in the communication software, containing first-level nodes. When the organization ID being queried isn't the root organization ID, the sub-organizations under it are non-first-level nodes within the root organization. First, the system determines whether the organization being queried is a sub-organization of the organization corresponding to the accessing user's ID. If so, it retrieves the non-first-level node information corresponding to the organization ID being queried and provides feedback to the accessing user. For example, in enterprise communication software, the root organization is the entire enterprise, and the first-level nodes are the major departments (such as the Sales Department or the Technology Department). Under the Sales Department, there are sub-organizations (non-first-level nodes) such as regional sales teams. If a sales employee queries for information about a regional sales team within their department, the system retrieves relevant information about that regional sales team (non-first-level node), such as team members and performance, and provides feedback to the employee.

[0110] If the organization being queried isn't a sub-organization of the organization corresponding to the user ID, the system will notify the user that they don't have access rights. For example, if a sales employee wants to query information about a project team under the technical department, the system will inform them that they don't have access rights because the project team isn't a sub-organization of the sales department.

[0111] By strictly limiting user access to information within sub-organizations of their own organization, users are prevented from arbitrarily accessing sensitive information from unrelated organizations. Different organizations may have different business data and confidential information. This access control mechanism prevents information leaks and protects the company's core data and trade secrets. For example, project development details within the technology department may be sensitive to sales staff. Restricting sales staff's access to information within the technology department's sub-organizations effectively ensures the security of technology development information.

[0112] Clearly defining the scope of user information access allows users to clearly understand which organizations' information they can access. This helps standardize user information acquisition behavior and reduces confusion and disputes caused by unclear information access rights. When employees query information, they can quickly determine whether they have access rights based on the rules, improving information query efficiency.

[0113] This access control approach aligns with an enterprise's organizational management structure. Within an enterprise, employees typically have a greater understanding of the business operations of their own department and its sub-organizations, and may even be required to participate in related work. Allowing employees to access information within sub-organizations within their own organization can meet their daily information needs and promote collaboration and communication within the organization. For example, a sales manager can better understand business progress and make informed decisions by accessing information from their regional sales teams. This also prevents users from ineffectively querying unauthorized information, reducing the system's processing burden. The system eliminates the need for complex data retrieval and processing for unauthorized access requests, freeing up resources to process legitimate access requests, thereby improving the system's overall operational efficiency and response speed.

[0114] Reference Figure 5 When the target set is not empty, the organization ID to be queried is the root organization ID, and the organization to be queried belongs to the target set, the analysis method specifically includes:

[0115] Determine whether the organization to be queried is a sub-organization under the organization corresponding to the accessing user ID. If not, determine the target node corresponding to the organization ID to be queried from the target set according to the preset node code; obtain the associated organization information of the first-level node corresponding to the target node, and feedback the associated organization information of the first-level node to the accessing user.

[0116] If the target set is not empty, the organization ID to be queried is the root organization ID, the organization to be queried belongs to the target set, and the organization to be queried is a child organization under the organization corresponding to the accessing user ID, obtain the associated organization information of the first-level node corresponding to the organization ID to be queried, and feedback the associated organization information of the first-level node to the accessing user.

[0117] Among them, the preset node code is the unique code corresponding to each node in the organizational structure of the communication software; the target node is other organizations in the target set that have visible permissions to the organization corresponding to the access user ID. In the organizational information query scenario of the communication software, when there is data in the target set, the organization ID to be queried is the root organization ID, and the organization to be queried belongs to the target set, different processing is required based on the relationship between the organization to be queried and the organization to which the access user belongs; the preset node code is the unique identifier corresponding to each node in the organizational structure of the communication software, and the target node is other organizations in the target set that have visible permissions to the organization corresponding to the access user ID. First, determine whether the organization to be queried is a child organization under the organization corresponding to the access user ID. If not, determine the target node corresponding to the organization ID to be queried from the target set based on the preset node code. The target node represents other organizations in the target set that have visible permissions to the organization to which the access user belongs.

[0118] Then, the system retrieves the associated organization information of the first-level node corresponding to the target node and feeds this information back to the accessing user. For example, in an enterprise communication software, the root organization is the entire enterprise, the accessing user belongs to the marketing department, and the organization to be queried is the R&D department (not a sub-organization of the marketing department). The system will find the target node corresponding to the R&D department based on the preset node code, and then retrieve the associated organization information (such as cooperating external organizations, related project teams, etc.) of the first-level node (such as the R&D department) corresponding to the target node and feed it back to the user.

[0119] If the organization being queried is a sub-organization of the organization corresponding to the accessing user's ID, the system directly retrieves the associated organization information of the first-level node corresponding to the accessing user's ID and provides feedback to the accessing user. For example, if the accessing user belongs to the Sales Department and the organization being queried is a regional sales team under the Sales Department (a sub-organization of the Sales Department), the system will retrieve the associated organization information of the first-level node corresponding to the regional sales team (i.e., the Sales Department) (such as market research organizations and logistics partners that work with the Sales Department) and provide feedback to the user.

[0120] By distinguishing the relationship between the organization being queried and the user's organization, users are provided with information about associated organizations at the first-level nodes with visibility permissions related to the queried organization. This ensures that the information users obtain is relevant to their work scenarios or business needs, avoids providing excessive irrelevant information, and improves the accuracy and usefulness of the information. For example, when a marketing employee queries R&D department information, they can obtain information about the first-level nodes associated with the R&D department, helping them understand the external collaboration status of the R&D business and providing reference for marketing promotion.

[0121] Using preset node codes to determine the target node ensures that information access is based on the permission rules of the organizational structure. Only information of other organizations with visibility permissions to the organization to which the accessing user belongs will be provided. This helps maintain the security and confidentiality of internal information in the organization. Information visibility between different departments can be flexibly configured according to business needs and security policies to prevent improper leakage of sensitive information.

[0122] Providing information about the associated organizations of a first-level node helps strengthen communication and collaboration between different organizations. By understanding this information, users can identify potential partnership opportunities and expand business channels. For example, after learning about the logistics partners associated with the first-level node of the sales department, sales staff may be able to deepen their collaboration with these partners to optimize product delivery processes and improve customer satisfaction.

[0123] This analysis method simplifies the process of information query and feedback, and quickly locates and obtains relevant information based on the relationship between the organization to be queried and the organization to which the user belongs. Users can directly obtain valuable information without performing complex search and screening operations, saving time and energy and improving work efficiency.

[0124] Reference Figure 6 When the target set is not empty, the organization ID to be queried is the root organization ID, and the organization to be queried does not belong to the target set, the analysis method specifically includes:

[0125] Determine whether there is a child node organization under the organization to be queried in the target set. If so, obtain the associated organization information of the child node organization under the organization to be queried and feedback it to the accessing user; if not, feedback a prompt that no access permission is provided to the accessing user.

[0126] In the organizational information query scenario of communication software, when the target set is not empty, the organization ID to be queried is the root organization ID, but the organization to be queried itself is not in the target set, the query request needs to be processed according to specific logic. First, determine whether there are child node organizations under the organization to be queried in the target set. If so, obtain the associated organization information of these child node organizations and feed it back to the accessing user. For example, in the communication software of a large enterprise, the root organization is the entire group company, and the organization to be queried may be a business segment under the group that has not yet been included in the current target set, but the target set contains subsidiary information under this business segment. At this time, the system will obtain the associated organization information of these subsidiaries (such as partners, upstream and downstream suppliers, etc.) and feed it back to the inquirer.

[0127] If the target set does not contain any child organizations under the organization being searched, the system will notify the user that they do not have access rights. This means that the user does not have permission to access any valid information related to the organization being searched. For example, if the user is searching for an emerging, independently operated business unit within a group company, and the target set does not contain information about either the business unit itself or its child organizations, the system will inform the user that they do not have access rights.

[0128] When the target set contains child organizations under the organization being searched, providing information about the child organizations' associated organizations can, to a certain extent, satisfy the queryer's need for relevant information. Even if the organization being searched isn't in the target set, the queryer can still use the child organizations' associated information to understand its business connections and external collaborations, providing a reference for decision-making or further understanding of the business.

[0129] If the target set does not contain any child organizations under the organization being queried, a "No Access Permission" prompt will be displayed. This strictly adheres to information access permission rules, helping to prevent unauthorized access and protect an organization's sensitive information and trade secrets. Different organizational levels and business units may have different confidentiality requirements. This approach ensures that relevant information can only be accessed if the permission conditions are met.

[0130] This analysis method provides a clear and precise processing flow, enabling the queryer to quickly obtain results, whether obtaining related information about child organizations or receiving a notification indicating that they do not have access rights. This avoids complex query processes and ambiguous feedback, improving the efficiency and experience of users querying information within communication software. Based on the feedback, users can decide whether to adjust their query strategy or take other actions. The system eliminates the need for excessive searching and processing for queries with no relevant information. When it determines that no child organizations under the organization being queried exist in the target set, it directly returns a notification indicating that they do not have access rights. This reduces the system's processing burden, improves the utilization of system resources, and ensures that the system can more efficiently process other valuable query requests.

[0131] Reference Figure 7 When the target set is not empty and the organization ID to be queried is not the root organization ID, the analysis method includes:

[0132] Determine whether the organization to be queried belongs to the target set. If so, determine the target node corresponding to the organization ID to be queried from the target set based on the preset node code; obtain the associated organization information of the non-first-level node corresponding to the target node, and feedback the associated organization information of the non-first-level node to the accessing user;

[0133] If the target collection is not empty, the organization ID to be queried is not the root organization ID, and the organization to be queried does not belong to the target collection, a prompt indicating that the access permission is denied is fed back to the accessing user.

[0134] In an organization information query scenario, if the target set is not empty and the organization ID being queried is not the root organization ID (i.e., the organization being queried is a sub-organization under the root organization), different processing is required depending on whether the organization being queried is in the target set. First, determine whether the organization being queried belongs to the target set. If the organization being queried is in the target set, the system will determine the target node corresponding to the organization ID in the target set based on the preset node code. The target node represents the accurate mapping of the organization being queried in the target set.

[0135] Then, the system retrieves the associated organization information of the non-first-level node corresponding to the target node and feeds this information back to the accessing user. For example, in an enterprise communication software, the root organization is the entire enterprise, and the organization to be queried is a project team under a department (a non-first-level node). If this project team information is in the target set, the system will locate the target node corresponding to the project team based on the preset node code, and then retrieve the associated organization information related to the project team (such as other cooperating project teams, support teams, etc.) and feed it back to the queryer.

[0136] If the organization being searched isn't in the target set, the user will be prompted with a "No Access Permission" message. This indicates that the user doesn't have permission to access information about the organization. This could be because the organization's information isn't included in the target scope of the query, or the user doesn't have permission to access it. For example, if the user is searching for information about a specific, confidential project team within a company, but that team's information isn't in the target set, the system will notify the user that they don't have permission to access it.

[0137] When the organization being queried belongs to the target set, the target node is accurately identified using a preset node code, and the associated organization information of the corresponding non-first-level node is provided. This provides the queryer with highly relevant and accurate information about the queried organization, avoiding irrelevant or inaccurate information. This improves the quality and practicality of the information and helps the queryer make more accurate decisions. For example, when a project leader queries the associated organization information of a project team, they can obtain information that is practically helpful for project execution.

[0138] For organizations not in the target set, a "no access" prompt is displayed, helping to strictly control access to information. Within an organization, different organizational nodes may have different confidentiality levels and access requirements. This approach ensures that only those who meet the required permissions can access relevant information, protecting the organization's sensitive information and trade secrets.

[0139] Clear processing logic makes the query process more efficient. The inquirer can quickly get feedback results. Whether obtaining the required associated organization information or receiving a prompt of no access rights, the inquirer can adjust the query strategy or take other actions in time, avoiding wasting time and energy on invalid queries.

[0140] The system does not need to conduct excessive searches and processing of organizational information that it does not have access to, effectively reducing the system's processing burden and improving the efficiency of system resource utilization. The system can concentrate more resources on processing legitimate query requests, effectively improving the overall system performance and response speed.

[0141] Before obtaining the target set, this application also includes: configuring the organizational policy switch, configuring the one-way circle and the shared circle, so as to control the visible organizational structure and personnel permissions for personnel at different levels in the same organization, and improve the dimensional control of enterprise-level communication software in personnel information management.

[0142] When an enterprise is in the execution stage of a commercial confidentiality project, it can strictly restrict non-project members from obtaining project members' contact information through visible permission configuration to eliminate the risk of information leakage. In the initial business negotiation scenario, it can flexibly control the chat initiation permissions of both parties to ensure that the business process proceeds in an orderly manner as planned, maintaining the standardization and security of the business process.

[0143] Furthermore, the configuration method of the organizational policy switch status specifically includes: an organizational policy switch variable orgPolicySwitch can be set in the configuration center module. When orgPolicySwitch = "1", it means that the organizational policy switch is turned on; when orgPolicySwitch = "2", it means that the organizational policy switch is turned off; when the user requests to obtain the organizational structure and personnel information, the value of the variable can be read first.

[0144] As the foundational control for the entire permissions management architecture, when the organizational policy is off, the system directly returns the user's query for organizational structure and personnel information. This meets the enterprise's need for full access to organizational structure and personnel information in full-staff collaboration scenarios, facilitating the rapid flow of information. When the organizational policy is on, users are restricted to accessing information only for their organization and its subordinate organizations, ensuring confidentiality between different departments in daily operations and preventing information leaks.

[0145] The organizational policy switch is the fundamental control mechanism for the entire permissions management architecture. Through simple variable settings and status judgments, it enables flexible control over users' access to organizational structure and personnel information. This not only meets the needs for rapid information flow during collaboration among all employees, but also ensures the security of information across different departments in daily operations.

[0146] Furthermore, the configuration method for one-way circles and shared circles specifically includes the following: Two configuration tables related to organizational policies can be created: the organizational policy information table and the organizational policy details table. These tables form the foundation of the entire configuration, storing relevant information about organizational policies through database tables to facilitate system management and query. The organizational policy information table is used to store basic policy information, such as the policy name, policy type (one-way circle or shared circle), whether it is enabled, the source organization ID, the target organization ID, whether sub-organizations are included, and employee level sets. This information is used to describe the overall attributes and scope of application of the policy.

[0147] The organization policy details table is used to record the source organization ID, visible organization details, and employee level sets, providing the detailed information required for specific policy implementation.

[0148] After the administrator configures a one-way or shared circle in the admin area, the system inserts the configuration information into the organization policy information table, but the policy does not take effect at this time. This provides the administrator with an opportunity to review and adjust the configuration to ensure that the information is correct before enabling the policy.

[0149] When the administrator chooses to open a one-way circle or a shared circle, the system first queries the organization policy information table to obtain detailed information about the policy for subsequent processing.

[0150] When obtaining the list of organization IDs, the system obtains the list of organization IDs involved based on the policy type (one-way circle or shared circle). If the policy contains sub-nodes, all sub-nodes will be queried to ensure that all relevant organizations are covered. When obtaining the set of recipient organization IDs, the scope of the organization receiving the information is clarified for subsequent information sharing and permission control. Check whether there is a conflict between the enabled one-way circle or shared circle and the current policy to be enabled to avoid permission confusion or information leakage. Insert and update the organization policy details table, store the detailed information of the policy in the database, and provide a basis for subsequent information interaction.

[0151] The processing flow when an organization moves includes: when an organization moves, the system first queries the policy details based on the organization ID to understand the current policy configuration of the organization; queries all enabled policies (including sub-organization types) to fully understand the policies in effect in the system; judges the query results, and if there are related policies, performs parent-child affiliation judgment to determine the impact of the organization move on the policy; based on the comparison before and after the organization move, determines the permission sets to be removed and added to ensure that the permission configuration is consistent with the changes in the organizational structure; updates or adds organizational policy details, and synchronously updates the policy details of sub-organizations to ensure that the policy configuration under the entire organizational structure is accurate.

[0152] The configuration of one-way and shared circles can meet the information exchange needs between organizations in complex business scenarios. In cross-departmental collaboration, flexible configuration can precisely set the scope of information sharing between specific organizations, promoting collaboration between different departments. The system can independently control whether to view the contact information of users in a specific organization and initiate chats based on business needs, effectively preventing information leakage and ensuring the orderly progress of the collaboration process. For example, the marketing department may only be able to view information of a specific project team in the R&D department, and cannot freely access other sensitive information. This promotes collaboration while protecting the company's core data.

[0153] In summary, this one-way circle and shared circle configuration scheme provides enterprises with a flexible and secure inter-organizational information interaction solution through reasonable database design and perfect processing flow.

[0154] The present invention designs a combined permission management architecture of organizational policy switches, one-way circles and shared circles; the organizational policy switch serves as the basic control. When it is turned off, it realizes the full display of the enterprise's organizational structure and personnel information, meeting the enterprise's information flow needs in a full-staff collaboration scenario; when the organizational policy switch is turned on, the information scope is restricted based on the organization to which the user belongs, ensuring information security in daily business. One-way circles and shared circles are in-depth expansions on this basis. One-way circles can accurately set the information visibility range between specific organizations, such as specifying that a certain organization can see a specific organization and its subordinate users. Shared circles realize the information interaction control of multiple organizations within a shared scope. Members of each organization can view other organizational structures and personnel information in the shared circle as needed, which comprehensively improves the flexibility of permission management and solves the problem of the single permission management mode of existing software.

[0155] The communication software information access control method disclosed in this application is crucial to ensuring the reasonable display and secure access of organizational structure and personnel information in the actual application scenarios of enterprise-level communication software. The organizational policy switch mechanism, the one-way circle and shared circle configuration strategy of the administrator background, etc. involved in this patent are all centered around how to achieve refined and flexible visibility control of different organizational structures and personnel information through algorithms and system architecture design in a software environment, and belong to the category of enterprise-level communication software information access control technology. At the same time, the control of personnel contact information viewing and chat initiation permissions is also closely related to information security management, aiming to prevent information leakage and ensure information security in the process of enterprise communication and collaboration.

[0156] Furthermore, the communication software information access control method disclosed in this application, on the technical level, achieves improved flexibility and accuracy of permission management: the existing software permission management model is single and difficult to meet complex business needs; the present invention realizes multi-dimensional and refined permission control through organizational policy switches, one-way circles and shared circle configurations. Enterprises can flexibly set the visible scope of organizational structure and personnel information according to different business scenarios, such as cross-departmental project collaboration, cross-enterprise cooperation, etc., accurately to specific organizations, specific personnel and even specific employee levels, greatly improving the flexibility and accuracy of information management, and providing more powerful technical support for enterprise communication and collaboration.

[0157] In terms of security control, the existing technology has obvious deficiencies and lacks effective management of the permissions for viewing contact information and initiating chats. The present invention sets up independent permission control fields, and performs fine management of the permissions for viewing contact information and initiating chats in one-way circles and shared circles respectively, effectively preventing information leakage and ensuring the security of enterprise information. The multi-level and multi-dimensional security control system enables enterprises to flexibly respond to information security challenges in different business scenarios, thereby improving the security and stability of the software.

[0158] On an economic level, it can effectively improve work efficiency and reduce communication costs. Precise permission management and information visibility control enable employees to quickly access the information they need during collaboration, avoiding time wasted due to untimely information acquisition or excessive irrelevant information, thereby improving work efficiency. In cross-departmental projects, the marketing department can quickly obtain relevant information from specific R&D project teams, reducing communication barriers and coordination costs, facilitating the efficient progress of projects, and thus saving the company significant manpower and time costs. It also effectively prevents information leaks, reducing potential financial losses to the company due to information security issues. In projects involving commercial secrets, strictly controlling access to project member contact information by non-project team members avoids the risks of market competitive disadvantages and legal disputes caused by confidential information leaks, saving the company potentially significant financial losses.

[0159] At the social level, it can effectively promote cooperation and development among enterprises; in cross-enterprise cooperation scenarios, the configuration of shared circles enables the effective exchange of information between departments of cooperating enterprises while ensuring information security, thereby promoting cooperation and development among enterprises. This cooperation model helps to promote technological innovation and resource integration in the industry, drive the coordinated development of related industries, and has a positive promoting effect on the overall development of the social economy.

[0160] The present invention provides enterprises with a set of scientific and complete organizational structures and personnel information management tools, which helps enterprises establish standardized information management processes and systems. During use, enterprises can more reasonably allocate information resources and standardize employees' information acquisition and use behaviors, thereby improving the overall management level of the enterprise and promoting the development of enterprise management in a standardized and scientific direction.

[0161] The present application discloses a communication software information access control system, which is used to implement the communication software information access control method disclosed in the first aspect of the present application, specifically comprising:

[0162] An information acquisition module, configured to respond to a communication software information access request and determine the access user ID, the organization ID to be queried, and the permission type of the access person;

[0163] The organization ID acquisition module is used to obtain the organization ID corresponding to the access user ID when there is an access user ID in the communication software;

[0164] The organization ID list acquisition module is used to combine the organization ID to which the organization belongs with the organization ID to be queried to form an organization ID list;

[0165] The query organization ID acquisition module is used to obtain the preset organization ID of each organization ID in the organization ID list, add up all the preset organization IDs to obtain the total identification value, and record it as the query organization ID; the first analysis module is used to call the organizational structure and personnel information corresponding to the query organization ID from the client's local data repository when the query organization ID is consistent with the organization ID input by the client, and feedback it to the accessing user;

[0166] The second analysis module is used to obtain the switch status of the organization policy to be queried when the queried organization identifier is inconsistent with the organization identifier input by the client;

[0167] A first execution module is configured to feed back access information to the accessing user according to the called first access policy when the switch state of the organization policy to be queried is off;

[0168] The second execution module is used to feed back access information to the accessing user according to the called second access policy when the switch state of the organization policy to be queried is on.

[0169] Furthermore, the source secret information access control system is used as an example for detailed description. The source secret information access control system may include a secret information management backend, an organization module, a user module, an organization identification configuration module, a configuration center, a database module, and a cache module.

[0170] The MeSign Management Backend provides an intuitive graphical user interface (GUI) that allows administrators to easily configure the system without the need for complex command line operations, lowering the barrier to entry. It also allows administrators to manage organizations, personnel permissions, and policy switches. For example, you can create new organizations, assign different permissions to different personnel, and enable or disable certain system policies.

[0171] The organizational module can add, modify, delete and query organizational structure information, such as creating a new department (add), adjusting the name or person in charge of a department (modify), revoking a department (delete), and viewing detailed information of a department (query); at the same time, visibility and chat permissions between different organizations can be set, and the system will automatically detect whether there are conflicts in these permission settings. For example, department A can see department B's contact information and initiate chats, while department B cannot see department A's contact information. The system will detect whether this setting is reasonable; in addition, detailed policy information of each organization can be recorded to facilitate subsequent queries and management.

[0172] The organization ID can be represented by the orgID field. It is a unique identifier for an organization and is used to uniquely identify an organization in the system. For example, "1000001" represents a specific organization.

[0173] Visible organization details can be represented using the targetInfo field, which contains information for multiple organizations. Each organization's information consists of three parts: orgID, whether contact information is visible, and whether chat initiation is possible, separated by commas. For example, "1000002YY" indicates the organization with ID 1000002. Other organizations can see its contact information and initiate chats.

[0174] The employee level set can be represented by the userAttribute field, with different employee levels separated by commas. For example, "1,2" means employees with levels 1 and 2.

[0175] The user module can operate on the basic information of personnel, such as adding new employees (add), modifying employee contact information (modify), deleting information of resigned employees (delete), and viewing detailed information of employees (check); it allows administrators to customize employee levels according to actual needs to meet different management needs.

[0176] The Organizational Identification Configuration module assigns a unique, pre-set Organizational Identification to each organization. The Organizational ID can be linked to a corresponding pre-set Organizational Identification, which can be used to track the latest changes to the organization. Whenever the organizational structure changes (such as adding or deleting a department) or personnel transfers (such as transferring from one department to another), the system automatically updates the corresponding pre-set Organizational Identification to track these changes.

[0177] The configuration center is used to store dynamic configuration information of organizational policy switches, which can be adjusted according to actual conditions. ZooKeeper is integrated to implement real-time monitoring of configuration changes. When the configuration changes, the system can promptly perceive and make corresponding adjustments.

[0178] The database module includes information about each organization, hierarchical relationships between organizations, etc. It records the permission settings of different organizations and personnel, and stores basic information of employees, the organizations they belong to, etc.

[0179] The cache module is used to store organizational structure data in layers according to the organization's parent ID. This can improve data query efficiency and facilitate quick location of information about an organization and its sub-organizations. It caches basic personnel information separately to avoid accessing the database every time personnel information is queried, thereby improving the system's response speed. When the required data is not in the cache, the system will automatically query the data from the database and update the query results to the cache to ensure the efficiency of subsequent queries.

[0180] In summary, the entire system achieves effective management of organizational structure, personnel information, permission strategy, etc. through the collaborative work of various modules, while using technologies such as caching and timestamps to improve the system's performance and maintainability.

[0181] Specifically, within the Xinyuan MiSign information access control system, the service processing logic involved includes: 1. Organizational Policy Switch Modification Process. 1.1) Administrator Login and Modification: The administrator logs in to the MiSign management backend and modifies the organizational policy switch on the provided web page. This is the starting point of the entire process, where the administrator intuitively adjusts the system's policy switch through a visual interface. 1.2) Passing the Switch Value to the Configuration Center: The MiSign management backend calls the relevant APIs in the configuration center and passes the administrator's modified organizational policy switch value to the configuration center. This ensures that the configuration center receives the latest policy switch settings. 1.3) Configuration Center Save and Update: After receiving the switch value, the configuration center saves it to the database to ensure data persistence. Simultaneously, the corresponding ZooKeeper node is modified. Since ZooKeeper is used to monitor configuration changes in real time, updating the node allows related services to promptly detect configuration changes. 1.4) Organization Service Updates Memory Value: The organization service monitors changes to configuration file nodes in ZooKeeper. Upon detecting a change to the organizational policy switch, it immediately updates the switch value in its memory. This approach avoids frequent queries of the configuration center interface by organizational services, improving the performance and response speed of the system.

[0182] 2. One-way circle or shared circle configuration process.

[0183] 2.1) The administrator performs configuration operations: The administrator configures the one-way circle or shared circle again through the web page of the MeSince management backend.

[0184] Configurable information includes: the viewing organization and its employee level, the target organization, whether the viewing organization contains sub-organizations, whether chats can be initiated in the organizational structure, and whether the contact information of people under the target organization can be viewed; among them, the viewing organization and its employee level: specifies a certain employee level in the viewing organization so that the policy is only effective for users at that level; the target organization: clarifies the organization object being viewed; whether the viewing organization contains sub-organizations: is used to determine whether the situation of sub-organizations needs to be considered in subsequent processing; whether chats can be initiated in the organizational structure: sets the chat permissions between the viewing party and the target organization; whether the contact information of people under the target organization can be viewed: sets the viewing party's permission to view the contact information of people in the target organization.

[0185] 2.2) Pass the configuration information to the organization module. The MeSign management backend calls the relevant interface of the organization module and passes the above information configured by the administrator to the organization module for subsequent processing.

[0186] 2.3) Check whether the viewing organization contains any sub-organizations. After receiving the configuration information, the organizational structure module first checks whether the viewing organization contains any sub-organizations. This step is a critical decision point for subsequent processing, and different results will lead to different processing flows.

[0187] 2.4) Obtain the ID list of the viewing organization. If the viewing organization contains sub-organizations, query all of its descendant organizations based on its aOrgID and compile their IDs into the aOrgIDList. If the viewing organization does not contain sub-organizations, the aOrgIDList contains only the viewing organization's aOrgID.

[0188] 2.5) Analyze policy information and obtain the target organization code set. Analyze the configured policy information to obtain the parsed target organization ID set (bOrgIDList). Then, use bOrgIDList to query the organization code set (bOrgCodeList) for these target organizations. Organization codes are unique to organizations and have a hierarchical structure, allowing you to quickly determine whether an organization is a descendant of another organization.

[0189] 2.6) Processing Organization Policy Details: Query the Organization Policy Details table based on aOrgIDList. If there is no policy details data for an organization in the table, place the relevant information for that organization in the insertDetails collection, which stores the policy details of the organization to be added.

[0190] 2.7) Compare and merge policy details. If an organization has policy details data, traverse the target organization's permission range in the existing policy and compare it with the policy details to be added. Use the organization code (bOrgCodeList) to quickly determine whether the permission ranges overlap. If there is an overlap in permission ranges and the visibility and chat settings are different, an error message indicating that there are conflicting policies is returned and the policy configuration fails. If there is no overlap in permission ranges, merge the newly added policy details with the existing policy details to form the updateDetails collection, which stores the policy details that need to be updated.

[0191] 2.8) Save the policy details. Save the policy details to be added in the insertDetails collection and the policy details to be updated in the updateDetails collection to the organization policy details table in the database, completing the organization policy configuration.

[0192] In summary, the entire service processing logic covers the complete process of modifying organizational policy switches and configuring one-way circles or shared circles. Through the collaborative work of multiple modules, effective management of organizational policies and conflict detection are achieved, ensuring that the system configuration information is accurate.

[0193] The computer device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache). The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, a flash memory, etc.

[0194] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of the present disclosure, the processor is used to execute the computer-readable instructions stored in the memory, so that the computer device executes all or part of the steps of the communication software information access control method of each embodiment of the present disclosure.

[0195] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0196] like Figure 8 The present invention provides a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Figure 8 The computer device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0197] like Figure 8 As shown, the computer device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). Various programs and data required for the operation of the computer device are also stored in the RAM. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0198] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device can allow the computer device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 8A computer device having various devices is shown, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0199] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the communication software information access control method of the embodiment of the present disclosure are executed.

[0200] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0201] According to the computer-readable storage medium of the embodiment of the present disclosure, non-transitory computer-readable instructions are stored thereon. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the communication software information access control method of each embodiment of the present disclosure are executed.

[0202] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0203] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0204] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0205] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0206] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0207] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0208] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0209] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0210] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A communication software information access control method, characterized in that: include: In response to an access request from an access user, determine the access user ID, the organization ID to be queried, and the permission type of the access person; When the access user ID exists in the communication software, obtaining the organization ID corresponding to the access user ID; Combine the organization ID and the organization ID to be queried to form an organization ID list; Obtaining a preset organization identifier for each organization ID in the organization ID list, and adding up all preset organization identifiers to obtain a sum of identifier values, which is recorded as the query organization identifier; When the query organization ID is consistent with the organization ID input by the client, the organizational structure and personnel information corresponding to the organization ID to be queried are retrieved from the client's local data repository and fed back to the accessing user; When the query organization identifier is inconsistent with the organization identifier input from the local database of the device, obtaining the switch status of the organization policy to be queried; When the switch state of the organization policy to be queried is off, feeding back access information to the access user according to the called first access policy; When the switch state of the organization policy to be queried is on, access information is fed back to the accessing user according to the called second access policy.

2. The communication software information access control method according to claim 1, characterized in that: When the switch state of the organization policy to be queried is off, feeding back access information to the accessing user according to the called first access policy includes: When the switch state of the organization policy to be queried is off, calling the first access policy, and feeding back access information to the accessing user according to the first access policy; The first access strategy includes: determining target name information of the access request, obtaining first information corresponding to the target name information, and feeding back the first information to the accessing user; The target name information includes the organizational structure information requested for query and the corresponding personnel information; the first information is the actual detailed information corresponding to the target name information.

3. The communication software information access control method according to claim 1, characterized in that: When the switch state of the organization policy to be queried is on, feeding back access information to the accessing user according to the called second access policy includes: Determine the department to which the accessing user ID described in the communication software belongs; Obtain all organizations in the department whose organization policy switch status is on, record them as target organizations, and store the organization IDs of all target organizations in the target set; Determine whether the data exists in the target set. If so, invoke the first sub-strategy and feedback access information to the accessing user according to the first sub-strategy; If not, the second sub-strategy is called, and access information is fed back to the accessing user according to the second sub-strategy.

4. The communication software information access control method according to claim 3, characterized in that: When the target set is empty, determine whether the organization ID to be queried is the root organization ID. If so, determine whether the organization to be queried is the organization corresponding to the accessing user ID. If so, obtain the first-level node information corresponding to the organization ID to be queried and feedback the first-level node information to the accessing user. The root organization is the top-level structure configured in the communication software, and the root organization includes a first-level node; when the organization ID to be queried is the root organization ID, the organization corresponding to the access user ID is the first-level node; If the organization to be queried is not the organization corresponding to the access user ID, the associated organization information corresponding to the organization corresponding to the access user ID is obtained, and the associated organization information is fed back to the access user.

5. The communication software information access control method according to claim 4, characterized in that: When the target set is empty and the organization ID to be queried is not the root organization ID, determine whether the organization to be queried is a sub-organization under the organization corresponding to the access user ID; If yes, obtain the non-first-level node information corresponding to the organization ID to be queried, and feed back the non-first-level node information to the accessing user; If the organization to be queried is not a sub-organization under the organization corresponding to the access user ID, a prompt indicating that no access rights are available is fed back to the access user; When the organization ID to be queried is not the root organization ID, the child organization under the organization is a non-first-level node in the root organization.

6. The communication software information access control method according to claim 3, characterized in that: When the target set is not empty, determining whether the organization ID to be queried is a root organization ID; If so, determine whether the organization to be queried belongs to the target set. If so, determine whether the organization to be queried is a child organization under the organization corresponding to the accessing user ID. If not, determine the target node corresponding to the organization ID to be queried from the target set according to the preset node code; obtain the associated organization information of the first-level node corresponding to the target node, and feedback the associated organization information of the first-level node to the accessing user; If the target set is not empty, the organization ID to be queried is the root organization ID, the organization to be queried belongs to the target set, and the organization to be queried is a child organization under the organization corresponding to the accessing user ID, obtain the associated organization information of the first-level node corresponding to the organization ID to be queried, and feedback the associated organization information of the first-level node to the accessing user; The preset node code is a unique code corresponding to each node in the organizational structure of the communication software; The target node is another organization in the target set that the organization corresponding to the access user ID has visibility permission to.

7. The communication software information access control method according to claim 6, characterized in that: When the target set is not empty, the organization ID to be queried is the root organization ID, and the organization to be queried does not belong to the target set, determine whether there is a child node organization under the organization to be queried in the target set. If so, obtain the associated organization information of the child node organization under the organization to be queried and feedback it to the accessing user; If not, a prompt indicating that the access permission is not granted will be fed back to the accessing user.

8. The communication software information access control method according to claim 6, characterized in that: When the target set is not empty, the organization ID to be queried is not the root organization ID, and the organization to be queried belongs to the target set, determining the target node corresponding to the organization ID to be queried from the target set according to the preset node code; obtaining the associated organization information of the non-first-level node corresponding to the target node, and feeding back the associated organization information of the non-first-level node to the accessing user; When the target set is not empty, the organization ID to be queried is not the root organization ID, and the organization to be queried does not belong to the target set, a prompt indicating that there is no access permission is fed back to the accessing user.

9. A computer device, characterized in that: The computer device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the communication software information access control method according to any one of claims 1-8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the communication software information access control method according to any one of claims 1-8.

Images