Authority management method and device, equipment and storage medium

Abstract

The invention discloses an authority management method and device, equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: constructing a grouping layer between a client layer and a user layer in an enterprise authority architecture, and creating user groups in the grouping layer according to business demands, the user groups being used for representing user sets with the same authority; when a permission allocation request is received, determining a to-be-allocated permission corresponding to a to-be-allocated permission user based on the permission allocation request; matching the to-be-distributed permission with a group configuration permission corresponding to the user group, and determining a target user group according to a matching result; and distributing the to-be-distributed permission user to the target user group, so as to distribute the target group configuration permission corresponding to the target user group to the to-be-distributed permission user. By applying the technical scheme, the technical problem of low authority management efficiency caused by the fact that authority needs to be set for operators one by one during authority management of an enterprise online banking system in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a permission management method and device, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of financial technology, the enterprise online banking system has become an indispensable tool for enterprise fund management and business operation, which can provide convenient online financial services for enterprises, including account management, fund transfer, transaction inquiry, electronic bill processing and other functions. However, with the expansion of enterprise scale and the improvement of business complexity, the enterprise online banking system faces many challenges in permission management. At present, the existing enterprise online banking system usually needs to set the permissions of online banking operators one by one. However, as the enterprise customer scale continues to expand, the number of online banking operators will also increase significantly, so the efficiency of managing the permissions of online banking operators in this way is not high, thereby affecting the system operation efficiency. SUMMARY

[0003] The main purpose of the present application is to provide a permission management method, device, equipment and storage medium, which aims to solve the technical problem that the existing enterprise online banking system needs to set the permissions of operators one by one in permission management, resulting in low permission management efficiency.

[0004] To achieve the above purpose, the present application provides a permission management method, which comprises:

[0005] A grouping layer is constructed between the customer layer and the user layer in the enterprise permission architecture, and a user group is created in the grouping layer according to business requirements, the user group being used to represent a user set with the same permissions;

[0006] When a permission allocation request is received, the corresponding to-be-allocated permission of the to-be-allocated permission user is determined based on the permission allocation request;

[0007] The to-be-allocated permission is matched with the group configuration permission corresponding to the user group, and the target user group is determined according to the matching result;

[0008] The to-be-allocated permission user is allocated to the target user group, so that the target group configuration permission corresponding to the target user group is allocated to the to-be-allocated permission user.

[0009] In an embodiment, before the step of determining the corresponding to-be-allocated permission of the to-be-allocated permission user based on the permission allocation request when the permission allocation request is received, the method further comprises:

[0010] The user group is configured with permissions to obtain the group configuration permission corresponding to the user group;

[0011] Synchronize the group configuration permission to a preset group permission table;

[0012] The step of matching the to-be-assigned permission with the group configuration permission corresponding to the user group and determining a target user group according to a matching result comprises:

[0013] The step of matching the to-be-assigned permission with all group configuration permissions in the preset group permission table and determining a target user group according to a matching result comprises:

[0014] In an embodiment, the preset group permission table comprises a group menu permission table and a group account permission table; the step of matching the to-be-assigned permission with all group configuration permissions in the preset group permission table and determining a target user group according to a matching result comprises:

[0015] Determining to-be-assigned menu permissions and to-be-assigned account permissions in the to-be-assigned permission;

[0016] Matching the to-be-assigned menu permissions and the to-be-assigned account permissions with menu configuration permissions in the group menu permission table and account configuration permissions in the group account permission table respectively;

[0017] Determining target matching menu permissions and target matching account permissions corresponding to the to-be-assigned permission user according to a matching result;

[0018] Determining a target user group based on the target matching menu permissions and the target matching account permissions.

[0019] In an embodiment, the step of assigning the to-be-assigned permission user to the target user group comprises:

[0020] Determining a group information table identifier corresponding to a group information table of the target user group;

[0021] Creating a user information table corresponding to the to-be-assigned permission user;

[0022] Determining a foreign key field corresponding to the user information table according to the group information table identifier, and assigning the to-be-assigned permission user to the target user group based on the foreign key field.

[0023] In an embodiment, after the step of assigning the to-be-assigned permission user to the target user group to assign target group configuration permissions corresponding to the target user group to the to-be-assigned permission user, the method further comprises:

[0024] Upon receiving a user permission adjustment request, determining a to-be-adjusted permission group and permission adjustment information corresponding to the to-be-adjusted permission group according to the user permission adjustment request;

[0025] adjust the first configuration permission corresponding to the to-be-adjusted permission group based on the permission adjustment information;

[0026] When the adjustment is completed, the adjusted configuration permission is synchronized to a user permission table to update the permissions of all users in the to-be-adjusted permission group.

[0027] In an embodiment, after the step of assigning the to-be-allocated-permission user to the target user group to allocate the target group configuration permission corresponding to the target user group to the to-be-allocated-permission user, the method further comprises:

[0028] Upon receiving a personalized permission configuration request, determining a to-be-customized-permission user and permission customization information corresponding to the to-be-customized-permission user according to the personalized permission configuration request;

[0029] Determining a first user group to which the to-be-customized-permission user belongs;

[0030] Determining whether the to-be-customized permission in the permission customization information exceeds the permission configuration range corresponding to the first user group;

[0031] If not, performing personalized permission configuration on the to-be-customized-permission user based on the to-be-customized permission.

[0032] In an embodiment, after the step of assigning the to-be-allocated-permission user to the target user group to allocate the target group configuration permission corresponding to the target user group to the to-be-allocated-permission user, the method further comprises:

[0033] Real-time acquisition of transaction data of a user and determination of group identification information corresponding to a user group to which the user belongs;

[0034] Group management of the transaction data based on the group identification information.

[0035] In addition, to achieve the above-mentioned purpose, the present application further provides a permission management device, which comprises:

[0036] A group creation module configured to build a group layer between a customer layer and a user layer in an enterprise permission architecture, and create a user group in the group layer according to business requirements, the user group being used to represent a user set having the same permission;

[0037] A permission determination module configured to determine a to-be-allocated permission corresponding to a to-be-allocated-permission user based on a permission allocation request upon receiving the permission allocation request;

[0038] The permission matching module is configured to match the to-be-assigned permission with the group configuration permission corresponding to the user group, and determine a target user group according to a matching result.

[0039] The permission allocation module is configured to allocate the to-be-assigned permission user to the target user group, so as to allocate the target group configuration permission corresponding to the target user group to the to-be-assigned permission user.

[0040] In addition, to achieve the above-mentioned purpose, the present application also provides a permission management device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the permission management method as described above.

[0041] In addition, to achieve the above-mentioned purpose, the present application also provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the permission management method as described above.

[0042] The present application provides a permission management method, and the present application discloses constructing a group layer between a customer layer and a user layer in an enterprise permission architecture, and creating user groups in the group layer according to business requirements, and the user groups are used to represent a user set with the same permission; when a permission allocation request is received, determining a to-be-assigned permission corresponding to a to-be-assigned permission user based on the permission allocation request; matching the to-be-assigned permission with a group configuration permission corresponding to a user group, and determining a target user group according to a matching result; allocating the to-be-assigned permission user to the target user group, so as to allocate a target group configuration permission corresponding to the target user group to the to-be-assigned permission user; since the present application can determine a matching target user group from all user groups created in the enterprise permission architecture according to the to-be-assigned permission of the to-be-assigned permission user, and allocate the to-be-assigned permission user to the target user group, so as to implement the permission allocation of the to-be-assigned permission user, thereby solving the technical problem that an enterprise online banking system in the prior art needs to set permissions for operators one by one when managing permissions, resulting in low permission management efficiency, and further improving system operation efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which are incorporated into and form a part of the specification, illustrate one embodiment consistent with the present application and, together with the description, serve to explain the principles of the application.

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, those skilled in the art can obtain other drawings from these drawings without any creative effort.

[0045] Figure 1 A flowchart provided for the first embodiment of the permission management method of the present application;

[0046] Figure 2 A flowchart provided for the second embodiment of the permission management method of the present application;

[0047] Figure 3 An architecture diagram of the enterprise online banking permission system in the permission management method of the present application;

[0048] Figure 4 A flowchart provided for the third embodiment of the permission management method of the present application;

[0049] Figure 5 A module structure diagram of the permission management device of the embodiment of the present application;

[0050] Figure 6 A device structure diagram of the hardware running environment involved in the permission management method of the embodiment of the present application.

[0051] The object implementation, functional features and advantages of the present application will be further explained with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0053] In order to better understand the technical solutions of the present application, the specific embodiments will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] The main solution of the embodiment of the present application is to build a grouping layer between the customer layer and the user layer in the enterprise permission architecture, and to create user groups in the grouping layer according to business needs, the user groups being used to represent a user set with the same permission; when a permission allocation request is received, the corresponding to-be-allocated permission of the to-be-allocated permission user is determined based on the permission allocation request; the to-be-allocated permission is matched with the group configuration permission corresponding to the user group, and the target user group is determined according to the matching result; the to-be-allocated permission user is allocated to the target user group, so as to allocate the target group configuration permission corresponding to the target user group to the to-be-allocated permission user.

[0055] The enterprise online banking system in the prior art usually needs to set the permissions of online banking operators one by one, which results in low efficiency of permission management and further affects the system operation efficiency.

[0056] The application provides a solution, which can determine a matched target user group from all user groups created in an enterprise permission architecture according to the to-be-assigned permission of a to-be-assigned permission user, and assign the to-be-assigned permission user to the target user group, so as to realize permission assignment of the to-be-assigned permission user, thereby solving the technical problem that the existing enterprise online banking system needs to set permissions for operators one by one when managing permissions, resulting in low permission management efficiency, and further improving system operation efficiency.

[0057] It should be noted that the execution subject of the embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a permission management device, etc. that can realize the above functions. The following will take the permission management device as an example (hereinafter referred to as the device) to describe the embodiment and the following embodiments.

[0058] Based on this, the application embodiment provides a permission management method, which refers to Figure 1 , Figure 1 The flowchart provided by the first embodiment of the permission management method of the application.

[0059] In the embodiment, the permission management method includes steps S10-S40:

[0060] Step S10: constructing a grouping layer between a customer layer and a user layer in an enterprise permission architecture, and creating a user group in the grouping layer according to business requirements, the user group being used to represent a user set with the same permission.

[0061] It should be noted that the enterprise permission architecture described above can be an architecture for managing user permissions in the enterprise online banking system. In actual application, the existing enterprise online banking system usually adopts a two-level permission management architecture, i.e., customer-level permission and user-level permission, wherein the customer-level permission is mainly set for the entire enterprise customer, and the user-level permission is individually configured for each specific online banking operator. Although this two-level architecture can meet the basic needs of the enterprise to some extent, when there are a large number of operators in the enterprise, the administrator needs to configure the permissions for each operator one by one, which is not only time-consuming and laborious, but also prone to errors. Therefore, the embodiment can build a grouping layer between the customer layer and the user layer in the enterprise permission architecture, forming a three-level permission architecture of "customer-group-user", so as to realize permission grouping management based on the organizational architecture, classify users with the same or similar permission requirements into the same group, thereby realizing centralized management of user permissions, which is conducive to improving the efficiency and clarity of permission management, and can reduce the workload of setting user permissions one by one and improve the efficiency of permission management. In the embodiment, through this hierarchical permission management mechanism, the operator permission configuration can be efficiently completed, and the requirements of the internal group data permission control of the enterprise can be met.

[0062] It should be noted that the enterprise permission architecture in the embodiment can include a customer layer, a grouping layer and a user layer, wherein the customer layer can be located at the topmost layer of the enterprise permission architecture, and can represent an enterprise customer, each customer therein can have multiple groups; the user layer can be located at the bottommost layer of the enterprise permission architecture, and can represent a specific online banking operator (i.e., a user), each user therein belongs to a single group, ensuring the clarity of permission management; the grouping layer can be located between the customer layer and the user layer, and can represent a user set with the same permission, each group therein belongs to a customer, but can include multiple users.

[0063] In the embodiment, the system can create different user groups in the grouping layer of the enterprise permission architecture according to the organizational architecture or business requirements of the enterprise, wherein each user group represents a user set with the same or similar permission requirements, i.e., all users belonging to the same user group have the same or similar permissions.

[0064] Step S20: Upon receiving the permission allocation request, determining the to-be-allocated permissions corresponding to the to-be-allocated permission user based on the permission allocation request.

[0065] It should be understood that the permission allocation request described above can be a business instruction for instructing the system to allocate or adjust permissions for the to-be-allocated permission user. The to-be-allocated permission user can be any single user or user group that needs to be allocated or adjusted permissions.

[0066] It can be understood that the to-be-assigned permission can be a specific permission to be assigned to the user, such as a menu permission, an account permission, an operation permission, and the like, which is specified in the permission assignment request, and the embodiment is not limited thereto. In actual application, after receiving the permission assignment request, the system can parse the permission assignment request to extract the user identifier information or the group identifier information, and the permission type and other key information in the permission assignment request, and then determine the to-be-assigned permission user indicated by the permission assignment request according to the user identifier information or the group identifier information, and determine the to-be-assigned permission corresponding to the to-be-assigned permission user according to the permission type.

[0067] Step S30: matching the to-be-assigned permission with the group configuration permission corresponding to the user group, and determining a target user group according to a matching result.

[0068] It should be noted that the group configuration permission can be a set of permissions pre-configured for the user group, and the target user group can be a user group configured with a permission matched with the to-be-assigned permission. In the embodiment, the system can match the to-be-assigned permission corresponding to the to-be-assigned permission user with all the permissions pre-configured for the user group, and determine the user group configured with the permission matched with the to-be-assigned permission as the target user group.

[0069] Step S40: assigning the to-be-assigned permission user to the target user group to assign the target group configuration permission corresponding to the target user group to the to-be-assigned permission user.

[0070] It can be understood that the target group configuration permission can be a permission pre-configured for the target user group. In the embodiment, by assigning the to-be-assigned permission user to the target user group, the to-be-assigned permission user becomes a member of the target user group, so that the to-be-assigned permission user can inherit all the permissions configured for the target user group, and thus the system can assign the target group configuration permission corresponding to the target user group to the to-be-assigned permission user.

[0071] Specifically, the step S40 includes: determining a group information table identifier corresponding to a group information table of the target user group; creating a user information table corresponding to the to-be-assigned permission user; determining a foreign key field corresponding to the user information table according to the group information table identifier, and assigning the to-be-assigned permission user to the target user group based on the foreign key field.

[0072] It should be understood that the group information table can be a storage space for storing basic information of the target user group, and the basic information of the user group in the embodiment can include but is not limited to a group information table identifier, a group name, a group description, and the like, wherein the group information table identifier can be an identifier for uniquely identifying the group information table.

[0073] It should be noted that the above user information table can be a storage space for storing basic information of a user. In the present embodiment, the basic information of the user can include but is not limited to identification information of the user, a user name, a password, and the like. In addition, the user information table can further store a foreign key field. The foreign key field can be a special field for establishing an association relationship between tables, and can point to a group information table identifier corresponding to a group information table of a target user group to which the user belongs. In the present embodiment, the system can associate the user information table corresponding to the foreign key field of the user information table with the user information table of the user to be assigned with a permission, so as to realize the association between the target user group and the user to be assigned with a permission, and enable the system to assign and manage the permission of the user according to the group to which the user belongs, thereby realizing the permission grouping management based on the organizational structure.

[0074] The present embodiment provides a permission management method. The method discloses constructing a grouping layer between a customer layer and a user layer in an enterprise permission architecture, and creating a user group in the grouping layer according to a business requirement. The user group is used to represent a user set having the same permission. When a permission assignment request is received, the method determines a to-be-assigned permission corresponding to a user to be assigned with a permission based on the permission assignment request. The to-be-assigned permission is matched with a group configuration permission corresponding to the user group, and a target user group is determined according to a matching result. The user to be assigned with a permission is assigned to the target user group, so as to assign a target group configuration permission corresponding to the target user group to the user to be assigned with a permission. Since the present embodiment can determine a matching target user group from all user groups created in the enterprise permission architecture according to a to-be-assigned permission of a user to be assigned with a permission, and assign the user to be assigned with a permission to the target user group, the permission assignment of the user to be assigned with a permission is realized, thereby solving the technical problem that an existing enterprise online banking system needs to set permissions for operators one by one when managing permissions, resulting in low efficiency of permission management, and further improving the system operation efficiency.

[0075] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above embodiment one can be referred to the above description, and will not be described hereinafter. On this basis, please refer to Figure 2 , Figure 2 The flowchart provided for the second embodiment of the permission management method of the present application.

[0076] In the present embodiment, before step S20, the method further includes steps S201-S202:

[0077] Step S201: configuring permissions for the user group to obtain group configuration permissions corresponding to the user group.

[0078] It should be understood that the above group configuration permission can be a permission set configured for the user group.

[0079] Step S202: synchronize the group configuration permission to a preset group permission table.

[0080] It should be understood that the above-mentioned preset group permission table can be a storage space for storing permission information of a user group. In the embodiment, the system can configure permissions for the user group, obtain the group configuration permission corresponding to the target group, and synchronize the group configuration permission to the group information table corresponding to the user group.

[0081] Correspondingly, the step S30 includes:

[0082] Step S30': match the to-be-assigned permission with all group configuration permissions in the preset group permission table, and determine the target user group according to the matching result.

[0083] In the embodiment, the system can match the to-be-assigned permission corresponding to the to-be-assigned permission user with all permissions in the preset group permission table, and then determine the user group to which the permission matched with the to-be-assigned permission belongs according to the matching result, and determine the user group as the target user group.

[0084] Further, the preset group permission table includes a group menu permission table and a group account permission table; and the step S30' includes:

[0085] Step S30'a: determine the to-be-assigned menu permission and the to-be-assigned account permission in the to-be-assigned permission.

[0086] It can be understood that the above-mentioned to-be-assigned menu permission can be a web banking system function menu access permission that needs to be assigned to the to-be-assigned permission user, for example, a permission to access menus such as fund transfer, account query, report export, etc. The above-mentioned to-be-assigned account permission can be an enterprise bank account operation permission that needs to be assigned to the to-be-assigned permission user, for example, querying account A, transferring account B, etc., which is not limited in the embodiment.

[0087] Step S30'b: match the to-be-assigned menu permission and the to-be-assigned account permission with the menu configuration permission in the group menu permission table and the account configuration permission in the group account permission table, respectively.

[0088] It should be noted that the above-mentioned group menu permission table can be a storage space for storing menu permissions of a user group, wherein the web banking function menus that can be accessed by the user group can be defined, such as fund transfer, transaction query, etc.; and correspondingly, the above-mentioned menu configuration permission can be a menu access permission pre-configured for the user stored in the group menu permission table.

[0089] It should be understood that the above-mentioned group account permission table can be a storage space for storing the account permissions of user groups, which can define the online banking accounts that the user groups can operate and related operation permissions, such as query, transfer, approval, etc.; accordingly, the above-mentioned account configuration permissions can be the account operation permissions pre-configured for the user stored in the group account permission table.

[0090] Step S30'c: determining the target matching menu permissions and target matching account permissions corresponding to the user to be assigned permissions according to the matching result.

[0091] It should be noted that the target matching menu permission may be a menu permission in the group menu permission table that matches the menu permission to be assigned; the target matching account permission may be an account permission in the group account permission table that matches the account permission to be assigned.

[0092] Step S30 ′d: determining a target user group based on the target matching menu authority and the target matching account authority.

[0093] It should be noted that the target user group mentioned above can be a user group that has both target-matching menu permissions and target-matching account permissions. In actual applications, the system can match the to-be-assigned menu permissions and to-be-assigned account permissions in the permissions to be assigned with the menu configuration permissions in the group menu permission table and the account configuration permissions in the group account permission table, respectively, to determine the target-matching menu permissions that match the user in the group menu permission table and the target-matching account permissions that match the user in the group account permission table. Finally, the system determines a user group that has both target-matching menu permissions and target-matching account permissions, and determines this user group as the target user group, thereby enabling group-level account permission and menu permission configuration.

[0094] In this embodiment, referring to Figure 3 , Figure 3 This is a diagram showing the architecture of the corporate online banking authority system in this application authority management method. Figure 3 As shown, in this embodiment, the enterprise online banking permission system can be composed of a customer layer, a group layer, and a user layer, wherein the customer layer is provided with a customer information table that stores the basic information of the customer, the group layer is provided with a group information table that stores the basic information of all groups in the group layer, and the user layer is provided with a user information table that stores the basic information of all users in the user layer, and the customer information table, the group information table, and the user information table are all related through foreign keys. In addition, the group layer is also provided with a group menu permission table and a group account permission table, wherein the group menu permission table is used to define the online banking menu items that the group can access, and the group account permission table is used to define the online banking accounts that the group can operate and the related operation permissions. This embodiment can implement a hierarchical permission management mechanism through this architecture, so that operator permission configuration can be completed efficiently.

[0095] In this embodiment, it is disclosed that the preset grouping permission table includes a grouping menu permission table and a grouping account permission table; the user grouping is configured with permissions to obtain grouping configuration permissions corresponding to the user grouping; the to-be-allocated menu permissions and the to-be-allocated account permissions in the grouping configuration permissions are matched with the menu configuration permissions in the grouping menu permission table and the account configuration permissions in the grouping account permission table respectively to determine target matching menu permissions and target matching account permissions corresponding to the to-be-allocated permission user; and the target user grouping is determined based on the target matching menu permissions and the target matching account permissions. Since the target user grouping can be determined based on the target matching menu permissions and the target matching account permissions of the to-be-allocated permission user in this embodiment, the grouping-level account permission and menu permission configuration function can be provided, the permission configuration can be automatically synchronized to the user permission table, and thus the convenient operation of batch permission management can be implemented.

[0096] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described in detail. On this basis, please refer to Figure 4 , Figure 4 The flowchart provided for the third embodiment of the permission management method of the present application.

[0097] In this embodiment, after step S40, the method further includes steps S501-S503:

[0098] Step S501: when receiving a user permission adjustment request, determining a to-be-adjusted permission grouping and permission adjustment information corresponding to the to-be-adjusted permission grouping according to the user permission adjustment request.

[0099] It should be understood that the above user permission adjustment request can be a request for indicating the system to modify, add or delete the permissions of the to-be-adjusted permission grouping, wherein the to-be-adjusted permission grouping can be any user grouping whose permissions need to be adjusted.

[0100] It can be understood that the above permission adjustment information can be the information of the adjustment type (including adding, modifying or revoking) and the adjustment object (such as menu, account, operation, etc. permissions) of the specific adjustment operation that needs to be performed on the to-be-adjusted permission grouping.

[0101] Step S502: adjusting the first configuration permissions corresponding to the to-be-adjusted permission grouping based on the permission adjustment information.

[0102] It can be understood that the above first configuration permissions can be the permissions pre-configured for the to-be-adjusted permission grouping.

[0103] Step S503: When the adjustment is completed, the adjusted configuration permission is synchronized to the user permission table to update the permissions of all users in the to-be-adjusted permission group.

[0104] In actual applications, the system can adjust the first configuration permission corresponding to the to-be-adjusted permission group in the preset group permission table according to the permission adjustment information, and synchronize the adjusted permission to the user permission table, so that the permission of each user belonging to the group can be updated according to the permission setting of the group, thereby realizing convenient operation of batch permission management and ensuring consistency and timeliness of the permission setting in the user group.

[0105] Further, after step S40, the method further includes: when receiving a personalized permission configuration request, determining a to-be-customized permission user and permission customization information corresponding to the to-be-customized permission user according to the personalized permission configuration request; determining a first user group to which the to-be-customized permission user belongs; judging whether the to-be-customized permission in the permission customization information exceeds the permission configuration range corresponding to the first user group; if not, performing personalized permission configuration on the to-be-customized permission user based on the to-be-customized permission.

[0106] It should be noted that the above-mentioned personalized permission configuration request can be a request for instructing the system to customize the permission for the to-be-customized permission user individually, wherein the to-be-customized permission user can be any user who needs to customize the permission individually.

[0107] It can be understood that the above-mentioned permission customization information can be information for performing personalized configuration of the permission for the to-be-customized permission user, including the adjustment type and adjustment object of the permission adjustment operation.

[0108] It should be noted that the above-mentioned first user group can be a user group to which the to-be-customized permission user belongs. In this embodiment, the system can query the first user group to which the to-be-customized permission user belongs through the foreign key field of the to-be-customized permission user stored in the user information table.

[0109] In this embodiment, the permission configuration range corresponding to the first user group can be the permission set configured by the first user group in the group menu permission table and the group account permission table corresponding thereto. In actual applications, the system can judge whether the permission customization information corresponding to the to-be-customized permission user belongs to the permission configured in the group menu permission table and the group account permission table corresponding to the first user group, if it does, it is determined that the permission customization information corresponding to the to-be-customized permission user does not exceed the permission configuration range corresponding to the first user group, and at this time, the to-be-customized permission user can be configured with personalized permission.

[0110] In the embodiment, the system allows individualized permission configuration for specific users under the group permission framework, realizes the "in-group differentiation" permission configuration mode, so that not only the efficiency advantage of group management can be retained, but also the individualized permission requirements of different post users in the same group can be met, thereby providing a more flexible permission management solution for enterprises and realizing fine-grained permission management.

[0111] Further, after step S40, the method further comprises: acquiring transaction data of the user in real time, and determining group identification information corresponding to a user group to which the user belongs; and performing group management on the transaction data based on the group identification information.

[0112] In the embodiment, when recording transaction data, the system can synchronously save the group identification information of the group to which the operator belongs, and perform group management on the transaction data based on the group identification information, thereby realizing fine-grained management and analysis of the transaction data. Through this mechanism, the system can strictly ensure the isolation of transaction data between different groups, meet the requirements of group data permission control within an enterprise, thereby maintaining the data security boundary between groups while ensuring the traceability of transaction records, and providing a more compliant and secure fund management environment for enterprises.

[0113] In the embodiment, it is disclosed that when a user permission adjustment request is received, the user permission adjustment request is used to determine a to-be-adjusted permission group and permission adjustment information corresponding to the to-be-adjusted permission group; the first configuration permission corresponding to the to-be-adjusted permission group is adjusted based on the permission adjustment information; and when the adjustment is completed, the adjusted configuration permission is synchronized to a user permission table to update the permissions of all users in the to-be-adjusted permission group. Since the embodiment can update the permissions of all users in the to-be-adjusted permission group based on the permission adjustment information corresponding to the to-be-adjusted permission group, the permissions of all users in the user group can be adjusted in batches, the permission management efficiency is improved, and the consistency and timeliness of the permission settings in the user group are ensured.

[0114] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the permission management method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0115] The present application also provides a permission management device, please refer to Figure 5 , the permission management device comprises:

[0116] The group creation module 10 is configured to build a group layer between the customer layer and the user layer in the enterprise permission architecture, and create a user group in the group layer according to business requirements, the user group being used to represent a user set having the same permission.

[0117] The permission determination module 20 is configured to determine, when receiving the permission allocation request, a to-be-allocated permission corresponding to a to-be-allocated permission user based on the permission allocation request.

[0118] The permission matching module 30 is configured to match the to-be-allocated permission with a group configuration permission corresponding to the user group, and determine a target user group according to a matching result.

[0119] The permission allocation module 40 is configured to allocate the to-be-allocated permission user to the target user group, so as to allocate a target group configuration permission corresponding to the target user group to the to-be-allocated permission user.

[0120] The permission management device provided in the present application adopts the permission management method in the above embodiments, and can solve the technical problem that the enterprise online banking system in the prior art needs to set permissions for operators one by one when managing permissions, resulting in low permission management efficiency. Compared with the prior art, the permission management device provided in the present application has the same beneficial effects as the permission management method provided in the above embodiments, and other technical features in the permission management device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0121] The present application provides a permission management device, which comprises at least one processor and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the permission management method in the above embodiment one.

[0122] Reference will be made to the following description Figure 6 which shows a structural schematic diagram of a permission management device suitable for implementing the embodiments of the present application. The permission management device in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 6 The permission management device shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0123] As Figure 6As shown, the rights management device can include a processing apparatus 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory 1002 or loaded from a storage apparatus 1003 into a random access memory 1004. Various programs and data required for the operation of the rights management device are also stored in the random access memory 1004. The processing apparatus 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other by a bus 1005. An input / output interface 1006 is also connected to the bus. Generally, the following systems can be connected to the input / output interface 1006: input apparatuses 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output apparatuses 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage apparatus 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication apparatus 1009. The communication apparatus 1009 can allow the rights management device to perform wireless or wired communication with other devices to exchange data. Although the rights management device having various systems is shown in the figure, it should be understood that all of the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0124] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication apparatus, or installed from the storage apparatus 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing apparatus 1001, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0125] The rights management device provided by the present disclosure adopts the rights management method in the above-mentioned embodiments, and can solve the technical problem of rights management. Compared with the prior art, the rights management device provided by the present disclosure has the same beneficial effects as the rights management method provided by the above-mentioned embodiments, and other technical features in the rights management device are the same as the features disclosed in the above-mentioned embodiments, which will not be described here.

[0126] It should be understood that parts of the present disclosure can be realized by hardware, software, firmware, or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0127] The above merely provides a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0128] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer programs) for performing the permission management method in the above embodiments.

[0129] The computer readable storage medium provided by the present application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electric connection having one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), etc., or any suitable combination of the above.

[0130] The above computer readable storage medium can be contained in the permission management device, or can exist separately without being assembled into the permission management device.

[0131] The computer readable storage medium carries one or more programs, when the one or more programs are executed by the permission management device, the permission management device is caused to: construct a group layer between a customer layer and a user layer in an enterprise permission architecture, and create a user group in the group layer according to a business requirement, the user group being used to represent a user set having the same permission; when a permission allocation request is received, determine a to-be-allocated permission corresponding to a to-be-allocated permission user based on the permission allocation request; match the to-be-allocated permission with a group configuration permission corresponding to a user group, and determine a target user group according to a matching result; and allocate the to-be-allocated permission user to the target user group, so as to allocate a target group configuration permission corresponding to the target user group to the to-be-allocated permission user.

[0132] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0133] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a procedure, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0134] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0135] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the above-mentioned permission management method, and can solve the technical problem that the existing enterprise online banking system needs to set permissions for operators one by one when managing permissions, resulting in low permission management efficiency. Compared with the prior art, the beneficial effects of the computer readable storage medium provided by the present application are the same as those of the permission management method provided by the above-mentioned embodiments, and will not be repeated here.

[0136] The above only describes some embodiments of the present application, and does not limit the scope of the present application. Any equivalent structural transformation, direct / indirect application in other related technical fields based on the technical concept of the present application, and the contents of the present application and the drawings are included in the protection scope of the present application.

Claims

1. A rights management method, characterized in that: The method includes: Building a grouping layer between the client layer and the user layer in the enterprise permission architecture, and creating user groups in the grouping layer according to business needs, wherein the user groups are used to represent a set of users with the same permissions; Upon receiving a permission allocation request, determining the permission to be allocated corresponding to the user to be allocated the permission based on the permission allocation request; Matching the permissions to be assigned with the group configuration permissions corresponding to the user group, and determining the target user group based on the matching result; The user to be assigned permissions is assigned to the target user group, so as to assign the target group configuration permissions corresponding to the target user group to the user to be assigned permissions.

2. The method according to claim 1, wherein Before the step of determining the rights to be assigned corresponding to the user to be assigned rights based on the rights assignment request when the rights assignment request is received, the method further includes: Performing permission configuration on the user group to obtain group configuration permissions corresponding to the user group; Synchronize the group configuration permissions to the preset group permission table; The step of matching the permissions to be assigned with the group configuration permissions corresponding to the user group, and determining the target user group according to the matching result, includes: The permissions to be assigned are matched with all group configuration permissions in the preset group permission table, and a target user group is determined according to the matching result.

3. The method according to claim 2, wherein The preset group permission table includes a group menu permission table and a group account permission table; The step of matching the permission to be assigned with all group configuration permissions in the preset group permission table and determining the target user group according to the matching result includes: Determining the menu permissions to be assigned and the account permissions to be assigned among the permissions to be assigned; Matching the menu permissions to be assigned and the account permissions to be assigned with the menu configuration permissions in the group menu permission table and the account configuration permissions in the group account permission table respectively; Determine the target matching menu permissions and target matching account permissions corresponding to the user to be assigned permissions based on the matching results; A target user group is determined based on the target matching menu authority and the target matching account authority.

4. The method according to claim 1, wherein The step of allocating the users to be assigned permissions to the target user group includes: Determine a group information table identifier corresponding to the group information table of the target user group; Create a user information table corresponding to the user to be assigned permissions; The foreign key field corresponding to the user information table is determined according to the group information table identifier, and the user to be assigned permissions is assigned to the target user group based on the foreign key field.

5. The method according to claim 2, wherein After the step of allocating the user to be assigned permissions to the target user group so as to allocate the target group configuration permissions corresponding to the target user group to the user to be assigned permissions, the method further includes: Upon receiving a user rights adjustment request, determining, according to the user rights adjustment request, a rights group to be adjusted and rights adjustment information corresponding to the rights group to be adjusted; Adjusting the first configuration permission corresponding to the permission group to be adjusted based on the permission adjustment information; When the adjustment is completed, the adjusted configuration permissions are synchronized to the user permission table to update the permissions of all users in the permission group to be adjusted.

6. The method according to any one of claims 1 to 5, characterized in that After the step of allocating the user to be assigned permissions to the target user group so as to allocate the target group configuration permissions corresponding to the target user group to the user to be assigned permissions, the method further includes: Upon receiving a personalized permission configuration request, determining a user to be customized and permission customization information corresponding to the user to be customized according to the personalized permission configuration request; Determine the first user group to which the user whose permissions are to be customized belongs; Determining whether the permissions to be customized in the permission customization information exceed the permission configuration range corresponding to the first user group; If not, personalized permission configuration is performed for the user with the permission to be customized based on the permission to be customized.

7. The method according to any one of claims 1 to 5, characterized in that After the step of allocating the user to be assigned permissions to the target user group so as to allocate the target group configuration permissions corresponding to the target user group to the user to be assigned permissions, the method further includes: Acquire the user's transaction data in real time and determine the group identification information corresponding to the user group to which the user belongs; The transaction data is grouped and managed based on the group identification information.

8. A rights management device, characterized in that: The device comprises: A group creation module is used to build a grouping layer between the client layer and the user layer in the enterprise permission architecture, and to create user groups in the grouping layer according to business needs. The user groups are used to represent a set of users with the same permissions. The authority determination module is used to determine the authority to be assigned corresponding to the user to be assigned authority based on the authority allocation request when receiving the authority allocation request; A permission matching module, configured to match the permission to be assigned with the group configuration permission corresponding to the user group, and determine the target user group according to the matching result; The authority allocation module is used to allocate the user to be allocated authority to the target user group, so as to allocate the target group configuration authority corresponding to the target user group to the user to be allocated authority.

9. A rights management device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the rights management method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the rights management method according to any one of claims 1 to 7 are implemented.

Images