Organization authorization method, system and equipment based on pre-sequencing traversal tree algorithm

Abstract

The invention discloses an organization authorization method, system and device based on a pre-sorting traversal tree algorithm, and relates to the technical field of organization authorization. The invention provides an organization authorization method based on a pre-sorting traversal tree algorithm, and the method comprises the steps: obtaining a plurality of organization nodes, distributing a left value and a right value for each organization node, and obtaining a preset data access range of a target node; in response to a data query request of a target node, extracting a key character string in the data query request, performing semantic understanding on the key character string based on a semantic understanding model, generating a data query target of the target node, and evaluating a risk coefficient of the data query target; adjusting a preset data access range as a target data access range according to the risk coefficient, determining a data query condition according to the target data access range, rewriting a data query request of a target node through the data query condition to generate an expansion statement, and sending a data query result to the target node according to the expansion statement.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of organization authorization, in particular to an organization authorization method, system and device based on pre-sequencing traversal tree algorithm. BACKGROUND

[0002] In modern enterprise management and information system design, the organization structure is usually represented in a tree structure. How to efficiently and accurately control the data access permissions of different departments or positions based on such a tree structure is a crucial and challenging problem. For hierarchical relationship queries of tree structure, traditional methods such as recursive query or multiple database connection query have significant performance bottlenecks when dealing with deep and large-scale organization structures. For example, when querying all the data of a department and all its descendant departments, multiple recursive or loop queries are required, which is slow in response and affects system performance. Moreover, the existing authorization model is mostly static configuration, and the system administrator presets a fixed data access range for users or departments, which is prone to loose or tight permission control, allowing low-privilege users to access high-sensitive data, causing data leakage risk or affecting the efficiency of normal business development. SUMMARY

[0003] The main purpose of the present application is to provide an organization authorization method, system and device based on pre-sequencing traversal tree algorithm, aiming to solve the technical problem that the existing authorization model is mostly static configuration, and the system administrator presets a fixed data access range for users or departments, which is prone to loose or tight permission control, allowing low-privilege users to access high-sensitive data, causing data leakage risk or affecting the efficiency of normal business development.

[0004] To achieve the above purpose, in a first aspect, the present application provides an organization authorization method based on pre-sequencing traversal tree algorithm, comprising: obtaining an organization structure and preprocessing the organization structure based on a pre-sequencing traversal tree algorithm to obtain a plurality of organization nodes, assigning a left value and a right value to each organization node, and obtaining a preset data access range of a target node according to the left value and the right value of the target node; in response to a data query request of the target node, extracting a key string in the data query request, performing semantic understanding on the key string based on a semantic understanding model, generating a data query target of the target node, and evaluating a risk coefficient of the data query target; adjusting the preset data access range to a target data access range according to the risk coefficient, determining a data query condition according to the target data access range, rewriting the data query request of the target node to generate an expansion statement through the data query condition, and sending a data query result to the target node according to the expansion statement.

[0005] Optionally, the steps of obtaining the organizational structure and preprocessing it based on a pre-sorted traversal tree algorithm to obtain multiple organizational nodes, assigning left and right values ​​to each organizational node, and obtaining the preset data access range of the target node based on its left and right values ​​include: Based on the left and right values ​​of the target node, obtain the management organization scope of the target node; Obtain the depth level of the target node, and based on the management organization scope, obtain the basic data access scope; Based on the historical busy phases of the target business, establish the relationship between target nodes and time weights, and determine the first adjustment coefficient; Based on the correlation between the target business and the target node, establish the weight relationship between the target node and the business, and determine the second adjustment coefficient; The preset data access range is determined based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

[0006] Optionally, the steps of responding to a data query request from a target node, extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: The key string is segmented to obtain multiple lexical units, the grammatical relationships between the lexical units are analyzed, and the entity words in the multiple lexical units are marked as named entities; Based on the pre-defined business knowledge graph, named entities are mapped to standard data models to obtain business mapping results; Based on the named entities and business mapping results, determine the query intent type of the data query request; Obtain the user profile of the target node, and generate the data query target for the target node based on the query intent type.

[0007] Optionally, the step of obtaining the user profile of the target node and generating the data query target of the target node according to the query intent type includes: Based on the management level, professional level, and reporting path of the target node, obtain the job level characteristics; Based on the department type, business importance, and data sensitivity of the target node, obtain department attribute characteristics; Based on the target node's functional permissions, data permissions, and approval permissions, obtain the role permission characteristics; Data access behavior characteristics are obtained by analyzing the access frequency, access depth, and query intent of the target node. Based on the target node's technical capability level, business understanding depth, and security awareness level, acquire capability characteristics; Trust characteristics are obtained based on the historical behavior trust level and responsibility level of the target node; Based on job level characteristics, department attribute characteristics, role permission characteristics, data access behavior characteristics, ability characteristics, and trust level characteristics, obtain user profiles for target nodes.

[0008] Optionally, the steps of responding to a data query request from a target node, extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: Based on the access time, geographical location, device type, and network security status when the target node sends a data query request, obtain the environmental risk factor; Based on the data query objectives, the sensitivity, timeliness, and relevance of the data query request to the target node are obtained to determine the data risk factors; Based on the data query target, obtain the object node and current business status of the data query request, and determine the organizational risk factor based on the sensitivity of the object node and the current business status; The risk coefficient of the data query target is assessed based on the environmental risk factors, data risk factors, and organizational risk factors.

[0009] Optionally, the step of adjusting the preset data access range to the target data access range based on the risk coefficient includes: When the risk coefficient is within the first preset range, the target data access range is the same as the preset data access range. When the risk coefficient is within the second preset range, the target data access range is limited to direct subordinate nodes of the target node. When the risk coefficient is in the third preset range, the target data access range is limited to allowing access only to the target node.

[0010] Optionally, the step of determining the data query conditions based on the target data access scope includes: Based on the target data access scope, obtain the logical conditions and parameter conditions corresponding to the organization node; Based on the logical and parameter conditions, obtain the basic query condition fragments based on the database query language; Based on the data query request, obtain the business filtering conditions, and concatenate the basic query condition fragments with the business filtering conditions to determine the data query conditions.

[0011] Secondly, this application provides an organization authorization system based on a pre-sorted traversal tree algorithm, comprising: The preset data access range acquisition module is configured to acquire the organizational structure and preprocess the organizational structure based on the pre-sorted traversal tree algorithm to obtain multiple organizational nodes, assign left and right values ​​to each organizational node, and obtain the preset data access range of the target node based on the left and right values ​​of the target node. The risk coefficient acquisition module is configured to respond to the data query request of the target node, extract the key strings in the data query request, perform semantic understanding on the key strings based on the semantic understanding model, generate the data query target of the target node, and evaluate the risk coefficient of the data query target. The query result output module is configured to adjust the preset data access range to the target data access range based on the risk coefficient, determine the data query conditions based on the target data access range, rewrite the data query request of the target node to generate an extended statement based on the data query conditions, and send the data query result to the target node based on the extended statement.

[0012] Optionally, the basic data access scope acquisition module is configured as follows: Based on the left and right values ​​of the target node, obtain the management organization scope of the target node; Obtain the depth level of the target node, and based on the management organization scope, obtain the basic data access scope; The adjustment coefficient acquisition module is configured to: establish a relationship between the target node and time weight based on the historical busy phases of the target business, and determine the first adjustment coefficient; Based on the correlation between the target business and the target node, establish the weight relationship between the target node and the business, and determine the second adjustment coefficient; The preset data access range output module is configured to determine the preset data access range based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

[0013] Thirdly, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the computer program to implement the method described above.

[0014] The beneficial effects that this application can achieve are: This application proposes an organizational authorization method, system, and device based on a pre-sorted traversal tree algorithm. By preprocessing the organizational structure using this algorithm, recursive / multiple queries of a tree structure are transformed into single-range queries on left and right values, reducing computational complexity and improving response speed. The range is dynamically adjusted and the query is rewritten based on risk coefficients, achieving dynamic and adaptive data security control. This transforms a static, pre-defined permission model into a dynamic, context-driven model. The permission range of target nodes is no longer fixed but adaptively adjusted based on real-time risk assessment results, enabling refined authorization tailored to specific problems. For low-risk queries, permissions can be maintained or relaxed to ensure business efficiency; for high-risk queries, permissions are tightened to prevent data overreach. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the organization authorization method according to an embodiment of this application; Figure 2 This is a schematic diagram of the preset data access range acquisition process in an embodiment of this application.

[0016] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0019] In this invention, unless otherwise explicitly specified and limited, the terms "connection," "fixed," etc., should be interpreted broadly. For example, "fixed" can mean a fixed connection, a detachable connection, or an integral part; it can mean a mechanical connection or an electrical connection; it can mean a direct connection or an indirect connection through an intermediate medium; it can mean the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0020] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the meaning of "and / or" throughout the text includes three parallel solutions; for example, "A and / or B" includes solution A, solution B, or a solution where both A and B are satisfied simultaneously. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0021] Example 1 Reference Figure 1 The first embodiment of this application provides an organization authorization method based on a pre-sorted traversal tree algorithm, including the following steps: S10. Obtain the organizational structure and preprocess it based on the pre-sorted traversal tree algorithm to obtain multiple organizational nodes. Assign left and right values ​​to each organizational node and obtain the preset data access range of the target node based on the left and right values ​​of the target node.

[0022] Optionally, during the preprocessing of the organizational structure using the pre-sorted traversal tree algorithm, the complete organizational structure tree is obtained from a database or configuration center. The organizational structure is represented as a tree data structure in memory, and a depth-first traversal is performed starting from the root node. During the traversal, each organizational node is assigned a unique left-hand value and a right-hand value. When an organizational node is visited for the first time, an incrementing left-hand value is assigned. After traversing all child nodes of the node, an incrementing right-hand value is assigned to the organizational node before backtracking to its parent node. The unique identifier, left-hand value, right-hand value, and hierarchical relationship of each node are stored in a database table. The hierarchical relationship between parent and child nodes in the tree structure is encoded as a numerical range relationship between left-hand and right-hand values; that is, the left-hand / right-hand value of all child nodes of any organizational node must fall within the range formed by the left-hand and right-hand values ​​of that node. Preprocessing the organizational structure using the pre-sorted traversal tree algorithm transforms complex recursive queries or multiple join queries into a single, efficient range query on two numerical fields, improving data retrieval speed under large-scale organizational structures. A clear, mathematically interval-based relationship graph is pre-defined for each node, making the description of complex permission scopes, such as obtaining a department and all its subordinate departments, very simple and consistent. The low computational complexity of the algorithm enables the system to easily handle the rapid expansion and deepening of organizational structures, providing robust underlying support for large enterprise applications.

[0023] S20. In response to the data query request of the target node, extract the key strings in the data query request, perform semantic understanding on the key strings based on the semantic understanding model, generate the data query target of the target node, and evaluate the risk coefficient of the data query target.

[0024] Optionally, intercept user data query requests, such as SQL statements and API calls, and extract key strings using natural language processing (NLP) techniques. These strings may include: the database table name, field names (e.g., salary, IDcard), operation type (e.g., SELECT, EXPORT), and condition values. Input the extracted key strings into a pre-trained semantic understanding model. Identify key entities in the query, such as employee personal information, financial data, and departmental summary reports. Determine the user's query intent, such as whether to generate a monthly report or export detailed personal information. Based on the semantic understanding results and a predefined security rule base, assess the risk of the query. For example: queries involving multiple sensitive fields such as salary and ID numbers are assessed as high risk; large-scale export increases the risk; queries occurring outside of working hours slightly increases the risk. Finally, generate a quantified risk coefficient, such as a decimal between 0 and 1, or three levels: low, medium, and high. Different query intents represent different business risks, and the system needs to be able to identify these risks, rather than relying solely on static identity permissions. This is a prerequisite for implementing dynamic authorization. In this step, the system is given the ability to understand the query intent of the target node, enabling it to distinguish between routine business operations and high-risk data snooping behavior. The quantified risk coefficient provides accurate and reliable input parameters for the next step of dynamically adjusting the scope of permissions, transforming authorization decisions from static configuration to dynamic calculation.

[0025] S30. Adjust the preset data access range to the target data access range according to the risk coefficient, determine the data query conditions according to the target data access range, rewrite the data query request of the target node to generate an extended statement according to the data query conditions, and send the data query result to the target node according to the extended statement.

[0026] Optionally, a mapping strategy between risk coefficients and permission scope can be established. For example, in low-risk situations, the scope can be maintained or relaxed to a preset range, such as allowing access to the current department and all sub-departments. In medium-risk situations, the scope can be narrowed, such as allowing access only to the current department. In high-risk situations, the scope can be further narrowed or additional restrictions can be added, such as allowing access only to the user's own data, or returning anonymized data. Based on the adjusted target data access scope, it is converted into specific query conditions. For example, if the scope is narrowed to only the current department, the new query condition might be WHERE department_id=[current department ID]. The original data query request for the target node is parsed and securely rewritten, and the data query conditions generated in the previous step are injected into the WHERE clause of the original query using an AND connection. The database executes the rewritten expanded statement with added security boundaries and returns the final query results within the secure scope to the target node. In this step, the rigid mode of traditional static authorization is broken, and fine-grained access control with dynamic adjustment of permissions according to risk is achieved. It ensures query efficiency and data integrity in low-risk business scenarios while automatically initiating strict protection in high-risk scenarios. Through a query rewriting mechanism, the entire process is seamless for users, achieving security enhancement without modifying business code, resulting in strong system compatibility and implementability. Mandatory scope restrictions are implemented from the source of data access to the returned results, effectively preventing unauthorized data access through legitimate interfaces.

[0027] Example 2 Based on Example 1, this example provides an organization authorization method based on a pre-sorted traversal tree algorithm, including the following steps: S10. Obtain the organizational structure and preprocess it based on the pre-sorted traversal tree algorithm to obtain multiple organizational nodes. Assign left and right values ​​to each organizational node and obtain the preset data access range of the target node based on the left and right values ​​of the target node.

[0028] Optionally, the steps of obtaining the organizational structure and preprocessing it based on a pre-sorted traversal tree algorithm to obtain multiple organizational nodes, assigning left and right values ​​to each organizational node, and obtaining the preset data access range of the target node based on its left and right values ​​include: S101. Obtain the management organization scope of the target node based on the left and right values ​​of the target node; Specifically, the preorder traversal tree algorithm, also known as preorder traversal, is a classic method for traversing tree structures. Its core idea is to visit nodes in the root-left-right order: first, visit the root node, the starting point of the current subtree; then recursively traverse the left subtree (the subtree composed of all left-child nodes); then recursively traverse the right subtree (the subtree composed of all right-child nodes). This order reflects a top-down access logic, starting from the root node, prioritizing the exploration of the left branch, and then moving to the right branch. Utilizing the characteristics of the preorder traversal tree algorithm, a database query is executed. The query condition is: find all organizational nodes whose left value is greater than or equal to the left value of the target node and whose right value is less than or equal to the right value of the target node. The set of these organizational nodes constitutes the management scope of the target node in the organizational structure. This provides each organizational node with a clear, unambiguous, and mathematically calculated management scope. All subsequent coefficient adjustments are performed within this management scope, ensuring the stability and predictability of the authorization system.

[0029] S102. Obtain the depth level of the target node and, based on the management organization scope, obtain the basic data access scope; Specifically, during preprocessing, in addition to left and right values, the depth level of each node can be calculated and stored. For example, the root node is level 1, and the level increments by 1 for each subsequent level. Based on preset rules, the scope of management organization is pruned according to the depth of the node. For example, for high-level nodes, such as groups or business units at depths of 1-3, their basic data access scope may be limited to their directly subordinate departments at levels 1-2, rather than all their descendants, to prevent excessive permissions. For low-level nodes, such as teams or individuals at depths of 4 and above, their basic data access scope may be their complete "management organization scope." In reality, a high-level manager theoretically governs the entire subtree, but in actual business operations, they may not need to access the specific data of every employee at the lowest level. Preprocessing the initial scope by depth level achieves initial convergence of permissions, enhancing security and compliance. This prevents potential data leakage risks from mid-to-high-level users due to excessive static permissions, conforming to best practices in data security.

[0030] S103. Based on the historical busy phases of the target business, establish the relationship between the target node and the time weight, and determine the first adjustment coefficient; Specifically, historical system logs are collected to analyze the query frequency and data volume of specific business operations, such as financial month-end closing and sales promotions, at different times. A time-weighted table is established, which involves creating a weight mapping. For example, during the three days following the financial month-end closing, which may be a busy period, the weight coefficient for the finance department node is 1.2, expanding permissions beyond the basic data access scope; during off-peak periods, the coefficient is 0.9, tightening permissions beyond the basic data access scope. When a query request is received, the system searches the time-weighted table and determines the first adjustment coefficient based on the current time and the business type of the target node. Business needs are not static but fluctuate cyclically over time. During busy periods, appropriately broadening the data scope helps efficient decision-making and business processing; during off-peak periods, tightening permissions ensures security. This allows the data authorization system to be correlated with the business cycle, upgrading from static configuration to dynamic adaptation. During busy periods, frequent temporary authorization requests due to overly tight permissions are avoided, ensuring the smooth operation of core businesses and improving business processing efficiency during specific periods. During off-peak periods, permissions are automatically tightened to reduce data exposure during unnecessary times.

[0031] S104. Based on the correlation between the target business and the target node, establish the correlation weight relationship between the target node and the business, and determine the second adjustment coefficient; Specifically, the core related departments are defined for different business operations within the organization, such as financial statement preparation, human resource auditing, and marketing activity analysis. A relationship weight matrix is ​​established, with specific steps including: creating a matrix describing the relationship strength between different node types and business types. For example, the finance department has a high relationship strength with the financial statement preparation business, so the second adjustment coefficient is 1.3, expanding permissions beyond the basic data access scope. The marketing department has a low relationship strength with the financial statement preparation business, so the second adjustment coefficient is 0.8, tightening permissions beyond the basic data access scope. The second adjustment coefficient is determined from the relationship weight matrix based on the target business to which the current data query request belongs and the target node initiating the request. A node's access to business data unrelated to its core functions should be more strictly restricted. This ensures that data is accessed only by those who need it, further implementing the principle of least privilege. Deeply binding permissions to specific business scenarios restricts access to sensitive business data by unrelated departments, reducing the risk of internal data misuse. Permission allocation rules are highly consistent with business logic, making authorization decisions easier for business departments to understand and accept.

[0032] S105. Determine the preset data access range based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

[0033] Specifically, a specific calculation function is defined. For example, a multiplication model can be used: Preset data access range = Basic data access range × First adjustment coefficient × Second adjustment coefficient. It should be noted that in the actual implementation, the application method of the coefficients may need to be defined, such as adjusting the range hierarchy or limiting the number of result sets. Upon receiving a request, the system dynamically calculates the final preset data access range. This result may be a new, scaled left and right value interval, or a redefined list of nodes. It should be noted that during the process of setting the preset data access range, the actual left and right values ​​of the target nodes are not changed; instead, virtual left and right values ​​are temporarily assigned to the target nodes. In this step, multiple dimensions such as time, business relevance, and organizational hierarchy are considered to output an optimal, dynamic preset permission value. The system no longer mechanically executes a fixed basic data access range but can dynamically adjust the basic data access range to determine the preset data access range.

[0034] S20. In response to the data query request of the target node, extract the key strings in the data query request, perform semantic understanding on the key strings based on the semantic understanding model, generate the data query target of the target node, and evaluate the risk coefficient of the data query target.

[0035] Optionally, in response to a data query request from a target node, the steps of extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: S201. Segment the key string to obtain multiple lexical units, analyze the grammatical relationships between the lexical units, and mark the entity words in the multiple lexical units as named entities. Specifically, a word segmentation tool is used to break down the key strings in the query request into independent lexical units. A key string might be: "Export a list of salaries and ID numbers for all employees last month." The segmented lexical units might be: export, last month, all, employees, of, salary, and, ID number, list. Dependency parsing or part-of-speech tagging is then performed to identify grammatical components such as subject, predicate, and object, and to understand the modifying relationships between words. For example, "export" is identified as the core verb, "list" as the object, "salary and ID number" as the specific content of the list, and "of all employees" as the modifying content. Entities with specific meanings are identified and categorized from the lexical units. For example, salary and ID number are identified as data entities, sensitive personal information; employees are identified as organizational entities; and last month is identified as a time entity. This transforms unstructured text data into structured, machine-understandable language units and relationships. This gives the chaotic raw query text a preliminary structure, enabling the computer to begin logical analysis. By using named entity recognition, the system can accurately extract core concepts that are crucial to risk assessment from queries, such as sensitive fields and operation types, providing data support for deep semantic understanding.

[0036] S202. Based on the preset business knowledge graph, map named entities to the standard data model to obtain business mapping results; Specifically, a knowledge graph is pre-constructed, containing enterprise business concepts, data assets, and their relationships. For example, the graph defines: salaries belong to financial data and have a high sensitivity level; ID numbers belong to personal identity information and have an extremely high sensitivity level; employees are associated with the human resources module. Named entities identified by S201 are linked to standard nodes in the knowledge graph. For example, the salary query from a user is mapped to the standard concept of employee salary data in the knowledge graph, inheriting its high sensitivity attribute.

[0037] S203. Determine the query intent type of the data query request based on the named entity and business mapping results; Specifically, the outputs of the previous steps, such as entity type, entity sensitivity, operation verbs, and syntactic structure, are combined into a feature vector. Based on a rule engine or machine learning classifier, a classification model is used to analyze these features and determine their corresponding query intent type. For example: Output the following entities: The operation entity is: Export; The first data entity is: salary, which is highly sensitive; The second data entity is: the ID number, which has extremely high brightness. The scope includes: all employees; Based on the above entity output intent type: Batch export of sensitive personnel information.

[0038] In this step, all low-level features are synthesized to provide a high-level summary and qualitative analysis of the user's behavioral intent. Different intent types directly correspond to different risk levels. Information about the data and how it was operated is synthesized and refined into a conclusion about the intended action. The system can penetrate the surface of the query statement and directly target the true operational intent of the target node; this is a crucial leap towards achieving intelligent risk control.

[0039] S204. Obtain the user profile of the target node and generate the data query target of the target node according to the query intent type.

[0040] Specifically, query intent types are combined with user profiles to generate the final data query target containing contextual information. For example, an intent to batch export sensitive personnel information, if originating from a user in a payroll management role, might be considered legitimate payroll calculation preparation. Conversely, the same intent, if originating from a user in the marketing department, might be considered suspicious unauthorized data collection. By incorporating user profiles, ambiguity in the process of generating data query targets for target nodes is reduced. For instance, if the target node is an engineer initiating Apple performance evaluation data, the "apple" refers to an electronic device, not a type of fruit.

[0041] For example, query intent types include: Detailed query: Requests specific, row-level raw data records. Example: Query employee Zhang San's ID number and salary.

[0042] Statistical queries: These requests aggregate data to obtain summary results without involving specific individual information. Example: Calculate the average salary for each department.

[0043] Business decision support: Queries performed for management purposes such as generating reports and formulating strategies, often involving statistical or limited-scope scans. Example: Generating a second-quarter product sales report.

[0044] Data exploration and analysis: Pattern queries for data analysis and mining purposes may involve variable behaviors, requiring attention to the depth of access. Example: Finding the correlation between customer purchasing behavior and geographic location.

[0045] Batch Export: Requests export of large amounts of data to the system in offline-compatible formats, such as Excel and CSV. Example: Export all customer data.

[0046] Optionally, the steps of obtaining the user profile of the target node and generating the data query target for the target node based on the query intent type include: S2041. Obtain job level characteristics based on the management level, professional level, and reporting path of the target node; Specifically, data is extracted from the HR system to quantify the organizational position of target nodes. This includes management levels such as entry-level, middle-level, and senior-level; professional levels such as junior, expert, and senior expert; and reporting paths such as reporting to the department director. Job hierarchy forms the basic framework for authority allocation. Senior managers typically require a more macro-level, cross-departmental data perspective, while entry-level employees are more focused on their own team's data. This characteristic ensures consistency between the authority model and the organizational structure.

[0047] S2042. Obtain department attribute characteristics based on the department type, business importance, and data sensitivity of the target node; Specifically, each department is tagged. For example, department type (e.g., finance, R&D, marketing), business importance (e.g., core revenue department, support department), and the inherent data sensitivity of the department (e.g., finance department, human resources department handles highly sensitive data). A user's department determines the business context of their work. A normal query from a finance department employee might naturally be more sensitive than from other departments. The system can identify queries from users in specific departments that may involve higher risks, thus adopting a more prudent assessment strategy.

[0048] S2043. Obtain role permission characteristics based on the target node's functional permissions, data permissions, and approval permissions; Specifically, by integrating data from the RBAC (Role-Based Access Control) system, a list of explicitly granted permissions for the target node is defined, including accessible system functions, configured static data scope, and the level of approval authority possessed. This represents the legal boundaries of a user's permissions within the current system, reflecting the baseline of the enterprise's trust in that user.

[0049] S2044. Obtain data access behavior characteristics by analyzing the access frequency, access depth, and query intent of the target node. Optionally, real-time analysis of user behavior logs is available. This includes access frequency (e.g., whether a large number of queries are initiated in a short period), access depth (e.g., whether queries are aggregated data or drill down to row-level details), and historical query intent (e.g., whether there are any high-risk query records in the past). A user's historical and real-time behavior is the most accurate reflection of their intent and reliability. A user who suddenly changes their behavior pattern, such as from low-frequency to high-frequency, or from aggregated to detailed data, will significantly increase their risk. This is crucial for detecting account theft and insider threats.

[0050] S2045. Based on the target node's technical capability level, business understanding depth, and security awareness level, obtain capability characteristics; Optionally, a comprehensive assessment can be conducted through training records, certification exams, and analysis of the complexity of historical queries to evaluate a user's technical capabilities, such as SQL skills, depth of business knowledge, and understanding of security policies. A user's capabilities determine whether they can securely and correctly use the granted data permissions. Granting a complex query permission containing sensitive data to a user with insufficient technical skills and security awareness is itself a risk.

[0051] S2046. Based on the historical behavior trust level and responsibility level of the target node, obtain the trust level characteristics; Optionally, a dynamic trust score can be calculated. Historical behavior trust level is based on factors such as whether there are any violations, and whether operations are performed with caution; responsibility level may be related to their position, signed confidentiality agreements, etc. It is a credit assessment of a user's long-term performance; a user who consistently adheres to regulations and bears higher responsibility can gain more trust and relatively more flexible permissions. Users with good behavior are rewarded to improve their work efficiency, while users with low trust levels are subject to stricter control.

[0052] S2047. Based on job level characteristics, department attribute characteristics, role permission characteristics, data access behavior characteristics, ability characteristics, and trust level characteristics, obtain the user profile of the target node.

[0053] Specifically, weighted fusion or machine learning models are used to integrate the feature vectors of the above six dimensions into a unified, quantified user profile. For example, this outputs a comprehensive score or a profile object containing multiple dimensions. A single dimension is incomplete; only by integrating multiple perspectives such as organization, role, behavior, ability, and trust can a comprehensive, three-dimensional, and impartial user view be formed. This allows for a more accurate identification of query intent types and reduces ambiguity in the data query process of generating target nodes.

[0054] Optionally, in response to a data query request from a target node, the steps of extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: S210. Obtain environmental risk factors based on the access time, geographical location, device type, and network security status when the target node sends a data query request; Specifically, determine whether the request occurred during working hours, holidays, or system-defined sensitive time windows, such as financial settlement periods. Identify the geographical location of the login IP to determine if it is a common office location, a resident city, or if there are any unusual cases of consecutive logins from two geographically distant locations within a short period. Check whether the device initiating the request is a registered, managed company asset, such as an office computer, or a personal or unknown device. Assess the security of the current network environment, such as whether access is through a company VPN, whether public Wi-Fi is being used, and whether the connection is encrypted. Assign risk weights to each sub-item and calculate a comprehensive environmental risk factor using a predefined model, such as weighted summation. For example, non-working hours + unfamiliar location + personal device + public network will result in an extremely high risk value. Even if the query intent and user identity are legitimate, an abnormal environmental context may indicate account theft, internal personnel misconduct, or a hacker attack.

[0055] S220. Based on the data query objective, obtain the sensitivity, timeliness, and relevance of the data query request to the target node, and determine the data risk factors; Specifically, based on a business knowledge graph, the sensitivity level of the data assets involved in the query target is identified, such as public, internal, confidential, and top secret. The time range of the data targeted by the query request is analyzed. Accessing real-time data and the latest transaction records generally carries a higher risk than accessing historical archived data. Combined with user profiles, especially departmental attributes, the business relevance of the data to the target node is determined. Access to financial data by finance personnel has a high relevance, while access by marketing personnel has a low relevance. These three dimensions are then used to calculate a data risk factor. A combination of high sensitivity, high timeliness, and low relevance will result in an extremely high risk value.

[0056] S230. Based on the data query target, obtain the object node and current business status of the data query request, and determine the organizational risk factor based on the sensitivity of the object node and the current business status. Specifically, identify the sensitivity of the target node for the query. For example, the sensitivity increases progressively when querying data of a regular employee versus data of a core R&D team member at the parent node. Determine the organization's current business cycle or state. For example, is it in a sensitive period such as legal proceedings, the eve of a major project bidding, a quiet period before financial report releases, or a period of organizational restructuring? Combine both. Accessing data of highly sensitive target nodes under sensitive business conditions will generate extremely high organizational risk factors.

[0057] S240. Assess the risk coefficient of the data query target based on environmental risk factors, data risk factors, and organizational risk factors.

[0058] Specifically, based on a fusion function, which can be a weighted linear model, a rule-based decision tree, or a more complex machine learning model, the risk factors output from the first three steps are used as input to the model for calculation. A final, quantified risk coefficient is generated, directly driving the dynamic adjustment of permissions in step S30. This overcomes the limitations of single-dimensional risk control models, obtaining a more accurate and reliable final risk assessment through the mutual corroboration of multi-dimensional evidence.

[0059] S30. Adjust the preset data access range to the target data access range according to the risk coefficient, determine the data query conditions according to the target data access range, rewrite the data query request of the target node to generate an extended statement according to the data query conditions, and send the data query result to the target node according to the extended statement.

[0060] Optionally, the step of adjusting the preset data access range to the target data access range based on the risk factor includes: S301. When the risk coefficient is within the first preset range, the target data access range is the same as the preset data access range. Specifically, the first preset interval typically corresponds to a low-risk level. For example, the risk coefficient is between [0, 0.3]. If the system determines that the risk coefficient of the current request falls within this interval, then the query is considered safe and reliable. No changes are made to the original preset data access range; it is directly used as the target data access range. For example, a department manager can still access the data of the entire subtree under their jurisdiction. For routine and compliant operations identified as low-risk by the system, users are given a complete, preset data view, ensuring smooth business processes and preventing security measures from becoming obstacles to business development.

[0061] S302. When the risk coefficient is in the second preset range, the target data access range is limited to the direct subordinate nodes of the target node. Specifically, the second preset interval typically corresponds to a medium risk level. For example, a risk coefficient between (0.3, 0.7). The system determines that this query has potential risks or warrants attention. Access control needs to be narrowed, but not completely locked. The access scope is reduced from the complete preset data access scope, such as the entire subtree, to only directly subordinate nodes. In a pre-sorted traversal tree, this typically means finding all nodes where parent_id = the current node ID. When the system detects anomalies, such as environmental anomalies or sensitive intent, but cannot yet confirm malicious behavior, this strategy strikes a balance between security and permissions. It limits users' ability to access deep data on a large scale while retaining the permissions needed to perform most of their direct management responsibilities. This makes security responses more refined and rational, preventing the impact of risky operations from spreading throughout the entire organizational branch and limiting the potential for data breaches to the smallest directly related team.

[0062] S303. When the risk coefficient is in the third preset range, the target data access range is limited to only allowing access to the target node.

[0063] Specifically, the third preset interval typically corresponds to a high-risk or extremely high-risk level. For example, a risk coefficient between (0.7, 1.0). The system determines that this query has highly suspicious or clear malicious characteristics. The strictest restrictions must be implemented. The access scope is drastically narrowed to only the target node itself, meaning the user can only access their personal data or the non-sensitive aggregated data of their smallest team. When multiple risk factors, such as abnormal environment, highly sensitive data, and unrelated departments, simultaneously point to high risk, the system will trigger the strictest protection mechanism. This is equivalent to immediately implementing minimum access control when an account is suspected of being stolen or a malicious internal threat is detected. It can effectively deal with extreme scenarios such as stolen credentials or malicious data scraping by internal personnel.

[0064] Optionally, the steps for determining data query conditions based on the target data access scope include: S310. Based on the target data access range, obtain the logical conditions and parameter conditions corresponding to the organization node; Specifically, the system receives the target data access range calculated from the preceding steps. This target data access range may exist in various forms, such as: Pre-sorted traversal of tree intervals: such as (left value > 15 AND right value < 28), which represents a department and all its sub-departments.

[0065] List of node IDs: e.g., department IDIN(101,102,105).

[0066] Transform the above range into a logical expression structure in an SQL query. For example, convert the range into an AND condition in the WHERE clause. Identify the parameters that need to be dynamically bound in the logical conditions. For example, in the condition: Department ID=XXX, XXX is a parameter, and its specific value, such as 101, is the parameter condition.

[0067] S320. Based on the logical conditions and parameter conditions, obtain the basic query condition fragments based on the database query language; Specifically, a database query language can be understood as a set of predefined SQL templates or generation rules optimized for a specific database. For a pre-order traversal tree query, ensure that the generated fragments can utilize indexes. For example, avoid performing function calculations on the left and right values. Generate syntax conforming to the dialects of different database types, such as MySQL, Oracle, and PostgreSQL. Use parameterized queries to prevent SQL injection attacks. Generate basic query condition fragments, which can output a secure and optimized SQL code fragment. For example: Input: Logical condition left value >? AND right value <?, parameter condition [15, 28]; Output: A parameterized query fragment "lft >? AND rgt <?" and the corresponding parameter array [15, 28]. Here, lft represents the left value, rgt represents the right value, and "?" represents a certain value.

[0068] SSS330. According to the data query request, obtain the business filtering conditions, splice the basic query condition fragments with the business filtering conditions, and determine the data query conditions.

[0069] Specifically, extract the business-related filtering conditions from the user's original data query request. For example, the user requests: "Query employees whose names contain 'Zhang' and whose status is 'employed'". The extracted business filtering conditions are: "name LIKE '%Zhang%' AND status = 'employed'".

[0070] Splice the basic query condition fragments in S320 with the business filtering conditions using the AND logical operator. Complete data query condition = basic query condition fragment AND business filtering condition; Based on the above example of business filtering conditions: "(lft >? AND rgt <? ) AND (name LIKE '%Zhang%' AND status = 'employed')".

[0071] Merge the parameter list of the basic query fragment with the parameter list of the business filtering condition to form the final parameter array for performing the parameterized query. Through the AND connection, it ensures that the final result meets both the security policy and the user's business requirements, and the security policy is mandatory, and users cannot bypass it by modifying the business conditions. Within the security boundary, fully respect the user's business query intention, ensuring the accuracy and availability of the query result. This is the last link in the entire dynamic authorization chain, which finally embodies all the previous complex risk assessments and decisions as a secure and executable database query, making the entire solution feasible.

[0072] To facilitate the understanding of the technical solution of this embodiment, the following examples are given for illustration. It should be noted that the following examples are only for the purpose of facilitating the understanding of the solution: The scenario is set as follows: Company: A large retail enterprise; Organizational structures already processed using the pre-sorted traversal tree algorithm: Company (ID:1, lft:1, rgt:14, depth:1); ├─Finance Department (ID:2, lft:2, rgt:7, depth:2); │├─Budget Group (ID:4, lft:3, rgt:4, depth:3); │└─Accounting Group (ID:5, lft:5, rgt:6, depth:3); ├─Marketing Department (ID:3, lft:8, rgt:13, depth:2); │├─Online Promotion Team (ID:6, lft:9, rgt:10, depth:3); │└─Offline Events Group (ID:7, lft:11, rgt:12, depth:3); Target node: Xiao Wang, manager of the Marketing Department - Offline Activities Group (ID:7). His default data access scope is his entire organizational subtree, i.e., lft>=11 AND rgt<=12 (meaning he can only access data from his own group).

[0073] Incident: At 10 PM on Friday, Xiao Wang logged into the company system at home using his laptop via public Wi-Fi. He entered the query: "Export the salary details and ID numbers of all marketing department employees from last year for a market analysis report."

[0074] Based on the received data query request, the system extracts keywords such as "export," "marketing department," "all employees," "salary details," and "ID number." The salary details and ID number are mapped to a standard data model and identified as highly sensitive personal financial and identity information. Considering the "export" operation and the highly sensitive data, the system determines the query intent to be the bulk export of sensitive personnel information, which is a high-risk intent.

[0075] The system retrieves Xiao Wang's user profile: Job level (S2041): Junior Manager.

[0076] Department Attribute (S2042): Marketing Department, with low correlation to financial data.

[0077] Role permissions (S2043): Only has query permissions for data within this group, no permissions for cross-departmental financial data.

[0078] Data access behavior (S2044): First query for this type of sensitive information.

[0079] Competency Characteristics (S2045): No Financial Data Analyst Certification.

[0080] Trust level characteristic (S2046): Trust level is good, but there is no special trust bonus.

[0081] Overall profiling conclusion: A junior manager in the marketing department has no reasonable grounds to access highly sensitive salary data from across departments.

[0082] The system conducts risk assessments based on query targets and user profiles: Environmental risk factor (S210): High. Reasons: Off-work hours + Off-company network + Off-company equipment.

[0083] Data Risk Factor (S220): Extremely High. Reason: Extremely high data sensitivity + extremely low relevance to Xiao Wang's department.

[0084] Organizational risk factor (S230): Medium. Reason: The query target is "all employees in the marketing department," which has a broad scope but does not include top management.

[0085] Comprehensive Risk Coefficient Assessment (S240): Combining three high-risk factors, the system calculates a final risk coefficient of 0.9 (assuming a full score of 1.0), which is considered high risk.

[0086] Based on a risk coefficient of 0.9, it falls into the third preset range, and the system triggers the strictest permission reduction policy (S303).

[0087] Adjustment decision: Reduce Xiao Wang's target data access range from its preset range (lft>=11 ANDrgt<=12, i.e., the data in this group) to only allow access to the target node itself.

[0088] New target data access scope: Node ID=7. This means he can now only query his own personal data.

[0089] Define the query conditions: From the new target data access scope, obtain the logical condition "employee_id=?", with the parameter being Xiao Wang's employee ID. The system generates a parameterized query fragment "WHEREemployee_id=?". The user's original query may contain business conditions, such as "last year's", which we assume is converted to "year=2023". The system concatenates the two using AND to form the final data query condition: "WHEREemployee_id=?ANDyear=2023".

[0090] Rewriting and executing the query: Original data query request: "SELECT * FROM salary_table WHERE department ='Marketing Department' AND year = 2023".

[0091] Rewritten extended statement: "SELECT * FROM salary_table WHERE employee_id ='Employee ID of Xiao Wang' AND year = 2023".

[0092] Sent result: The database executed the rewritten statement, and finally the system only returned the salary information of Xiao Wang in 2023 to him. The data of "all employees in the Marketing Department" he requested was completely blocked. Based on the output result, in order to verify the accuracy of the result or verify certain special situations, such as the data query request is an instruction issued by the highest authority owner to Xiao Wang, an artificial judgment mechanism can be introduced, that is, it can prompt Xiao Wang that some data is blocked and pop up whether to send a verification request to the highest authority owner. After the highest authority owner passes the information verification, the blocked message can be sent to Xiao Wang.

[0093] Embodiment 3 Based on Embodiment 1, this embodiment provides an organizational authorization system based on the pre-order traversal tree algorithm, including: A preset data access range acquisition module, which is configured to obtain an organizational structure, preprocess the organizational structure based on the pre-order traversal tree algorithm to obtain multiple organizational nodes, assign left values and right values to each organizational node, and obtain the preset data access range of the target node according to the left value and right value of the target node; A risk coefficient acquisition module, which is configured to respond to a data query request of a target node, extract a key string in the data query request, perform semantic understanding on the key string based on a semantic understanding model, generate a data query target of the target node, and evaluate the risk coefficient of the data query target; A query result output module, which is configured to adjust the preset data access range to a target data access range according to the risk coefficient, determine a data query condition according to the target data access range, rewrite the data query request of the target node through the data query condition to generate an extended statement, and send a data query result to the target node according to the extended statement.

[0094] Optionally, a basic data access range acquisition module, which is configured to: Obtain the management organization range of the target node according to the left value and right value of the target node; Obtain the depth level of the target node, and obtain the basic data access range based on the management organization range; The adjustment coefficient acquisition module is configured to: establish a relationship between the target node and time weight based on the historical busy phases of the target business, and determine the first adjustment coefficient; Based on the correlation between the target business and the target node, establish the weight relationship between the target node and the business, and determine the second adjustment coefficient; The preset data access range output module is configured to determine the preset data access range based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

[0095] Example 4 This embodiment provides a computer device, including a memory and a processor. The memory stores a computer program that can run on the processor, and the processor executes the computer program to implement any of the methods described above.

[0096] Example 5 This embodiment provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above.

[0097] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. An organization and authorization method based on a pre-sorted traversal tree algorithm, characterized in that, include: The organizational structure is obtained and preprocessed based on the pre-sorted traversal tree algorithm to obtain multiple organizational nodes. Each organizational node is assigned a left value and a right value. The preset data access range of the target node is obtained based on the left value and the right value of the target node. In response to a data query request from a target node, key strings are extracted from the data query request. Based on a semantic understanding model, the key strings are semantically understood to generate the data query target for the target node and the risk coefficient of the data query target is evaluated. The preset data access range is adjusted to the target data access range based on the risk coefficient. Data query conditions are determined based on the target data access range. The data query request of the target node is rewritten to generate an extended statement based on the data query conditions. The data query result is sent to the target node based on the extended statement.

2. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 1, characterized in that, The steps of obtaining the organizational structure and preprocessing it using a pre-sorted traversal tree algorithm to obtain multiple organizational nodes, assigning left and right values ​​to each organizational node, and obtaining the preset data access range of the target node based on its left and right values ​​include: Based on the left and right values ​​of the target node, obtain the management organization scope of the target node; Obtain the depth level of the target node, and based on the management organization scope, obtain the basic data access scope; Based on the historical busy phases of the target business, establish the relationship between target nodes and time weights, and determine the first adjustment coefficient; Based on the correlation between the target business and the target node, establish the weight relationship between the target node and the business, and determine the second adjustment coefficient; The preset data access range is determined based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

3. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 1, characterized in that, The steps of responding to a data query request from a target node, extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: The key string is segmented to obtain multiple lexical units, the grammatical relationships between the lexical units are analyzed, and the entity words in the multiple lexical units are marked as named entities; Based on the pre-defined business knowledge graph, named entities are mapped to standard data models to obtain business mapping results; Based on the named entities and business mapping results, determine the query intent type of the data query request; Obtain the user profile of the target node, and generate the data query target for the target node based on the query intent type.

4. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 3, characterized in that, The steps of obtaining the user profile of the target node and generating the data query target of the target node according to the query intent type include: Based on the management level, professional level, and reporting path of the target node, obtain the job level characteristics; Based on the department type, business importance, and data sensitivity of the target node, obtain department attribute characteristics; Based on the target node's functional permissions, data permissions, and approval permissions, obtain the role permission characteristics; Data access behavior characteristics are obtained by analyzing the access frequency, access depth, and query intent of the target node. Based on the target node's technical capability level, business understanding depth, and security awareness level, acquire capability characteristics; Trust characteristics are obtained based on the historical behavior trust level and responsibility level of the target node; Based on job level characteristics, department attribute characteristics, role permission characteristics, data access behavior characteristics, ability characteristics, and trust level characteristics, obtain user profiles for target nodes.

5. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 1, characterized in that, The steps of responding to a data query request from a target node, extracting key strings from the data query request, performing semantic understanding on the key strings based on a semantic understanding model, generating a data query target for the target node, and assessing the risk coefficient of the data query target include: Based on the access time, geographical location, device type, and network security status when the target node sends a data query request, obtain the environmental risk factor; Based on the data query objectives, the sensitivity, timeliness, and relevance of the data query request to the target node are obtained to determine the data risk factors; Based on the data query target, obtain the object node and current business status of the data query request, and determine the organizational risk factor based on the sensitivity of the object node and the current business status; The risk coefficient of the data query target is assessed based on the environmental risk factors, data risk factors, and organizational risk factors.

6. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 1, characterized in that, The step of adjusting the preset data access range to the target data access range based on the risk coefficient includes: When the risk coefficient is within the first preset range, the target data access range is the same as the preset data access range. When the risk coefficient is within the second preset range, the target data access range is limited to direct subordinate nodes of the target node. When the risk coefficient is in the third preset range, the target data access range is limited to allowing access only to the target node.

7. The organization and authorization method based on the pre-sorted traversal tree algorithm as described in claim 1, characterized in that, The step of determining the data query conditions based on the target data access scope includes: Based on the target data access scope, obtain the logical conditions and parameter conditions corresponding to the organization node; Based on the logical and parameter conditions, obtain the basic query condition fragments based on the database query language; Based on the data query request, obtain the business filtering conditions, and concatenate the basic query condition fragments with the business filtering conditions to determine the data query conditions.

8. An organization authorization system based on a pre-sorted traversal tree algorithm, characterized in that, include: The preset data access range acquisition module is configured to acquire the organizational structure and preprocess the organizational structure based on the pre-sorted traversal tree algorithm to obtain multiple organizational nodes, assign left and right values ​​to each organizational node, and obtain the preset data access range of the target node based on the left and right values ​​of the target node. The risk coefficient acquisition module is configured to respond to the data query request of the target node, extract the key strings in the data query request, perform semantic understanding on the key strings based on the semantic understanding model, generate the data query target of the target node, and evaluate the risk coefficient of the data query target. The query result output module is configured to adjust the preset data access range to the target data access range based on the risk coefficient, determine the data query conditions based on the target data access range, rewrite the data query request of the target node to generate an extended statement based on the data query conditions, and send the data query result to the target node based on the extended statement.

9. The organization authorization system based on the pre-sorted traversal tree algorithm as described in claim 8, characterized in that, include: The basic data access range acquisition module is configured as follows: Based on the left and right values ​​of the target node, obtain the management organization scope of the target node; Obtain the depth level of the target node, and based on the management organization scope, obtain the basic data access scope; The adjustment coefficient acquisition module is configured to: establish a relationship between the target node and time weight based on the historical busy phases of the target business, and determine the first adjustment coefficient; Based on the correlation between the target business and the target node, establish the weight relationship between the target node and the business, and determine the second adjustment coefficient; The preset data access range output module is configured to determine the preset data access range based on the first adjustment coefficient, the second adjustment coefficient, and the basic data access range.

10. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method of any one of claims 1 to 7.

Images