Application system authority control method and system

Abstract

The invention provides an application system authority control method and system, and relates to the technical field of software development, and the method comprises the steps: building a unified employee-post-role-authority relation model, and carrying out the unified maintenance of the corresponding relation between employees and posts, between posts and roles, and between roles and authority; packaging the model in a standard micro-service form and providing service through a standard interface; based on a message driving mechanism of employee post information, information such as employee post adjustment and organization change is used as enterprise messages and event assets to be pushed to a sharing event center for sharing; and the application system subscribes to each event type of the event center and automatically executes application system user and post permission change according to event contents, so that automatic granting and automatic change of user permission based on message driving are realized. Through the automatic and standardized authority management method, the problems existing in traditional authority management are solved, and the compliance governance capability and the information safety management level of enterprises are improved.

Description

Technical Field

[0001] This invention relates to the field of software development technology, specifically to an application system permission control method and system. Background Technology

[0002] As enterprises accelerate their digital transformation, more and more traditional businesses are migrating online, and various business systems are going live. This presents unprecedented challenges to internal IT management. Particularly in user access control, the sheer number of application systems and their relatively independent access control mechanisms, coupled with the lack of a unified access control model, results in a massive workload. Furthermore, the absence of effective approval processes to constrain system administrator behavior poses risks of unauthorized access and abuse of power. In addition, user job information is not closely linked to system permissions. When employees are transferred or leave their positions, their permissions across different application systems cannot be adjusted or deleted in a timely manner, leading to potential security vulnerabilities and information leaks.

[0003] In traditional access control, permissions are typically based on role-based access control (RBAC model), meaning that a user's access to resources or actions is determined by their assigned role. However, in real-world enterprise environments, employee job responsibilities may change, and these changes need to be reflected in the access control system. Current practice often involves system administrators manually adjusting employee permission settings based on their new roles. This approach is not only inefficient but also prone to errors, especially in large enterprises with numerous employees and frequent job changes. Clearly, this management method cannot meet the high demands of modern enterprise access control. Summary of the Invention

[0004] The purpose of this invention is to provide an application system permission control method and system that can automatically adapt to changes in employee positions and update their permissions in various application systems in a timely manner, thereby reducing the workload of permission management and improving the enterprise's compliance governance capabilities and information security management level.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] An application system access control method includes the following steps:

[0007] S1: Establish a unified employee-position-role-permission relationship model, and uniformly maintain the correspondence between employees and positions, positions and roles, and roles and permissions;

[0008] S2: Encapsulates the employee-position-role-permission relationship model established by S1 in the form of microservices, and provides services through the standard REST API interface;

[0009] S3: A message-driven mechanism based on employee job information will push information including employee job adjustments, organizational changes, and employee retirement as enterprise messages and event assets to the shared event center for shared application;

[0010] S4: The application system subscribes to various event types in the event center and automatically performs changes to user and job permissions based on the event content, using message-driven automatic granting and modification of user permissions.

[0011] Further: Step S1 specifically includes the following steps:

[0012] S11: Use the employee management system to collect and organize information on various positions within the company, including job titles, job descriptions, and business scopes.

[0013] S12: Create a set of roles and define the permission scope of each set of roles. Associate the set of roles with the job positions. Each job position has a corresponding set of roles.

[0014] S13: Assign specific permissions to each role in the role set, including the resources they can access and the operations they can perform.

[0015] Further: Step S2 specifically includes the following steps:

[0016] S21: Develop a permission model service using a microservice framework and deploy it to a production environment;

[0017] S22: Provide authentication and authorization services through standard RESTAPI interfaces, including user information interface, token maintenance interface, JWT maintenance interface, job operation interface, role operation interface, and menu operation interface;

[0018] S23: Integrate the permission model service into the microservice infrastructure, which includes a unified gateway, a registry center, and a configuration center.

[0019] Further: Step S3 specifically includes the following steps:

[0020] S31: Define the data structure and format of events, including event types such as employee job changes and system creation;

[0021] S32: Select a messaging mechanism, including Apache Kafka, which supports event publishing and subscription;

[0022] S33: Develop a client library for event producers to send events to the shared event center; develop a client library for event consumers to listen for events from the shared event center and perform corresponding operations based on the event content.

[0023] S34: Design error handling and retry logic, specifically including: listening for network problems and service unavailability, and logging errors; attempting to resend events when they fail to be sent.

[0024] Further: Step S4 specifically includes the following steps:

[0025] S41: Implement the message topic subscription process, including submitting, reviewing, and approving subscription requests, and providing the function to unsubscribe;

[0026] S42: Use the rule template to configure filtering rules and specify the messages that need to be filtered;

[0027] S43: Monitor the system's operational status indicators. When an abnormal situation is detected, an alarm notification is sent. The operational status indicators include message source, time, amount sent, amount received, and processing time.

[0028] S44: Receive event messages pushed by the event center, parse the event content, and extract key information; automatically perform permission change operations based on the event content, including adjusting user permissions and updating job information; and record logs of permission change operations.

[0029] The present invention also provides an application system access control system for implementing the above method, comprising:

[0030] The permission model service module is used to establish a unified permission model and provide services through the RESTAPI standard interface.

[0031] The message-driven module is used to push information such as changes in employee positions and organizational structure as enterprise messages and event assets to the shared event center for sharing, based on the message-driven mechanism of employee position information.

[0032] The application system module is used to subscribe to event types in the shared event center and automatically execute user permission changes based on the event content, thereby realizing message-driven automatic granting and modification of user permissions.

[0033] Furthermore: the permission model service module specifically includes:

[0034] The job definition and management unit is used to define each job position and clarify the responsibilities and scope of business for each position.

[0035] The role creation and assignment unit is used to define various role sets, clarify the permission scope of each role set, and associate roles with job positions;

[0036] The permission configuration unit is used to configure corresponding permissions for each role, including the resources that can be accessed and the operations that can be performed.

[0037] Furthermore: the message-driven module specifically includes:

[0038] The event model definition unit is used to define the data structure and format of an event;

[0039] The message passing mechanism selection unit is used to select the message passing mechanism;

[0040] The event producer design unit is used to design event producers and implement the sending of event messages;

[0041] The event consumer design unit is used to design event consumers, receive event messages, and perform corresponding permission change operations based on the event content.

[0042] Furthermore: the application system module specifically includes:

[0043] The subscription management unit is used to implement the subscription process for message topics;

[0044] The message filtering and conversion unit is used to implement message filtering and conversion functions;

[0045] The monitoring and statistics unit is used to implement monitoring statistics and alarm management.

[0046] Compared with the prior art, the present invention has the following advantages:

[0047] 1. Automatically adapt to changes in employee positions: By establishing a unified employee-position-role-permission relationship model and combining it with a message-driven mechanism, this invention can capture information such as employee position adjustments and organizational changes in real time, and automatically update employee permissions in various application systems to ensure that permissions are always up-to-date without manual intervention. This not only reduces the risk of errors caused by manual operation, but also greatly improves the efficiency and accuracy of permission management.

[0048] Second, traditional access control relies on individual authorization by system administrators, which easily leads to a large amount of repetitive work. This invention greatly simplifies the access control process by uniformly maintaining the correspondence between employees and positions, positions and roles, and roles and permissions, and providing services through standard microservice interfaces. The application system subscribes to various event types in the event center and automatically performs permission changes based on the event content, thus automating access control and greatly reducing the workload of system administrators.

[0049] Third, this invention ensures that employee permissions are strictly matched with their job responsibilities through an automated permission change mechanism, avoiding the risk of unauthorized operations and helping to improve the company's compliance management level; by monitoring the system's operating status in real time, it can promptly detect and handle abnormal situations, enhancing the system's stability and reliability, and further ensuring the company's compliant operation.

[0050] Fourth, this invention ensures the timeliness and accuracy of permission changes through a unified permission model and message-driven mechanism, reducing data leaks and other security risks caused by improper permissions; it also implements log recording of permission change operations, ensuring the traceability of operations, which helps with post-event auditing and accountability, and further enhances information security management. Attached Figure Description

[0051] Figure 1 This is a flowchart of an application system permission control method in one embodiment of the present invention;

[0052] Figure 2 This is a flowchart of an application system permission control method in another embodiment of the present invention. Detailed Implementation

[0053] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0055] This invention relates to an application system access control method and system. By establishing a unified employee-position-role-access relationship model and combining it with a message-driven mechanism, it achieves automatic adaptation and timely updating of permissions, thereby reducing the workload of access control and improving the enterprise's compliance governance capabilities and information security management level. The invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0056] The purpose of this invention is to provide an application system access control method and system that can automatically adapt to changes in employee positions and promptly update their permissions in various application systems. This reduces the workload of access control and improves an enterprise's compliance governance capabilities and information security management level. To achieve the above objectives, this invention is implemented through the following technical solutions:

[0057] An application system access control method includes the following steps:

[0058] S1: Establish a unified employee-position-role-permission relationship model, and uniformly maintain the correspondence between employees and positions, positions and roles, and roles and permissions;

[0059] In some embodiments, step S1 further includes the following steps:

[0060] S11: Use the employee management system to collect and organize information on various positions within the company, including job titles, job descriptions, and business scopes.

[0061] S12: Create a set of roles and define the permission scope of each set of roles. Associate the set of roles with the job positions. Each job position has a corresponding set of roles.

[0062] S13: Assign specific permissions to each role in the role set, including the resources they can access and the operations they can perform.

[0063] S2: Encapsulates the employee-position-role-permission relationship model established by S1 in the form of microservices, and provides services through the standard REST API interface;

[0064] In some embodiments, step S2 further includes the following steps:

[0065] S21: Develop a permission model service using a microservice framework and deploy it to a production environment;

[0066] S22: Provide authentication and authorization services through standard RESTAPI interfaces, including user information interface, token maintenance interface, JWT maintenance interface, job operation interface, role operation interface, and menu operation interface;

[0067] S23: Integrate the permission model service into the microservice infrastructure, which includes a unified gateway, a registry center, and a configuration center.

[0068] S3: A message-driven mechanism based on employee job information, which treats information such as employee job adjustments, organizational changes, and employee retirement as enterprise messages and event assets, and pushes them to the shared event center for shared application.

[0069] In some embodiments, step S3 further includes the following steps:

[0070] S31: Define the data structure and format of events, including event types such as employee job changes and system creation;

[0071] S32: Select a messaging mechanism, including Apache Kafka, which supports event publishing and subscription;

[0072] S33: Develop a client library for event producers to send events to the shared event center; develop a client library for event consumers to listen for events from the shared event center and perform corresponding operations based on the event content.

[0073] S34: Design error handling and retry logic, specifically including: monitoring for network problems, service unavailability, etc., and logging errors; attempting to resend events when they fail to be sent.

[0074] S4: The application system subscribes to various event types in the event center and automatically performs changes to user and job permissions based on the event content, using message-driven automatic granting and modification of user permissions;

[0075] In some embodiments, step S4 further includes the following steps:

[0076] S41: Implement the message topic subscription process, including submitting, reviewing, and approving subscription requests, and providing the function to unsubscribe;

[0077] S42: Use the rule template to configure filtering rules and specify the messages that need to be filtered;

[0078] S43: Monitor the system's operational status indicators. When an abnormal situation is detected, an alarm notification is sent. The operational status indicators include message source, time, amount sent, amount received, and processing time.

[0079] S44: Receive event messages pushed by the event center, parse the event content, and extract key information; automatically perform permission change operations based on the event content, including adjusting user permissions and updating job information; and record logs of permission change operations.

[0080] The present invention also provides an application system access control system for implementing the above method, comprising:

[0081] The permission model service module is used to establish a unified permission model and provide services through the REST API standard interface; specifically, it includes:

[0082] The job definition and management unit is used to define each job position and clarify the responsibilities and scope of business for each position.

[0083] The role creation and assignment unit is used to define various role sets, clarify the permission scope of each role set, and associate roles with job positions;

[0084] The permission configuration unit is used to configure corresponding permissions for each role, including the resources that can be accessed and the operations that can be performed.

[0085] The message-driven module is used for a message-driven mechanism based on employee job information. It treats employee job changes, organizational structure changes, and other information as enterprise messages and event assets, pushing them to the shared event center for sharing. Specifically, it includes:

[0086] The event model definition unit is used to define the data structure and format of an event;

[0087] The message passing mechanism selection unit is used to select the message passing mechanism;

[0088] The event producer design unit is used to design event producers and implement the sending of event messages;

[0089] The event consumer design unit is used to design event consumers, receive event messages, and perform corresponding permission change operations based on the event content.

[0090] The application system module is used to subscribe to event types in the shared event center and automatically execute application system user permission changes based on event content, realizing message-driven automatic granting and modification of user permissions; specifically including:

[0091] The subscription management unit is used to implement the subscription process for message topics;

[0092] The message filtering and conversion unit is used to implement message filtering and conversion functions;

[0093] The monitoring and statistics unit is used to implement monitoring statistics and alarm management. Specific implementation examples:

[0095] Suppose a company needs to implement access control for an application system based on employee job information. The specific implementation steps are as follows:

[0096] First, using the company's HR ERP system, collect and organize information for each position, including job title, job description, and scope of work. Then, create role sets and define the permission scope for each role set, associating the role sets with the positions. Next, assign specific permissions to each role, including the resources they can access and the operations they can perform.

[0097] Next, we will develop a permission model service using the Spring Cloud framework and deploy it to the production environment. We will provide authentication and permission services through standard REST API interfaces, including user information interfaces, token maintenance interfaces, JWT maintenance interfaces, role operation interfaces, function operation interfaces, and menu operation interfaces. We will then integrate the permission model service into our microservice infrastructure, including a unified gateway, registry center, and configuration center.

[0098] Subsequently, the data structure and format of events were defined, including event types such as employee job changes and system creation. Apache Kafka was chosen as the messaging mechanism to support event publishing and subscription. Client libraries for event producers were developed to send events to the shared event center; client libraries for event consumers were developed to listen for events from the shared event center and perform corresponding operations based on the event content. Error handling and retry logic were designed to monitor network problems, service unavailability, and other issues, and to log errors; when event sending fails, resends are attempted.

[0099] Finally, the message topic subscription process is implemented, including submitting, reviewing, and approving subscription requests, and providing a function to unsubscribe. Filtering rules are configured using rule templates to specify the messages to be filtered. System operational status indicators are monitored, and alarm notifications are sent when anomalies are detected. These operational status indicators include message source, time, number of messages sent, number of messages received, and processing time. Event messages pushed by the event center are received, the event content is parsed, and key information is extracted; permission change operations are automatically executed based on the event content, including adjusting user permissions and updating job information; and logs of permission change operations are recorded.

[0100] Through the above specific implementation methods, the present invention provides an application system permission control method and system based on employee job information, which realizes automatic adaptation and timely updating of permissions, reduces the workload of permission management, and improves the enterprise's compliance governance capabilities and information security management level.

[0101] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent transformations or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for managing access permissions in an application system, characterized in that: Includes the following steps: S1: Establish a unified employee-position-role-permission relationship model, and uniformly maintain the correspondence between employees and positions, positions and roles, and roles and permissions; S2: Encapsulates the employee-position-role-permission relationship model established by S1 in the form of microservices, and provides services through the standard REST API interface; S3: A message-driven mechanism based on employee job information will push information including employee job adjustments, organizational changes, and employee retirement as enterprise messages and event assets to the shared event center for shared application. The event assets include event type and event content. S4: The application system subscribes to various event types in the shared event center and automatically performs changes to user and job permissions based on the event content, using message-driven automatic granting and modification of user permissions.

2. The application system access control method according to claim 1, characterized in that: Step S1 specifically includes the following steps: S11: Use the employee management system to collect and organize information on various positions within the company, including job titles, job descriptions, and business scopes. S12: Create a set of roles and define the permission scope of each set of roles. Associate the set of roles with the job positions. Each job position has a corresponding set of roles. S13: Assign specific permissions to each role in the role set, including the resources they can access and the operations they can perform.

3. The application system access control method according to claim 1, characterized in that: Step S2 specifically includes the following steps: S21: Develop a permission model service using a microservice framework and deploy it to a production environment; S22: Provide authentication and authorization services through standard RESTAPI interfaces, including user information interface, token maintenance interface, JWT maintenance interface, job operation interface, role operation interface, and menu operation interface; S23: Integrate the permission model service into the microservice infrastructure, which includes a unified gateway, a registry center, and a configuration center.

4. The application system access control method according to claim 1, characterized in that: Step S3 specifically includes the following steps: S31: Define the data structure and format of events, including employee job changes and system-created event types; S32: Select a messaging mechanism, including Apache Kafka, which supports event publishing and subscription; S33: Develop a client library for event producers to send events to the shared event center; develop a client library for event consumers to listen for events from the shared event center and perform corresponding operations based on the event content. S34: Design error handling and retry logic, specifically including: listening for network problems and service unavailability, and logging errors; attempting to resend events when they fail to be sent.

5. The application system access control method according to claim 1, characterized in that: Step S4 specifically includes the following steps: S41: Implement the message topic subscription process, including submitting, reviewing, and approving subscription requests, and providing the function to unsubscribe; S42: Use the rule template to configure filtering rules and specify the messages that need to be filtered; S43: Monitor the system's operational status indicators. When an abnormal situation is detected, an alarm notification is sent. The operational status indicators include message source, time, amount sent, amount received, and processing time. S44: Receive event messages pushed by the event center, parse the event content, and extract key information; automatically perform permission change operations based on the event content, including adjusting user permissions and updating job information; and record logs of permission change operations.

6. An application system access control system, characterized in that, To implement the method of any one of claims 1-5, comprising: The permission model service module is used to establish a unified permission model and provide services through the RESTAPI standard interface. The message-driven module is used to push information such as changes in employee positions and organizational structure as enterprise messages and event assets to the shared event center for sharing, based on the message-driven mechanism of employee position information. The application system module is used to subscribe to the event types of the shared event center and automatically execute application system user permission changes based on the event content, thereby realizing automatic granting and changing of user permissions based on message-driven mechanisms.

7. The application system access control system according to claim 6, characterized in that, The permission model service module specifically includes: The job definition and management unit is used to define each job position and clarify the responsibilities and scope of business for each position. The role creation and assignment unit is used to define various role sets, clarify the permission scope of each role set, and associate roles with job positions; The permission configuration unit is used to configure corresponding permissions for each role, including the resources that can be accessed and the operations that can be performed.

8. The application system access control system according to claim 6, characterized in that, The message-driven module specifically includes: The event model definition unit is used to define the data structure and format of an event; The message passing mechanism selection unit is used to select the message passing mechanism; The event producer design unit is used to design event producers and implement the sending of event messages; The event consumer design unit is used to design event consumers, receive event messages, and perform corresponding permission change operations based on the event content.

9. The application system access control system according to claim 6, characterized in that, The application system module specifically includes: The subscription management unit is used to implement the subscription process for message topics; The message filtering and conversion unit is used to implement message filtering and conversion functions; The monitoring and statistics unit is used to implement monitoring statistics and alarm management.

Images