Data permission attribution and management method, system and device and storage medium

Abstract

The invention provides a data permission attribution and management method, system and device and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: building a unified attribution relation and a channel hierarchical structure of channel data in a platform dimension; wherein the subordinate channel automatically inherits the platform attribute of the corresponding direct superior channel; deducing and determining the access range of the user to the platform, the channel and the business object step by step based on the unified affiliation relationship, the channel hierarchical structure and the preset role authority; responding to a data query request of a target user, generating a data filtering condition according to the access permission range, and executing query according to the data filtering condition to obtain authorization data; and performing data rendering and component display matched with the access range of the target user in the graphical user interface based on the authorization data. By means of the mode, centralized and safe management of complex data relations is achieved, and the safety and efficiency of data query are improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data rights attribution and management method, system, device and storage medium. Background Technology

[0002] In current marketing data backend systems, various business data are typically stored and managed in a dispersed manner according to dimensions such as platform, game, channel, and promoter. Due to the complexity of permission configuration mechanisms and the high degree of data isolation, operations personnel need to frequently log in to different systems when conducting cross-dimensional analysis, resulting in cumbersome query processes and low efficiency. At the same time, existing permission management is mostly designed based on a single dimension, making it difficult to achieve refined control in multi-level organizational structures and multi-role collaboration scenarios. This easily leads to the risk of overlapping permissions or unauthorized data access, affecting data security and operational efficiency. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide data permission attribution and management methods, systems, devices and storage media to achieve centralized and secure management of complex data relationships and improve the security and efficiency of data query.

[0004] Firstly, this application provides a data permission attribution and management method, which includes: establishing a unified attribution relationship and channel hierarchy structure for channel data at the platform level; wherein, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels; based on the unified attribution relationship, channel hierarchy structure, and preset role permissions, deriving and determining the user's access scope to the platform, channels, and business objects level by level; responding to the target user's data query request, generating data filtering conditions according to the access permission scope, and executing the query according to the data filtering conditions to obtain authorized data; and based on the authorized data, performing data rendering and component display in the graphical user interface that matches the target user's access scope.

[0005] Furthermore, a unified attribution relationship and channel hierarchy structure for channel data at the platform level are established, including: defining the channel data structure; wherein the channel data structure includes a preset platform identifier field and a superior channel identifier field; constructing a tree-like hierarchy through the superior channel identifier field, and enabling lower-level channels to automatically inherit the platform to which their corresponding direct superior channel belongs.

[0006] Furthermore, based on a unified attribution relationship, channel hierarchy structure, and preset role permissions, the user's access scope to the platform, channels, and business objects is derived and determined step by step, including: configuring permission information; wherein, the permission information sets the operation permissions for the platform, channels, or business objects; and based on the permission information and role entities, the permission set is batch-associated with each user.

[0007] Furthermore, in response to the target user's data query request, data filtering conditions are generated based on the access permission scope, including: when a data query request from a target user is received, obtaining and parsing the permission set corresponding to the target user's role to obtain the corresponding data identifier set; and generating query filtering conditions based on the data identifier set; wherein, the query filtering conditions are used to limit the data query scope.

[0008] Furthermore, the query is executed based on the data filtering conditions, including: logically combining the query filtering conditions with the business query conditions to form a complete database query statement; performing the query in the database based on the database query statement and returning authorized data.

[0009] Furthermore, based on the authorized data, data rendering and component display are performed in the graphical user interface to match the access scope of the target user, including: obtaining the permission scope of the target user account, and loading the operable data scope and functional controls according to the permission scope; in the graphical user interface, rendering the corresponding data controls according to the data scope, and controlling the display state of interactive components according to the functional controls.

[0010] Secondly, this application also provides a data permission attribution and management system, comprising: a relationship building module for establishing a unified attribution relationship and channel hierarchy structure for channel data at the platform level; wherein, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels; a permission management module for deriving and determining the user's access scope to the platform, channels, and business objects level by level based on the unified attribution relationship, channel hierarchy structure, and preset role permissions; a dynamic query filtering module for responding to the data query request of the target user, generating data filtering conditions according to the access permission scope, and executing the query according to the data filtering conditions to obtain authorized data; and a permission matching control module for performing data rendering and component display in the graphical user interface that matches the access scope of the target user based on the authorized data.

[0011] Furthermore, the relationship building module connects with the database through a data table structure to enable the automatic inheritance of platform attributes from lower-level channels to their direct superior channels. The system also includes a data entity definition module, which defines user, platform, game, channel, and promoter entities, and establishes access mappings between users and each data entity through an authorization relationship table.

[0012] Thirdly, this application provides a data rights attribution and management device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned data rights attribution and management method.

[0013] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions. When the computer-executable instructions are invoked and executed by a processor, the computer-executable instructions cause the processor to implement the aforementioned data access attribution and management method.

[0014] This application brings the following beneficial effects: The aforementioned data permission attribution and management methods, systems, devices, and storage media establish a unified attribution relationship and channel hierarchy for channel data at the platform level. Lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. Based on the unified attribution relationship, channel hierarchy, and preset role permissions, the access scope of users to the platform, channels, and business objects is derived and determined level by level. Responding to data query requests from target users, data filtering conditions are generated based on the access permission scope, and queries are executed according to these conditions to obtain authorized data. Based on the authorized data, data rendering and component display are performed in the graphical user interface to match the access scope of the target user.

[0015] This approach establishes a unified ownership and hierarchical relationship between channels and platforms, enabling lower-level channels to automatically inherit attributes from higher-level platforms. Based on this relationship network and role permissions, the precise access scope of users is dynamically derived. When a data query request is received, data filtering conditions are automatically generated based on this access scope, and controlled queries are executed. The front end dynamically matches and renders data content and interactive components according to the user's permissions, achieving centralized and secure management of complex data relationships and improving the security and efficiency of data queries.

[0016] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application are realized and obtained through the structures particularly pointed out in the description, claims and drawings.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of this application or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a data permission attribution and management method provided in this application embodiment; Figure 2 A structural block diagram of a data permission attribution and management system provided in this application embodiment; Figure 3 A structural block diagram of another data permission attribution and management system provided in this application embodiment; Figure 4 This is a structural block diagram of a data permission attribution and management device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] Based on this, the data permission attribution and management method, system, device and storage medium provided in the embodiments of this application can be applied to the management and control of data permissions.

[0022] Example 1 This application discloses a data permission attribution and management method, such as... Figure 1 As shown, this method includes the following steps: Step S102: Establish a unified ownership relationship and channel hierarchy structure for channel data at the platform level; wherein, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels.

[0023] Specifically, a channel table is created in the system database to store all channel data. For example, this channel table contains fields such as channel unique identifier, channel name, platform identifier, parent channel identifier, and hierarchical path. The platform identifier is associated with the platform table, the parent channel identifier is associated with this channel table (with the top-level channel having an empty field), and the hierarchical path is used for quick subtree lookup.

[0024] Subsequently, a unified attribution relationship and channel hierarchy structure are established at the platform level for channel data. This unified attribution relationship clarifies the direct platform to which each channel belongs through the platform identifier field. The channel hierarchy structure constructs a tree-like channel organizational structure through the parent channel identifier field; it can be understood that a channel (sub-channel) has one and only one direct parent channel (parent channel), forming a multi-level relationship.

[0025] Here, lower-level channels automatically inherit the platform attributes of their corresponding direct parent channels. This automatic inheritance can be implemented in the business logic in the following two ways: Method 1: Calculate and store the platform identifier during creation or modification. When a channel is created or modified, the parent channel's record is retrieved based on its parent channel identifier. If the parent channel's platform identifier is not empty, the new channel's platform identifier value is automatically assigned and persisted to the database. This method improves query efficiency.

[0026] Method 2: Dynamically resolve the platform identifier during the query. When performing permission checks or data queries, if the platform identifier of a lower-level channel is allowed to be empty or not stored in the business logic, the query will recursively search upwards based on the identifier of the upper-level channel until the first channel with a platform identifier is found, and that platform will be used as the platform to which the current channel belongs. This method can improve the flexibility of the query.

[0027] For example, if there is a platform A, a primary channel B, and a secondary channel C under B, then C will automatically inherit the attributes of platform A to which B belongs. This inheritance mechanism simplifies data management and makes the ownership of data across different levels of channels clearer and more explicit.

[0028] Through the above embodiments, clear and automatic ownership management of channel data at the platform level has been achieved, providing a solid data foundation for dynamic permission inference based on this hierarchical structure.

[0029] Step S104: Based on the unified ownership relationship, channel hierarchy structure, and preset role permissions, the user's access scope to the platform, channels, and business objects is deduced and determined step by step.

[0030] Specifically, the platform table, channel table, and business object table are obtained first. Then, the role permissions are configured. For example, the role permission table defines the types and specific resources that a role can access. The user role association table is used to obtain the roles assigned to users.

[0031] After determining the user's access scope, the following deduction logic is executed in sequence: obtain direct permissions, deduce the access permissions of all channels under a certain platform based on the "unified attribution relationship", deduce the access permissions of all sub-channels under a certain channel based on the "channel hierarchy structure", and determine the access scope of the business object.

[0032] Assume there exists a role called "Operations Specialist" with permissions configured to access data from platform P1 and all its channels. When user A is assigned the "Operations Specialist" role, the system first grants direct permissions, meaning user A can access platform P1. Next, based on the "unified attribution relationship," since platform P1 has channels C1 and C2, user A also gains access to channels C1 and C2. Then, based on the "channel hierarchy," if channel C1 has sub-channels C11 and C12, and channel C2 has sub-channel C21, user A also gains access to these sub-channels. Regarding the scope of access to business objects, if the business object table contains business objects O1, O2, O3, etc., related to platform P1 and the aforementioned channels, and access to these business objects is permitted in the role's permission configuration, then user A also has corresponding access permissions to these business objects.

[0033] During the derivation process, the system executes a step-by-step derivation according to preset rules. If a channel or business object is not within the scope of the role's permission configuration, even if there may be a connection through hierarchical relationships, the user will not be able to obtain the corresponding access permissions. For example, if the role permissions explicitly restrict access to some channels under platform P1, then users will not be able to access channels that are not within the permission scope. This step-by-step derivation method ensures the accuracy and security of user access scope, making data use and management more standardized and orderly.

[0034] This embodiment achieves refined, accurate, and easy-to-maintain permission management by combining static role configuration with dynamic data relationship deduction.

[0035] Step S106: Respond to the target user's data query request, generate data filtering conditions based on the access permission scope, and execute the query based on the data filtering conditions to obtain authorized data.

[0036] Specifically, when a target user triggers a data query request, data filtering conditions are generated based on the target user's access permissions. First, the system parses the target user's role to obtain the corresponding set of permission information. Taking a financial institution as an example, if the target user is a credit approver, this set of permission information may include query permissions for specific customer credit rating data, loan application materials, etc.

[0037] Next, the system analyzes this permission information and converts it into specific data identifiers, which correspond to user permissions. For example, for the role of a credit approver, the data identifier may include a specific customer's ID number, loan application number, etc.; through these data identifiers, the scope of data that the user has permission to access can be quickly located in a large amount of data.

[0038] In generating data filtering conditions, the system can consider various factors. Besides user access permissions, it can also incorporate business logic and security policies. For example, in some cases, even if a user has access to certain data, the scope of data queries can be further restricted due to data sensitivity or business rules. For instance, for sensitive data involving customer privacy, the system can restrict users to querying it within a specific time period or require additional approval processes.

[0039] After generating data filtering conditions, the system logically combines them with the business query conditions submitted by the user. These business query conditions are typically specific query requests submitted by the user based on actual business needs, such as querying loan application data within a certain time period. By combining permission filtering conditions and business query conditions, a complete and precise database query statement is formed, which can perform accurate filtering and querying within the database.

[0040] When executing a query in the database, the system operates according to this complete query statement, performing a fast search in the data storage to return only data that meets the permission scope and business query conditions—that is, authorized data. Here, the system can employ a caching mechanism to cache frequently queried authorized data that is in small quantities; furthermore, the cache expiration period can be set, and the cached data can be updated periodically to ensure data timeliness and accuracy.

[0041] This embodiment translates user access scope into specific data layer filtering instructions, ensuring that users can only access the data they are authorized to access, preventing data leakage and unauthorized access. At the same time, this approach also improves data query efficiency, enabling rapid responses to user query requests and providing timely and accurate data support.

[0042] Step S108: Based on the authorized data, perform data rendering and component display in the graphical user interface that matches the access scope of the target user.

[0043] Specifically, the system first identifies the target user's access scope, clarifying the data the user is authorized to access and the functions they can operate. Then, based on the content and format of the authorized data, it selects an appropriate rendering method. For example, for tabular data, a table component can be used to display the data clearly in rows and columns, making it easy for users to view and compare; for graphical data, such as statistical charts, corresponding chart components, such as bar charts, line charts, and pie charts, can be used to display the data in an intuitive graphical way, making it easier for users to quickly understand data trends and proportional relationships.

[0044] During rendering, the display state and interactive functions of components are dynamically adjusted based on the user's access permissions. For example, if the user only has viewing permissions, the component is displayed in read-only mode, without edit, delete, or other operation buttons; if the user has modification permissions, the corresponding edit function buttons are displayed, allowing the user to modify the data. Interactive controls such as data sorting, filtering, and searching are also provided to facilitate further operations and analysis of authorized data.

[0045] This embodiment ensures the security and rationality of data access by providing personalized data display and interactive experiences for users with different permissions on a graphical user interface, while improving user efficiency and satisfaction.

[0046] The aforementioned data permission attribution and management method establishes a unified attribution relationship and channel hierarchy structure for channel data at the platform level. Lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. Based on the unified attribution relationship, channel hierarchy structure, and preset role permissions, the access scope of users to the platform, channels, and business objects is derived and determined level by level. In response to data query requests from target users, data filtering conditions are generated based on the access permission scope, and queries are executed according to these conditions to obtain authorized data. Based on the authorized data, data rendering and component display are performed in the graphical user interface to match the access scope of the target user.

[0047] This approach establishes a unified ownership and hierarchical relationship between channels and platforms, enabling lower-level channels to automatically inherit attributes from higher-level platforms. Based on this relationship network and role permissions, the precise access scope of users is dynamically derived. When a data query request is received, data filtering conditions are automatically generated based on this access scope, and controlled queries are executed. The front end dynamically matches and renders data content and interactive components according to the user's permissions, achieving centralized and secure management of complex data relationships and improving the security and efficiency of data queries.

[0048] One possible implementation involves defining a channel data structure, which includes a preset platform identifier field and a parent channel identifier field. A tree-like hierarchy is constructed using the parent channel identifier field, and lower-level channels automatically inherit the platform to which their corresponding direct parent channel belongs.

[0049] Specifically, during system design, a channel data structure is predefined, which includes a platform identifier field and a parent channel identifier field. The platform identifier field identifies the platform to which each channel belongs. The parent channel identifier field establishes the hierarchical relationship between channels.

[0050] When creating new channel data, the system assigns values ​​to these two fields according to preset rules. For the platform identifier field, if the channel is a top-level channel, the system manually specifies its platform according to business needs; if it is a lower-level channel, the system finds its direct parent channel based on the parent channel identifier field and assigns the parent channel's platform identifier to the lower-level channel, thereby achieving automatic inheritance of the parent channel's platform attributes by the lower-level channel.

[0051] Subsequently, the system constructs a tree-like hierarchy using the parent channel identifier field. For example, the various channels are connected through the parent channel identifier field to form a hierarchical tree structure. Each channel (except the top-level channel) has a unique parent channel identifier that points to its direct parent channel. In this way, starting from the top-level channel, following the pointer of the parent channel identifier field, one can gradually traverse to each subordinate channel, clearly showing the hierarchical relationship between channels.

[0052] For example, an e-commerce platform may have multiple sales channels, such as physical stores, the official website, and third-party e-commerce platforms. These channels can serve as top-level channels, each with its own platform identifier. Each top-level channel can then contain multiple sub-channels; for instance, physical stores can be divided into stores in different regions, and the official website can include different business segments. These sub-channels are linked to the top-level channel through the parent channel identifier field, forming a hierarchical tree structure. Simultaneously, sub-channels automatically inherit the platform attributes of their direct parent channels, ensuring consistency and accuracy in data management.

[0053] The above approach makes the organization of channel data clearer and the hierarchical relationship more explicit, which is conducive to operations such as permission inference and data query, and further improves the efficiency and security of data management.

[0054] In one possible implementation, permission information is configured; the permission information sets the operation permissions for the platform, channel or business object; based on the permission information and role entities, the permission set is batch-associated with each user.

[0055] Specifically, the system first meticulously categorizes and defines permission information. This permission information covers various operations on the platform, such as creating, modifying, deleting, and viewing statistical data; operation permissions on channels, including adding, editing, closing, and viewing channel data; and permissions for business objects, including creating, reading, updating, and deleting business objects. In practice, different business scenarios can employ different combinations of operation permissions.

[0056] Next, the system constructs role entities. A role entity is an abstract concept that categorizes users with the same business functions and operational needs. For example, in a company, there are administrator roles, financial personnel roles, sales personnel roles, etc. Each role entity corresponds to a specific set of operational permissions to meet their actual needs in business operations.

[0057] Next, the system assigns a corresponding set of permissions to each user based on the permission information and role entity. This process can be completed in batches. During batch association, the system determines the corresponding role entity based on information such as the user's department and position, and then automatically assigns the set of permissions corresponding to that role entity to the user.

[0058] For example, for a new batch of sales staff, the set of permissions corresponding to the "sales staff" role can be associated with these users all at once. These permissions may include accessing sales data from specific channels, creating and modifying sales orders, etc. For the administrator role, permissions may include management permissions for all platforms and channels, advanced configuration permissions for business objects, etc.

[0059] The above approach not only simplifies the access control process but also ensures the accuracy and consistency of access allocation. Furthermore, when business needs change or personnel positions are adjusted, user permissions can be easily and quickly adjusted and updated, thereby improving the system's flexibility and adaptability and ensuring the security and compliance of data access.

[0060] In one possible implementation, when a data query request from a target user is received, the permission set corresponding to the role to which the target user belongs is obtained and parsed to obtain the corresponding data identifier set; based on the data identifier set, query filtering conditions are generated; wherein, the query filtering conditions are used to limit the scope of data query.

[0061] Specifically, when a target user initiates a data query request, the system retrieves the set of permissions corresponding to the role to which the target user belongs. This set of permissions is configured based on the role entity and permission information and associated with the target user. The system then parses this set of permissions, transforming the permission descriptions into specific data identifiers.

[0062] During the parsing process, the system matches each permission in the permission set with a specific data identifier according to pre-defined rules and mapping relationships. For example, if the permission set includes access permissions to a specific channel on a certain platform, the system extracts the identifier information of that channel through a data dictionary or mapping table, forming part of the data identifier set.

[0063] After obtaining the corresponding set of data identifiers, the system generates query filtering conditions based on this. First, the system analyzes each data identifier in the set to determine its storage method and relationships in the database. For example, different data identifiers may correspond to different fields or tables in the database, and the system constructs appropriate query statements based on this information.

[0064] The generated query filters are used to limit the scope of data queries. When executing a query in the database, the system combines these filters with the user-submitted business query conditions to form a complete query statement. Based on this query statement, the system filters and searches the database, returning only data that meets the permission range and business query conditions.

[0065] The system validates and optimizes query filtering conditions during generation to ensure accuracy and efficiency. For example, it checks whether the filtering conditions are reasonable and whether they lead to empty or inaccurate query results. It can also optimize query statements to avoid complex nested queries or unnecessary calculations, thereby improving query performance.

[0066] This embodiment transforms the abstract role permissions of users into specific, executable database query commands, thereby achieving refined and dynamic data permission control.

[0067] In one possible implementation, the query filtering conditions and business query conditions are logically combined to form a complete database query statement; the database is then queried based on the database query statement, and authorized data is returned.

[0068] Specifically, when logically combining query filtering conditions with business query conditions, various logical relationships are used, such as "AND," "OR," and "NOT." Taking the "AND" relationship as an example, if a user's business query condition is to query order data within a certain time period, while the query filtering condition is that the user only has permission to access order data of specific customers, then the system combines these two conditions with "AND" logic, that is, it only queries order data of specific customers within that time period.

[0069] In practical applications, the system can select the most suitable logical combination method according to different business scenarios and data structures; for some complex query requirements, nested logical combinations can be used to ensure the accuracy and completeness of query results.

[0070] After a complete database query is generated, the system sends it to the database for querying. During the query process, the stored data is filtered and searched based on the query statement. Indexing techniques can be used here, with indexes created for frequently queried fields to speed up data retrieval. After the query is completed in the database, data that meets the criteria is returned to the system. This data is the authorized data, meaning data that the target user has permission to access and that meets the business query conditions. Upon receiving the authorized data, the system further processes and verifies it to ensure data integrity and accuracy.

[0071] Here, asynchronous queries can be used. This means that after sending a query request, other tasks can continue processing without waiting for the database to return results. Once the database returns results, appropriate processing can then be performed, improving system performance and response speed. Furthermore, query results can be cached. Frequently queried data can be retrieved directly from the cache, avoiding duplicate queries and thus improving overall system performance.

[0072] This embodiment combines query filtering conditions with business query conditions in a reasonable logical way to form a complete database query statement and perform the query in the database. This ensures that users can only obtain the authorized data they have permission to access, further improving the security and efficiency of data access.

[0073] In one possible implementation, the permission scope of the target user account is obtained, and the operable data scope and functional controls are loaded according to the permission scope; in the graphical user interface, the corresponding data controls are rendered according to the data scope, and the display state of the interactive components is controlled according to the functional controls.

[0074] Specifically, the first step is to identify the scope of permissions for the target user account. This process is based on multiple factors, including the permission set corresponding to the target user's role, previously configured permission information, and the hierarchical relationship between channels and platforms. By integrating and analyzing this information, the specific operational permissions of the target user in terms of platform, channels, and business objects are determined, thereby defining the scope of data they can manipulate.

[0075] After determining the operable data range, the system can load the corresponding data controls based on that range. Different data controls are used to display different types of data. For example, text boxes and text areas are used for text data; number input boxes and progress bars are used for numeric data; and drop-down lists, radio buttons, and checkboxes are used for selection data. When loading data controls, the characteristics of the data and the user's operating habits are considered to ensure that the data display is clear, accurate, and easy to operate.

[0076] Meanwhile, the system can load functional controls based on the user's permission level. These functional controls correspond to different operation functions, such as adding, modifying, deleting, saving, and exporting data. For users with only viewing permissions, the system only loads viewing-related functional controls, such as viewing details and printing; while for users with modification permissions, in addition to viewing-related functional controls, editing and saving functional controls are also loaded.

[0077] In the graphical user interface, the system can render the corresponding data controls based on the range of loaded data. That is, the data controls are customized in terms of their actual content and format. For example, for tables containing large amounts of data, the width and height of the table are automatically adjusted based on the number and length of the columns to ensure all data is displayed completely; for graphical data controls, the size and style of the graphics are adjusted according to the characteristics and proportions of the data to make them more aesthetically pleasing and intuitive.

[0078] Furthermore, the system can control the display state of interactive components based on functional controls. These interactive components include buttons, menus, dialog boxes, etc., used to interact with the user and implement various operational functions. The system dynamically displays or hides these interactive components based on the user's permissions and the current operation scenario. For example, when a user clicks on a data item, if the user has modification permissions, the edit button is displayed; if the user does not have modification permissions, the edit button is hidden, that is, the edit button is not displayed.

[0079] By employing the above methods, personalized data display and interactive experiences are provided to target users with different permissions on the graphical user interface, enabling users to perform data operations more conveniently and quickly, while ensuring the security and rationality of data access, and further improving user efficiency and satisfaction.

[0080] Example 2 This application provides a data rights attribution and management system, such as Figure 2 As shown, the system includes: The relationship building module 21 is used to establish a unified ownership relationship and channel hierarchy structure for channel data at the platform level; wherein, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. The permission management module 22 is used to deduce and determine the user's access scope to the platform, channels and business objects step by step based on the unified ownership relationship, channel hierarchy structure and preset role permissions. The dynamic query filtering module 23 is used to respond to the data query request of the target user, generate data filtering conditions according to the access permission scope, and execute the query according to the data filtering conditions to obtain authorized data; The permission matching control module 24 is used to perform data rendering and component display in the graphical user interface based on the authorization data to match the access scope of the target user.

[0081] The aforementioned data permission attribution and management system establishes a unified attribution relationship and channel hierarchy for channel data at the platform level. Lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. Based on the unified attribution relationship, channel hierarchy, and preset role permissions, the system deduces and determines the user's access scope to the platform, channels, and business objects level by level. Responding to data query requests from target users, it generates data filtering conditions based on the access permission scope and executes queries according to these conditions to obtain authorized data. Based on the authorized data, it renders data and displays components in the graphical user interface that match the target user's access scope.

[0082] This approach establishes a unified ownership and hierarchical relationship between channels and platforms, enabling lower-level channels to automatically inherit attributes from higher-level platforms. Based on this relationship network and role permissions, the precise access scope of users is dynamically derived. When a data query request is received, data filtering conditions are automatically generated based on this access scope, and controlled queries are executed. The front end dynamically matches and renders data content and interactive components according to the user's permissions, achieving centralized and secure management of complex data relationships and improving the security and efficiency of data queries.

[0083] In one possible approach, the aforementioned relationship building module 21 is associated with the database through a data table structure, enabling the automatic inheritance of platform attributes from the lower-level channel to the direct upper-level channel.

[0084] Furthermore, such as Figure 3 As shown in the figure, this embodiment provides another structural block diagram of a data permission attribution and management system: The relationship building module 21 is used to establish a unified ownership relationship and channel hierarchy structure for channel data at the platform level; wherein, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. The permission management module 22 is used to deduce and determine the user's access scope to the platform, channels and business objects step by step based on the unified ownership relationship, channel hierarchy structure and preset role permissions. The dynamic query filtering module 23 is used to respond to the data query request of the target user, generate data filtering conditions according to the access permission scope, and execute the query according to the data filtering conditions to obtain authorized data; The permission matching control module 24 is used to perform data rendering and component display in the graphical user interface based on the authorization data to match the access scope of the target user.

[0085] The data entity definition module 25 is used to define user, platform, game, channel and promoter entities, and to establish access mapping between users and each data entity through the authorization relationship table.

[0086] Example 3 This embodiment provides a data permission attribution and management device, including a processor and a memory. The memory stores computer-executable instructions that can be executed by the processor. The processor executes the computer-executable instructions to implement the aforementioned data permission attribution and management method. This data permission attribution and management device can be a server or a terminal device.

[0087] See Figure 4 As shown, the data rights attribution and management device includes a processor 100 and a memory 101. The memory 101 stores computer-executable instructions that can be executed by the processor 100. The processor 100 executes the computer-executable instructions to implement the above-mentioned data rights attribution and management method.

[0088] Furthermore, Figure 4 The data access control and management device shown also includes a bus 102 and a communication interface 103. The processor 100, the communication interface 103, and the memory 101 are connected via the bus 102.

[0089] The memory 101 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 103 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 102 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0090] The processor 100 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 100 or by instructions in software form. The processor 100 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a readily available storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 101, and the processor 100 reads the information from memory 101 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0091] Example 4 This embodiment provides a computer-readable storage medium storing computer-executable instructions. When the computer-executable instructions are invoked and executed by a processor, the computer-executable instructions cause the processor to implement the aforementioned data permission attribution and management method.

[0092] The computer program products of the data permission attribution and management method, system, and data permission attribution and management device provided in this application embodiment include a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0093] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0094] Furthermore, in the description of the embodiments of this application, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0095] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0097] Finally, it should be noted that the above embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the technical scope disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for attributing and managing data permissions, characterized in that, The method includes: Establish a unified ownership relationship and channel hierarchy for channel data at the platform level; where lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. Based on the unified attribution relationship, channel hierarchy structure, and preset role permissions, the user's access scope to the platform, channels, and business objects is deduced and determined step by step. In response to a target user's data query request, generate data filtering conditions based on the access permission scope, and execute the query based on the data filtering conditions to obtain authorized data; Based on the authorized data, data rendering and component display are performed in the graphical user interface to match the access scope of the target user.

2. The method according to claim 1, characterized in that, Establish a unified ownership structure and hierarchical structure for channel data at the platform level, including: Define a channel data structure; wherein the channel data structure includes a preset platform identifier field and a parent channel identifier field; A tree-like hierarchy is constructed using the parent channel identifier field, and lower-level channels automatically inherit the platform to which their corresponding direct parent channel belongs.

3. The method according to claim 1, characterized in that, Based on the unified attribution relationship, channel hierarchy, and preset role permissions, the user's access scope to the platform, channels, and business objects is derived and determined step by step, including: Configure permission information; wherein, the permission information sets the operation permissions for the platform, channel or business object; Based on the permission information and role entities, the permission set is batch-associated with each user.

4. The method according to claim 1 or 3, characterized in that, In response to a target user's data query request, data filtering conditions are generated based on the access permission scope, including: When a data query request from a target user is received, the permission set corresponding to the role to which the target user belongs is obtained and parsed to obtain the corresponding data identifier set; Based on the data identifier set, query filter conditions are generated; wherein, the query filter conditions are used to limit the scope of data query.

5. The method according to claim 1, characterized in that, Execute a query based on the data filtering conditions, including: The query filtering conditions are logically combined with the business query conditions to form a complete database query statement; The database query statement is used to perform a query in the database and return authorized data.

6. The method according to claim 1, characterized in that, Based on the authorized data, data rendering and component display are performed in the graphical user interface to match the access scope of the target user, including: Obtain the permission scope of the target user account, and load the operable data range and functional controls according to the permission scope; In the graphical user interface, the corresponding data control is rendered according to the data range, and the display state of the interactive components is controlled according to the functional control.

7. A data access control and management system, characterized in that, The system includes: The relationship building module is used to establish a unified ownership relationship and channel hierarchy structure for channel data at the platform level; among them, lower-level channels automatically inherit the platform attributes of their corresponding direct superior channels. The access control module is used to deduce and determine the user's access scope to the platform, channels and business objects step by step based on the unified attribution relationship, channel hierarchy structure and preset role permissions. The dynamic query filtering module is used to respond to the data query request of the target user, generate data filtering conditions according to the access permission scope, and execute the query according to the data filtering conditions to obtain authorized data; The permission matching control module is used to perform data rendering and component display in the graphical user interface that matches the access scope of the target user based on the authorization data.

8. The system according to claim 7, characterized in that, The relationship building module connects to the database through a data table structure, enabling lower-level channels to automatically inherit platform attributes from their direct superior channels; the system also includes: The data entity definition module is used to define entities such as users, platforms, games, channels, and promoters, and to establish access mappings between users and each data entity through an authorization relationship table.

9. A data access permission attribution and management device, characterized in that, It includes a processor and a memory, the memory storing computer-executable instructions that can be executed by the processor, the processor executing the computer-executable instructions to implement the data rights attribution and management method according to any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the data rights attribution and management method according to any one of claims 1-6.

Images