Resource and data access control method and system based on multi-dimensional hierarchical management and control

Abstract

The invention discloses a resource and data access control method and system based on multi-dimensional hierarchical management and control, and belongs to the technical field of computers, and access authority comprises multi-level management and control of an application level, a menu level, a page resource level and a page element level. Setting parameters by dynamically registering page resources and elements according to a standard coding structure, maintaining menu structure associated resources, dynamically maintaining application roles, and configuring a starting switch to realize authorization management and control of the menu / page resources / page elements; and the data authority provides strategy management and control of directly-subordinate project organizations, target project organizations and specified business data white lists based on project organizations, and supports data access of directly-subordinate organizations, data access of target organizations and business data white list authorities of creators. According to the method, refined and strategic access control of resources and data is realized, the system security and management flexibility are effectively improved, and the method is suitable for multi-scene application of construction management, construction participation management and the like.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a resource and data access control method and system based on multi-dimensional hierarchical management. Background Technology

[0002] In the field of data and resource access control, Role-Based Access Control (RBAC) is the mainstream access control mechanism, widely used in enterprise-level security policy management. This model defines users, roles, permissions, and the relationships between them, achieving a logical separation of "users authorizing roles, and roles authorizing permissions," effectively simplifying the access control process and reducing the complexity of permission configuration. Currently, most mainstream software products and solutions on the market use RBAC as the core framework for building their access control systems.

[0003] Specifically, several improved solutions based on RBAC have emerged in existing technologies. For example, the core innovation of "A method, device, and storage medium based on role-based access control" (publication number CN119939610A) applied for by Beijing Wilbers Information Technology Co., Ltd. lies in creating differentiated roles for target system resources and generating role names based on preset naming specifications, thereby constructing a relationship tree between tenants and roles, and between roles, which significantly optimizes the efficiency of role transfer between multiple subsystems. The "A method, device, equipment, and medium based on role-based access control" (authorization announcement number CN112131559B) obtained by Tencent Technology (Shenzhen) Co., Ltd. has made targeted improvements to the execution efficiency of the access control process, increasing the response speed of access allocation.

[0004] However, while the aforementioned existing patents have achieved partial improvements in specific aspects of the RBAC model (such as role naming conventions and process optimization), they have all failed to solve the following key technical problems: The current technology for access control is limited to a single dimension: it only improves upon the static association between RBAC users, roles, and permissions, lacking support for multi-dimensional control mechanisms such as operation sequence control and permission type subdivision. In complex business scenarios (such as approval processes in project management), the lack of fine-grained division of operation permissions for page elements (such as buttons and fields) fails to meet the business process control needs that have strict time sequence requirements for operation steps.

[0005] Poor adaptability to application scenarios: Existing solutions are not deeply adapted to specific scenarios such as engineering management involving multiple participants and project organizations. For example, in projects such as hydropower construction, it is impossible to effectively isolate permissions between construction management applications and participating management applications, and there is a lack of dynamic data access policy configuration capabilities based on project organizational relationships, resulting in rigid permission management in multi-organizational collaboration scenarios.

[0006] Data access control is simplistic: At the data access level, existing technologies only provide basic "visible / invisible" level permission settings, without implementing policy-based management tailored to the characteristics of business objects. Taking project management as an example, critical business data such as contract lists and document lists cannot achieve dynamic access control based on project organizational relationships (such as "only allow access to data of directly subordinate project organizations" or "authorize access by specified organization"), making it difficult to balance data security and business collaboration.

[0007] In summary, existing technologies have significant limitations in terms of the dimensional coverage of access control, scenario adaptability, and data strategy management. They are unable to meet the urgent needs for refined and dynamic access control in collaborative scenarios involving multiple participants, such as engineering management. There is an urgent need for a resource and data access control method and system that can achieve multi-dimensional hierarchical control. Summary of the Invention

[0008] This application provides a resource and data access control method and system based on multi-dimensional hierarchical management.

[0009] Firstly, embodiments of this application provide a resource and data access control method based on multi-dimensional hierarchical management, which divides permissions into two categories: access permissions and data permissions. The access permissions include multi-level management at the application level, menu level, page resource level, and page element level, while the data permissions include policy-based management based on project organization. The method includes: Dynamically register page resources and page elements, and set page element parameters according to standard coding structure; Maintain the menu structure and associate menus with page resources; Dynamically maintain application roles; Configure menu access authorization, page resource authorization, and page element authorization by enabling the corresponding switches. The page element authorization includes unauthorized display control and unauthorized operation control. Provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for target project organizations, and specifying whitelist permissions for business data.

[0010] In conjunction with the first aspect, in one implementation, the page element authorization includes configuring unauthorized display control, configuring unauthorized operation control, and configuring custom prompt information functionality.

[0011] In conjunction with the first aspect, in one implementation, the unauthorized display control includes hiding page elements; The unauthorized operation control includes the function of disabling operations on page elements.

[0012] In conjunction with the first aspect, in one implementation, the page elements include operation buttons, input fields, and cells in a data table.

[0013] In conjunction with the first aspect, in one implementation, the data access authorization policy includes: Enable data access permissions for the creator's direct project organizations, where the direct project organizations are automatically determined based on the user's organizational affiliation. Specify data access permissions for the target project organization, wherein the target project organization is specified by the user; Specify whitelist permissions for business data, wherein the whitelist is based on a predefined list of business data objects.

[0014] In conjunction with the first aspect, in one implementation, the specified business data whitelist permission includes adding or deleting whitelist data items.

[0015] In conjunction with the first aspect, in one implementation, the dynamic registration of page resources and page elements includes setting page element parameters.

[0016] In conjunction with the first aspect, in one implementation, the menu structure maintenance includes adding, deleting, or modifying menu items.

[0017] In conjunction with the first aspect, in one embodiment, the method further includes: Assign application roles to specific users.

[0018] Secondly, embodiments of this application provide a resource and data access control system based on multi-dimensional hierarchical management and control, used to implement the method, including: The dynamic registration module is used to dynamically register page resources and page elements, and set page element parameters according to the standard coding structure. The menu maintenance module is used to maintain the menu structure and associate menus with page resources; The role maintenance module is used to dynamically maintain application roles; The authorization configuration module is used to provide access authorization for enabling / disabling the switch configuration menu, page resource authorization, and page element authorization. The page element authorization includes unauthorized display control and unauthorized operation control. The data access authorization module is used to provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for target project organizations, and specifying whitelist permissions for business data.

[0019] The beneficial effects of the technical solutions provided in this application include: This invention achieves fine-grained permission division through multi-level permission control at the application level, menu level, page resource level, and page element level, meeting the differentiated needs of multiple applications and business scenarios in engineering construction management.

[0020] By enabling settings to configure permissions (such as enabling a menu access switch), users can make flexible configurations in a visual interface, significantly reducing the complexity of permission management and labor costs.

[0021] For engineering scenarios such as construction management / participation management, this invention realizes application-level permission isolation and dynamic configuration of data permissions based on project organization, effectively solving the problem of permission isolation and sharing in multi-participant collaboration.

[0022] The dynamic registration function, triggered by the dynamic discovery mechanism of page resources, automatically completes the registration of page resources and elements, eliminating the need for manual input by users, simplifying the operation process and reducing the probability of errors. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating an embodiment of the resource and data access control method based on multi-dimensional hierarchical management in this application; Figure 2 This is a schematic diagram of access permission relationships in a specific embodiment of this application; Figure 3 This is a schematic diagram of data permission relationships in a specific embodiment of this application; Figure 4 This is a flowchart of resource and data-based access control in a specific embodiment of this application; Figure 5 This is a schematic diagram of the resource and element registration source interface in a specific embodiment of this application; Figure 6 This is a schematic diagram of the menu-associated resource interface in a specific embodiment of this application; Figure 7 This is a schematic diagram of the application role management interface in a specific embodiment of this application; Figure 8 This is a schematic diagram of the menu authorization interface in a specific embodiment of this application; Figure 9 This is a schematic diagram of the page resource authorization interface in a specific embodiment of this application; Figure 10 This is a schematic diagram of the page element authorization interface in a specific embodiment of this application; Figure 11 This is a schematic diagram of the data permission management interface in a specific embodiment of this application; Figure 12 This is a functional module diagram of an embodiment of the resource and data access control system based on multi-dimensional hierarchical management and control of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0026] In a first aspect, embodiments of this application provide a resource and data access control method based on multi-dimensional hierarchical management.

[0027] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the resource and data access control method based on multi-dimensional hierarchical management according to this application. Figure 1 As shown, the resource and data access control method based on multi-dimensional hierarchical management divides permissions into two categories: access permissions and data permissions. Access permissions include multi-level management at the application level, menu level, page resource level, and page element level. Data permissions include policy-based management based on project organization. The method specifically includes: Step S1: Dynamically register page resources and page elements, and set page element parameters according to the standard coding structure; Step S2: Maintain the menu structure and associate the menu with page resources; Step S3: Dynamically maintain application roles; Step S4: Configure menu access authorization, page resource authorization, and page element authorization by enabling the corresponding switches. Page element authorization includes unauthorized display control and unauthorized operation control. Step S5: Provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for target project organizations, and specifying whitelist permissions for business data.

[0028] Steps S2 and S3 can be performed simultaneously, or step S3 can be performed before step S1 or step S2.

[0029] In this embodiment, by implementing multi-level permission control at the application level, menu level, page resource level, and page element level, as well as policy-based data permission management based on project organization, a fine-grained division of permission granularity is achieved. This meets the differentiated permission requirements of various scenarios such as construction management applications and participation management applications in engineering construction management, achieving the effect of multi-dimensional, classified control and separation of access permissions and data permissions. It effectively avoids the security risks caused by overly coarse permission control, thereby achieving multi-dimensional fine-grained control.

[0030] By enabling access authorization via the switch configuration menu, page resource authorization, and page element authorization, users can operate directly in the visual interface, achieving a WYSIWYG permission configuration mode. This significantly reduces the complexity of permission management and the cost of manual operation, improves the work efficiency of system administrators, and thus achieves visual configuration and enhanced flexibility.

[0031] For engineering construction management scenarios, this invention maintains independent roles for construction management applications and participating management applications, and dynamically configures data access policies based on project organizational relationships. This achieves application-level permission isolation and dynamic control of data permissions, effectively solving the collaboration obstacles and data leakage risks caused by unclear permission boundaries among multiple participants (such as owners, designers, and construction parties) in project collaboration, thereby achieving deep adaptation to engineering scenarios.

[0032] Based on the dynamic registration function triggered by the dynamic discovery mechanism of page resources, the system automatically completes the registration and parameter setting of page resources and elements without the need for manual input by users. This simplifies the permission configuration process, greatly reduces the probability of configuration errors caused by manual intervention, and ensures the accuracy and stability of system deployment, thereby achieving automated process optimization.

[0033] In summary, this invention achieves fine-grained permission granularity through multi-level permission control at the application, menu, page resource, and page element levels, as well as strategy-based data permission management based on project organization. This meets the differentiated permission requirements of various scenarios in engineering construction management, such as construction management applications and participant management applications. By enabling and configuring menu access authorization, page resource authorization, and page element authorization via switches, users can operate directly in a visual interface, achieving a WYSIWYG permission configuration mode, significantly reducing the complexity of permission management and manual operation costs. For engineering construction management scenarios, this invention maintains independent roles for construction management applications and participant management applications, and dynamically configures data access policies based on project organizational relationships. This achieves application-level permission isolation and dynamic control of data permissions, effectively solving collaboration obstacles and data leakage risks caused by ambiguous permission boundaries in multi-participant project collaboration. Furthermore, based on the dynamic registration function triggered by the dynamic discovery mechanism of page resources, the system automatically completes the registration and parameter setting of page resources and elements, eliminating the need for manual input by users. This simplifies the permission configuration process, significantly reduces the probability of configuration errors caused by manual intervention, and improves the accuracy and stability of system deployment.

[0034] Furthermore, in one embodiment, the page element authorization includes configuring unauthorized display control, configuring unauthorized operation control, and configuring custom prompt information functionality.

[0035] In this embodiment, by implementing unauthorized display control of page elements (hiding or disabling unauthorized elements), unauthorized operation control (disabling functions without permission), and customizable prompt information, it effectively prevents users from accessing or attempting sensitive operations without permission. At the same time, by customizing prompt information, it improves the user experience and significantly reduces operational errors and user confusion caused by unclear permissions. This provides flexible and intuitive technical support for refined permission management in various business scenarios such as engineering construction management.

[0036] In addition, this invention achieves dynamic control of operation permissions through fine-grained authorization of page elements (including hiding, showing but disabling, and showing with prompts), which can indirectly meet the requirements of some business scenarios for the order of operation processes.

[0037] Furthermore, in one embodiment, the unauthorized display control includes hiding page elements; The unauthorized operation control includes the function of disabling operations on page elements.

[0038] In this embodiment, by controlling unauthorized display (hiding unauthorized page elements) and controlling unauthorized operation (disabling the operation functions of unauthorized elements), it is effectively prevented that users will access or attempt to operate sensitive interface elements in an unauthorized state. At the same time, by providing clear visual prompts through the disabled state, the error rate of operation and user confusion are significantly reduced, providing intuitive and efficient technical support for refined permission management in multiple business scenarios such as engineering construction management.

[0039] Furthermore, in one embodiment, the page elements include operation buttons, input fields, and cells in a data table.

[0040] In this embodiment, by specifically limiting page elements to operation buttons, input fields, and data table cells, fine-grained and differentiated authorization control of front-end interactive elements (such as disabling buttons, hiding fields, and desensitizing cell data) is achieved. This effectively prevents users from operating sensitive interface elements without permission, significantly reduces the error rate and data leakage risk, and provides accurate and secure permission control support for scenarios such as engineering construction management.

[0041] Furthermore, in one embodiment, the data access authorization policy includes: Enable data access permissions for the creator's direct project organizations, where the direct project organizations are automatically determined based on the user's organizational affiliation. Specify data access permissions for the target project organization, wherein the target project organization is specified by the user; Specify whitelist permissions for business data, wherein the whitelist is based on a predefined list of business data objects.

[0042] In this embodiment, by automatically determining the direct project organization based on the user's organizational affiliation, allowing the user to specify the target project organization, and configuring a business data whitelist based on a predefined list of business data objects, dynamic and refined control of data access permissions is achieved. This effectively solves the risks of data access conflicts and sensitive information leakage caused by ambiguous permission boundaries when multiple parties collaborate in engineering construction management. At the same time, it significantly reduces the complexity of data permission configuration and improves the work efficiency of system administrators.

[0043] Furthermore, in one embodiment, the specified business data whitelist permission includes adding or deleting whitelist data items.

[0044] In this embodiment, by supporting the dynamic addition and deletion of whitelisted data items, flexible adjustment of data access permissions is achieved, effectively reducing the error rate of data permission configuration, improving the work efficiency of system administrators, and ensuring real-time matching between data access policies and business needs.

[0045] Furthermore, in one embodiment, the dynamic registration of page resources and page elements includes setting page element parameters.

[0046] In this embodiment, by setting page element parameters according to the standard coding structure, the standardization and consistency of parameter definitions are achieved, effectively avoiding configuration errors caused by inconsistent parameter formats, improving the accuracy of resource and element registration and the stability of system operation, and providing reliable technical support for the efficient deployment of the engineering construction management system.

[0047] Furthermore, in one embodiment, the menu structure maintenance includes adding, deleting, or modifying menu items.

[0048] In this embodiment, by supporting the dynamic addition, deletion, and modification of menu items, the menu structure can be flexibly configured, effectively reducing configuration errors in menu management, improving the work efficiency of system administrators, and ensuring that the menu interface is synchronized and adapted to the business needs of engineering construction management in real time.

[0049] Furthermore, in one embodiment, the method further includes: Assign application roles to specific users.

[0050] In this embodiment, by assigning application roles to designated users, precise configuration of user permissions is achieved, effectively reducing the error rate of permission allocation, improving the work efficiency of system administrators, and ensuring synchronous adaptation of permission management with the business needs of engineering construction management.

[0051] In one specific embodiment, during system implementation, permissions are decomposed into two categories: access permissions and data permissions. Access permissions are further subdivided into three categories: menus, page resources, and page elements. Menus are linked to page resources, which are composed of page elements. Based on the RBAC model, roles are associated with menus, page resources, and page elements, supporting independent or combined authorization to achieve coarse-grained to fine-grained control. Simultaneously, applications are split according to the complexity of the business scenario. For example, in the engineering management field, applications can be split into construction management applications (used by the owner) and participation management applications (used by the contractor and supervisor), allowing for independent authorization of these applications and achieving application-level permission isolation.

[0052] Data permissions: Based on project organization management, they are divided into two categories: general permissions and policy-controlled permissions. General permissions allow users to access business data created by themselves, created by members of their project organization, accessed by other project organizations authorized by their project organization, and data of users who are whitelisted by themselves. Policy-controlled permissions include enabling access permissions for data of the creator's directly subordinate project organization, enabling access permissions for data of a specified target project organization, and enabling permissions for specified business data whitelists, all of which have defined on / off switches.

[0053] In another specific embodiment, the access control process includes: Resource and element registration: During the system construction phase, the dynamic registration of page resources is completed, and the parameters of page elements requiring permission control are set and dynamically registered according to the standard coding structure; Menu associated resources: Provides a menu associated resource management page divided by application, allowing users to dynamically maintain the menu structure and associate menus with page resources; Application role maintenance: The system administrator maintains separate roles for the construction management application and the participation management application; Menu authorization: Provides an enable switch, allowing users to flexibly configure menu access authorization; Page resource authorization: Manage the authorization of registered page resources and provide an enable switch for users to configure flexibly; Page element authorization: Manage the authorization of registered page elements, and provide custom control functions such as enable switch, unauthorized display control, unauthorized operation control, and unauthorized operation prompts; Data access authorization: Provides data access permissions for directly affiliated project organizations and target project organizations, as well as whitelist permission control for specified business data, and supports custom data object functionality.

[0054] In another specific embodiment, we take the multi-dimensional management scenario requirements such as hierarchical applications, multi-project organization, and roles as an example.

[0055] Reference Figure 2 As shown, Figure 2 This is a diagram illustrating access permission relationships, showing the connections between menus, page resources, page elements, users, and roles, as well as the permission isolation between the construction management application and the participation management application. Reference Figure 3 As shown, Figure 3 This is a diagram illustrating data permission relationships, showing the permission allocation relationships between users, project organizations, and business data, including data access permissions for directly subordinate project organizations, data access permissions for target project organizations, and access whitelists for specified business objects. Reference Figure 4 As shown, Figure 4 This is a flowchart of access control based on resources and data, describing the entire access control process from resource and element registration to configuration parsing and permission control, and then to rendering, reflecting the process of dynamic loading and permission verification by the system.

[0056] Reference Figure 5 As shown, Figure 5 This is a schematic diagram of the resource and element registration source interface, showing an example of the standard coding structure when registering page resources and elements, making it easier to understand how dynamic resource registration is implemented.

[0057] Reference Figures 6 to 11 As shown, Figure 6 This is an example image of the menu permission management interface. Figure 7 This is a schematic diagram of the application role management interface. Figure 8 This is a schematic diagram of the menu authorization interface. Figure 9 This is a schematic diagram of the page resource authorization interface. Figure 10 A diagram illustrating the authorization interface for page elements. Figure 11 This is a schematic diagram of the data permission management interface, which intuitively presents the implementation method of visual permission configuration.

[0058] Secondly, embodiments of this application also provide a resource and data access control system based on multi-dimensional hierarchical management and control.

[0059] In one embodiment, reference is made to Figure 12 , Figure 12 This is a functional module diagram of an embodiment of the resource and data access control system based on multi-dimensional hierarchical control of this application. Figure 12 As shown, the resource and data access control system based on multi-dimensional hierarchical management includes: Dynamic registration module 1 is used to dynamically register page resources and page elements, and set page element parameters according to the standard coding structure; Menu maintenance module 2 is used to maintain the menu structure and associate menus with page resources; Role maintenance module 3 is used for dynamically maintaining application roles; Authorization configuration module 4 is used to provide access authorization for enabling switch configuration menu, page resource authorization, and page element authorization. The page element authorization includes unauthorized display control and unauthorized operation control. Data access authorization module 5 is used to provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for the target project organization, and specifying whitelist permissions for business data.

[0060] This invention achieves fine-grained permission division through multi-level permission control at the application level, menu level, page resource level, and page element level, meeting the differentiated needs of multiple applications and business scenarios in engineering construction management.

[0061] By enabling settings to configure permissions (such as enabling a menu access switch), users can make flexible configurations in a visual interface, significantly reducing the complexity of permission management and labor costs.

[0062] For engineering scenarios such as construction management / participation management, this invention realizes application-level permission isolation and dynamic configuration of data permissions based on project organization, effectively solving the problem of permission isolation and sharing in multi-participant collaboration.

[0063] The dynamic registration function, triggered by the dynamic discovery mechanism of page resources, automatically completes the registration of page resources and elements, eliminating the need for manual input by users, simplifying the operation process and reducing the probability of errors.

[0064] The functions of each module in the resource and data access control system based on multi-dimensional hierarchical management correspond to the steps in the resource and data access control method embodiment based on multi-dimensional hierarchical management. Their functions and implementation processes will not be described in detail here.

[0065] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0066] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0067] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0068] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0069] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0070] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0071] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A resource and data access control method based on multi-dimensional hierarchical management, characterized in that, Permissions are divided into two categories: access permissions and data permissions. Access permissions include multi-level control at the application level, menu level, page resource level, and page element level. Data permissions include policy-based control based on project organization. The method includes: Dynamically register page resources and page elements, and set page element parameters according to standard coding structure; Maintain the menu structure and associate menus with page resources; Dynamically maintain application roles; Configure menu access authorization, page resource authorization, and page element authorization by enabling the corresponding switches. The page element authorization includes unauthorized display control and unauthorized operation control. Provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for target project organizations, and specifying whitelist permissions for business data; The specified business data whitelist permission includes adding or deleting whitelist data items.

2. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The page element authorization includes configuring unauthorized display control, configuring unauthorized operation control, and configuring custom prompt information functionality.

3. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 2, characterized in that, The unauthorized display control includes hiding page elements; The unauthorized operation control includes the function of disabling operations on page elements.

4. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The page elements include operation buttons, input fields, and cells in a data table.

5. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The data access authorization policy includes: Enable data access permissions for the creator's direct project organizations, where the direct project organizations are automatically determined based on the user's organizational affiliation. Specify data access permissions for the target project organization, wherein the target project organization is specified by the user; Specify whitelist permissions for business data, wherein the whitelist is based on a predefined list of business data objects.

6. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The dynamic registration page resources and page elements include setting page element parameters.

7. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The menu structure maintenance includes adding, deleting, or modifying menu items.

8. The resource and data access control method based on multi-dimensional hierarchical management and control according to claim 1, characterized in that, The method further includes: Assign application roles to specific users.

9. A resource and data access control system based on multi-dimensional hierarchical management and control, characterized in that, To implement the method of claim 1, the method comprises: The dynamic registration module is used to dynamically register page resources and page elements, and set page element parameters according to the standard coding structure. The menu maintenance module is used to maintain the menu structure and associate menus with page resources; The role maintenance module is used to dynamically maintain application roles; The authorization configuration module is used to provide access authorization for enabling / disabling the switch configuration menu, page resource authorization, and page element authorization. The page element authorization includes unauthorized display control and unauthorized operation control. The data access authorization module is used to provide data access authorization policies, including enabling data access permissions for the creator's directly affiliated project organization, specifying data access permissions for target project organizations, and specifying whitelist permissions for business data. The specified business data whitelist permission includes adding or deleting whitelist data items.

Images