Authorization control method, device and system of dynamic permission and storage medium

Abstract

The invention discloses a dynamic permission authorization control method, device and system and a storage medium. The method comprises the following steps: acquiring a target business object bound with a life cycle template, wherein the life cycle template is associated with a process template; wherein the life cycle state of the life cycle template is configured with a life cycle dynamic permission, and the task node of the process template is configured with a process dynamic permission; in response to process operation of the target business object, when the target business object is transferred to the target task node, distributing a process dynamic permission to an actual participant of the target task node according to the process dynamic permission of the target task node in the process template; and in response to the task node, triggering the change of the life cycle state of the target business object, and according to the changed target life cycle state, allocating life cycle dynamic permissions to the actual participants in the target life cycle state. The method has the technical effect of improving the enterprise authority management efficiency.

Description

Technical Field

[0001] This disclosure relates to the field of permission management technology, and in particular to a dynamic permission authorization control method, apparatus, system, and storage medium. Background Technology

[0002] With the deepening of enterprise digital transformation, core business systems such as Product Lifecycle Management (PLM) and Enterprise Resource Planning (ERP) are widely used in enterprise operations. Their core function lies in the refined management of business objects such as components and documents throughout their entire lifecycle. Existing technologies typically employ role-based static access control mechanisms, pre-assigning fixed access permissions based on the user's team or organizational structure. However, business objects often involve complex approval processes and status changes during actual workflow. For scenarios such as cross-departmental collaboration, expert review, or temporary approval, static access control mechanisms often lack flexibility, preventing the actual handler from accessing the business object. Furthermore, to address temporary access requirements in the process, existing practices often require frequent manual intervention or special code-level processing, which can easily lead to over-authorization and data security risks. Therefore, improving the flexibility of permissions for business objects during workflow deserves attention. Summary of the Invention

[0003] In view of this, embodiments of this disclosure provide a method, apparatus, system, and storage medium for dynamic permission authorization control, aiming to improve the efficiency of permission management in the production and operation process of enterprises. A first aspect provides a method for dynamic permission authorization control, comprising: obtaining a target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; wherein the lifecycle template is used to define the lifecycle state of the target business object, the lifecycle state is configured with lifecycle dynamic permissions, and the process template is used to define business processes and task nodes associated with the target business object, the task nodes are configured with process dynamic permissions; in response to the execution of the process of the target business object, when the flow reaches a target task node, determining the actual participants of the target task node, and assigning process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template; and / or, in response to the task node triggering a change in the lifecycle state of the target business object, determining the actual participants of the target lifecycle state according to the changed target lifecycle state, and assigning lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

[0004] The above dynamic permission authorization control methods refine the granularity of permission control to process nodes and lifecycle states, constructing a dynamic authorization approach that includes static permissions, process dynamic permissions, and lifecycle dynamic permissions. This not only solves the problems of insufficient flexibility and frequent manual intervention required by traditional static permission management in complex business processes, but also avoids the security risks that may arise from temporary authorization, over-authorization, and authorization remaining unchanged despite changes in the process stage, thereby achieving a dual improvement in business efficiency and data security.

[0005] Optionally, based on the dynamic permissions of the target task node in the process template, dynamic permissions are assigned to the actual participants of the target task node, including: obtaining the first permission information pre-configured for the target task node; writing the actual participants of the target task node and the first permission information into the dynamic permissions field of the target business object; based on the dynamic permissions of the target lifecycle state in the lifecycle template, dynamic permissions are assigned to the actual participants of the target lifecycle state, including: obtaining the second permission information pre-configured for the target lifecycle state; writing the actual participants of the target lifecycle state and the second permission information into the dynamic permissions field of the target business object.

[0006] Optionally, the first permission information and the second permission information are configured to limit the operation permission types of the actual participants, and the operation permission types include at least one of: read, modify, and download.

[0007] Optionally, it also includes: in response to the completion of the target task node, removing the process dynamic permissions of the actual participants of the target task node from the target business object; and / or, in response to the end of the target lifecycle state, removing the lifecycle dynamic permissions of the actual participants of the target lifecycle state from the target business object.

[0008] Optionally, it also includes: receiving an operation request for a target business object, obtaining the target business object's static permissions, process dynamic permissions, and lifecycle dynamic permissions; determining whether to allow the operation request based on a preset permission calculation logic; wherein, the permission calculation logic includes: rejecting the operation request when all static permissions, process dynamic permissions, and lifecycle dynamic permissions fail verification; or, allowing the operation request when any one of the static permissions, process dynamic permissions, and lifecycle dynamic permissions passes verification.

[0009] Optionally, it also includes: in response to receiving a task transfer request for the target task node, updating the actual participant of the target task node from the original handler to the task agent; modifying the process dynamic permission field of the target business object to transfer the process dynamic permission of the original handler to the task agent.

[0010] Optionally, it also includes: parsing and determining the actual user authentication information based on the participant type configured in the process template, wherein the participant type includes user, organization, role or group; when the actual participant is a temporarily added user not preset in the process template, automatically assigning the dynamic process permissions of the target task node to the temporarily added user.

[0011] Secondly, a dynamic permission authorization control device is provided, comprising: an acquisition unit for acquiring a target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; wherein the lifecycle template is used to define the lifecycle state of the target business object, and the lifecycle state is configured with lifecycle dynamic permissions; the process template is used to define the business process and task nodes associated with the target business object, and the task nodes are configured with process dynamic permissions; a first response unit for responding to the process execution of the target business object, and when the flow reaches the target task node, determining the actual participants of the target task node, and assigning process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template; and a second response unit for responding to the task node triggering a change in the lifecycle state of the target business object, determining the actual participants of the target lifecycle state according to the changed target lifecycle state, and assigning lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

[0012] Thirdly, a dynamic permission authorization control system is provided, comprising: a business object management module for managing target business objects, binding target business objects and lifecycle templates, and associating lifecycle templates and process templates; a lifecycle management module for managing lifecycle templates, wherein the lifecycle templates define the lifecycle states of target business objects, and the lifecycle states are configured with dynamic lifecycle permissions; a process management module for managing process templates, wherein the process templates define business processes and task nodes associated with target business objects, and the task nodes are configured with dynamic process permissions; and for running the process of the target business object to flow to the target task node, and triggering changes in the lifecycle state of the target business object; and a permission management module for, in response to the flow to the target task node, determining the actual participants of the target task node, and assigning dynamic process permissions to the actual participants of the target task node according to the dynamic process permissions of the target task node in the process template; and in response to the task node triggering a change in the lifecycle state of the target business object, determining the actual participants of the target lifecycle state according to the changed target lifecycle state, and assigning dynamic lifecycle permissions to the actual participants of the target lifecycle state according to the dynamic lifecycle permissions of the target lifecycle state in the lifecycle template.

[0013] Fourthly, a computer-readable storage medium is provided, including instructions that, when read by a processor, execute the dynamic permission authorization control method provided in the first aspect. Attached Figure Description

[0014] The accompanying drawings used in the description of the embodiments of this disclosure are briefly introduced below: Figure 1 The diagram shows a flowchart of a dynamic permission authorization control method provided in some embodiments of this application; Figure 2 The diagram shows a schematic representation of a dynamic permission authorization control device provided in some embodiments of this application. Figure 3 The diagram shows a schematic representation of the structure of a dynamic permission authorization control system provided in some embodiments of this application. Detailed Implementation

[0015] To more clearly illustrate the technical solutions in the embodiments of this disclosure, examples of implementation methods of this disclosure will be described below with reference to the accompanying drawings. The accompanying drawings described below are merely some embodiments of this disclosure. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without creative effort. Adjustments and improvements made without departing from the concept of this disclosure are all within the protection scope of this disclosure.

[0016] To keep the drawings simple, each figure only schematically shows the parts relevant to the embodiment, and they do not represent the actual structure of the product. In addition, for the sake of clarity and ease of understanding, some figures only schematically show parts of components with the same structure or function, and there may actually be more or fewer components with the same structure or function.

[0017] In this disclosure, unless otherwise expressly specified and limited, ordinal numbers, such as “first”, “second”, etc., are used only to distinguish and describe related objects, and should not be construed as indicating or implying the relative importance or order between related objects; furthermore, they do not represent the quantity of related objects. “Multiple” includes two or more, and other quantifiers are similar. “ / ” is used to describe the relationship between related objects, indicating an “or” relationship between them. “And / or” is used to describe the relationship between related objects, including any combination relationship between them, such as “a and / or b” including: “a alone”, “b alone”, or “a and b”. “One or more” or “at least one” of multiple objects refers to any object or any combination of multiple objects, such as “one or more of a1, a2, a3” or “at least one of a1, a2, a3” including: “a1 alone”, “a2 alone”, “a3 alone”, “a1 and a2”, “a1 and a3”, “a2 and a3”, or “a1, a2 and a3”.

[0018] Enterprise-level access control technology, as a core component of product lifecycle management, enterprise resource planning, and large-scale collaborative office systems, has its advantages and disadvantages primarily reflected in data security, compliance of business processes, and efficiency of cross-departmental collaboration. Currently, enterprise applications typically rely on predefined role-based access control models for static authorization. The scope of permissions is often deeply bound to the user's organizational structure or product container team. However, when business objects undergo cross-level or cross-domain lifecycle flows, authentication based solely on fixed static organizational boundaries lacks dynamic awareness of the process task context and lifecycle status, making it difficult to meet the flexible, ad-hoc business processing needs of enterprises. For example, in complex component release approval processes, current access control methods often ignore temporary participation scenarios involving non-fixed team members, such as inviting external experts for technical reviews or cross-departmental leaders for compliance approvals. Because these individuals do not belong to the static container team of the component, their legitimate identities in specific tasks cannot be identified in real time, resulting in their inability to access controlled objects and forcing the approval process to be interrupted. Furthermore, current permission policies lack fine-grained differentiation of business processes. For example, in pursuit of smooth workflow, temporary personnel are directly added as system administrators with full permissions, which can easily lead to users obtaining excessive authorization beyond what is required for their tasks, posing a risk of data leakage. On the other hand, if static configurations are strictly adhered to to ensure data security, administrators inevitably need to manually authorize and clean up frequently for each workflow, resulting in high maintenance costs and a high risk of untimely permission revokement due to human error. Therefore, existing technologies struggle to simultaneously balance business flexibility, operational efficiency, and data security, limiting the deep application of enterprise digital management and user experience. In view of this, this application proposes a dynamic permission authorization control method, device, system, and storage medium. By establishing a deep correlation model between business object lifecycle, process approval, and permission control, and using the arrival of process nodes and lifecycle state changes as triggering conditions for fusion perception, the task roles and current states of actual participants are accurately identified, thereby achieving dynamic allocation and automatic revoke of permissions. This ensures the security of enterprise data asset access while eliminating the risk of excessive authorization and improving business workflow efficiency.

[0019] The following description is in conjunction with the accompanying drawings: Please refer to Figure 1 This document illustrates a flowchart of a dynamic permission authorization control method provided in some embodiments of this application. The dynamic permission authorization control method includes: S110: Obtain the target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; wherein the lifecycle template is used to define the lifecycle state of the target business object, and the lifecycle state is configured with dynamic lifecycle permissions; the process template is used to define the business process and task nodes associated with the target business object, and the task nodes are configured with dynamic process permissions. S120: In response to the process execution of the target business object, when the flow reaches the target task node, determine the actual participants of the target task node, and assign process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template. S130: In response to the lifecycle state change of the target business object triggered by the task node, determine the actual participants of the target lifecycle state according to the changed target lifecycle state, and assign lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

[0020] In the above embodiments, the target business object refers to entity data that needs to be controlled in enterprise-level information systems, such as product lifecycle management and enterprise resource planning systems, including components, documents, baselines, and change requests. To achieve refined management of this target business object, it is associated with a specific lifecycle template through attribute binding. This lifecycle template defines the complete state transition path (i.e., lifecycle state) of the business object from creation, approval, release to archiving. Simultaneously, to drive the flow of the business object, this lifecycle template is further associated with a process template, which defines specific business process logic and various task nodes, such as submission nodes, review nodes, and approval nodes. During this configuration phase, the system pre-configures dynamic lifecycle permissions on each state of the lifecycle template, defining the operational permissions that various roles should possess when the object is in a specific state, such as "under design." Simultaneously, dynamic process permissions are configured on each task node of the process template, defining the operational permissions that the handler at that node should possess when the process flows to a specific node, such as "manager approval." This configuration method breaks the singularity of traditional static permissions and establishes a deep mapping between permissions and business scenarios. Furthermore, once a process instance initiated for the target business object is launched, the process engine drives the instance flow. When the process reaches a specific target task node, such as the "expert review" node, the system triggers dynamic authorization logic. At this time, the system first parses the participant configuration of the task node, resolving the preset abstract participant type into the current specific actual participant, such as a specific user ID. Subsequently, the system reads the permission policy preset for that node in the process template, such as granting modification permissions, and dynamically assigns the process permissions to the actual participants of the task node in real time. This mechanism helps to dynamically adjust the permissions of the actual participants of the corresponding target task nodes on different task nodes according to changes in task nodes during the flow of business objects. Even if the actual participant was not originally within the static authorization scope of the business object, it can temporarily obtain the necessary permissions to handle business during the execution of the task node, thereby solving the problem of permission obstruction during cross-departmental collaboration or temporary approval. At the same time, the lifecycle state changes of business objects are often driven by the execution results of process tasks, such as the approval causing the status to change from "under review" to "released". When the processing logic of a task node triggers a state change event, the system identifies the target lifecycle state after the change and backtracks to query the lifecycle template bound to that business object. The system retrieves the pre-configured permission rules for that target state, identifies the set of permissions that each actual participant should have in this new state, and allocates dynamic lifecycle permissions accordingly.For example, when an object's status changes to "published," the system may automatically revoke the designer's modification permissions and assign read permissions, thereby achieving automatic state-based permission switching. The dynamic permission authorization control method provided in this application refines permission control granularity to process nodes and lifecycle states, constructing a dynamic authorization method encompassing static permissions, process-based dynamic permissions, and lifecycle-based dynamic permissions. This not only solves the problems of insufficient flexibility and frequent manual intervention required by traditional static permission management in complex business processes, but also avoids security risks arising from temporary authorization, over-authorization, and unchanging authorizations during workflow changes, achieving a dual improvement in business efficiency and data security.

[0021] In some embodiments of this application, step S120 assigns process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template, including: obtaining the first permission information pre-configured for the target task node; and writing the actual participants of the target task node and the first permission information into the process dynamic permission field of the target business object. Step S130 assigns lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template, including: obtaining the second permission information pre-configured for the target lifecycle state; and writing the actual participants of the target lifecycle state and the second permission information into the lifecycle dynamic permission field of the target business object.

[0022] In the above embodiments, the first permission information and the second permission information specifically define the scope of operations that participants can perform on business objects, including but not limited to read, modify, and download permissions, or may also include full authorization, meaning that all three of the aforementioned operations can be performed. In actual execution, this application does not merely temporarily mark permissions in memory, but rather employs a persistent storage strategy based on object attributes. For dynamic process permissions, once the actual participants of the target task node are determined—for example, after the system resolves the role of "R&D Manager" to a specific "User A" based on the organizational structure—the system will combine "User A" with the "read" or "modify" permissions configured for that node into data in a specific format, such as a JSON string, and directly update and write it to the reserved dynamic process permission field in the target business object's database record. Similarly, when the state changes, lifecycle dynamic permissions will also be written to the lifecycle dynamic permission field of the business object entity. Because dynamic permissions change frequently with process flow and state transition, storing them directly in the fields of the business object itself allows the permission verification engine to synchronously obtain the currently valid dynamic permissions when loading the business object. This avoids having to query the separate permission table or recalculate complex rules every time authentication is performed, thereby significantly improving the response speed of permission evaluation and the high concurrency processing capability of the system.

[0023] In some embodiments of this application, the first permission information and the second permission information are configured to limit the operation permission types of actual participants. The operation permission types include at least one of: read, modify, and download. To meet the needs of refined management of enterprise-level business objects at different stages of their flow, the dynamic permission mechanism provided in this application supports multi-dimensional granular control of operations. Read permission typically refers to basic access behaviors such as allowing participants to view the metadata information of the business object (e.g., name, number, creation time), browse the attribute page of the business object, and view the BOM structure. Modification permission refers to allowing participants to edit and update the attribute values ​​of the business object, associate or remove sub-objects, etc. Download permission specifically refers to allowing participants to download electronic source files or attachments associated with the business object, such as CAD drawings, technical specification documents, etc. Furthermore, depending on the needs of the actual business scenario, the operation permission types may further include modification content permission, which can be used to iterate or check out modifications to the content of entity files associated with the business object. Alternatively, it may include full control permission, i.e., having all operational rights over the object. By defining such fine-grained permission types, the system can adhere to the principle of least privilege, granting only the minimum set of permissions necessary for the actual participant to complete the current task at each process node or specific lifecycle state. For example, for an expert review node, the system can only grant the external expert read permissions to review drawings, without granting modification or download permissions. This prevents the expert from accidentally modifying critical attributes of business objects or from leaking confidential information, ensuring data integrity and security.

[0024] In some embodiments of this application, the method further includes: in response to the completion of the target task node, removing the process dynamic permissions of the actual participants of the target task node from the target business object; and / or, in response to the end of the target lifecycle state, removing the lifecycle dynamic permissions of the actual participants of the target lifecycle state from the target business object.

[0025] In the above embodiments, dynamic permissions for participants can be revoked to address the issues of over-authorization and dormant permissions in traditional permission management. For the revocation of dynamic permissions in the workflow, when a task handler (the actual participant) submits a task completion request in the system, such as by clicking the "Agree" or "Reject" button, the workflow engine executes the task completion logic. At this time, the task listener configured internally in the system captures the task completion event and triggers a cleanup procedure. For example, temporary permission records associated with the task node and the participant can be located and removed from the dynamic permission field of the target business object's workflow. This ensures that reviewers only have access to or operation permissions for the business object within the specific time window in which they perform their duties. Once the task ends, the permissions immediately expire, thus eliminating the risk of data leakage due to residual permissions. Similarly, for the revocation of dynamic permissions in the lifecycle, when a business object transitions from a lifecycle state, such as "Under Design," to the next state, such as "Under Review," it signifies the end of the previous state. The system automatically cleans up or overwrites the permission configurations related to the old state stored in the dynamic permission field of the lifecycle, ensuring that the permission environment of the business object always remains strictly consistent with the current lifecycle stage. This automated permission revoke strategy enables permissions to be granted as needed and revoked when not in use, ensuring business continuity while maximizing system security and compliance.

[0026] In some embodiments of this application, the method further includes: receiving an operation request for a target business object, obtaining the static permissions, process dynamic permissions, and lifecycle dynamic permissions of the target business object; determining whether to allow the operation request based on a preset permission calculation logic; wherein the permission calculation logic includes: rejecting the operation request when all static permissions, process dynamic permissions, and lifecycle dynamic permissions fail verification; or allowing the operation request when any one of the static permissions, process dynamic permissions, and lifecycle dynamic permissions passes verification.

[0027] In the above embodiments, when a user attempts to perform a specific operation on a business object, such as modifying a document, the system triggers the permission evaluation engine. This engine can then retrieve three types of permission data associated with the business object in parallel or sequentially: static permissions based on the user's team or role, and dynamic permissions for the workflow and lifecycle directly stored in the business object's attribute fields. Subsequently, a short-circuit verification strategy based on logical OR can be executed, or a highly efficient calculation logic combining bitwise operations can be used, such as `final permission = (static granted & ~ static denied) | dynamic permission`. As long as the user satisfies any one of the static permissions, dynamic workflow permissions, or dynamic lifecycle permissions, the system determines that the user has the operation permission and allows the operation. Only if all permission levels fail to grant permission will the system ultimately reject the request. This verification logic establishes the temporary supplementary or extended role of dynamic permissions for static permissions. For example, an external review expert may not have any static access permissions because they are not part of the product's static team (static permission verification failed). However, because the workflow has reached the review node, they have been granted temporary dynamic workflow reading permissions (dynamic workflow permission verification passed). According to the above logic, the expert can view the document smoothly without the administrator having to modify the underlying static security policy, thus balancing the needs of security and short-term business flexibility.

[0028] In some embodiments of this application, the method further includes: in response to receiving a task transfer request for a target task node, updating the actual participant of the target task node from the original handler to the task agent; modifying the process dynamic permission field of the target business object, and transferring the process dynamic permission of the original handler to the task agent.

[0029] The above embodiments can manage permissions for common task transfer or temporary delegation scenarios in enterprise business collaboration, such as when the original approver is on leave, resigns, or has an excessive workload, and needs to transfer the pending tasks to other colleagues. In existing conventional systems, simple workflow task transfer often only changes the task ownership in the process engine, but ignores the synchronous change of business data access permissions. As a result, although the person who takes over the task receives the task notification, they cannot view the details or perform approval operations due to a lack of access permissions to the business objects. Therefore, when this application detects that a task handler has issued a task transfer request, or when an administrator performs a task reassignment operation in the background, it can not only change the executor of the process task from the original handler to the task agent (i.e., the new actual participant) at the workflow engine level, but also trigger a permission synchronization mechanism. This mechanism reads the current dynamic permission field of the target business object, locates the original handler's permission record, and replaces or migrates it to the task agent. This ensures that the task agent immediately obtains the same dynamic operation permissions as the original handler upon taking over the task, guaranteeing a seamless transition of the business process. At the same time, the system will usually also remove the original handler's dynamic permissions to follow the principle of least privilege and prevent the original handler from accessing business data through residual permissions after no longer being responsible for the task.

[0030] In some embodiments of this application, the method further includes: parsing and determining the actual user authentication information based on the participant type configured in the process template, wherein the participant type includes user, organization, role or group; when the actual participant is a temporarily added user not preset in the process template, automatically assigning the dynamic process permissions of the target task node to the temporarily added user.

[0031] To maintain template versatility and reusability, when defining task nodes in a workflow template, abstract participant types are typically used to represent task handlers, such as department manager (role), R&D Department 1 (organization), or Project A Group (group), rather than hard-coding specific employee names. During workflow instance execution, these abstract types need to be dynamically parsed into specific, unique user authentication information, typically a UserID, based on the current organizational structure data, for accurate permission binding. This application can address common dynamic scenarios during workflow execution, such as temporary additions, notifications, or expert collaboration. Specifically, it provides a fallback authorization mechanism when the workflow initiator or current handler decides to invite a temporarily added user not pre-defined in the initial workflow template to participate in the task. When it is identified that the actual participant is an additional addition, there is no need for the system administrator to intervene to modify the underlying static permission model or temporarily adjust the user group. Instead, the system automatically generates and assigns default dynamic permissions for the target task node process to the temporary user at the code logic level. For example, for notification tasks, the system automatically assigns read permissions by default so that the user can view the review materials. This improves the adaptability and flexibility of the business process in the face of emergencies, effectively avoids process blockage caused by temporary participants not having permission to access business objects, and also saves the maintenance personnel the burden of frequently manually maintaining permissions.

[0032] Figure 2 A schematic diagram of the structure of a dynamic permission authorization control device provided in some embodiments of this application is shown. The authorization control device 200 includes: an acquisition unit 210, configured to acquire a target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; wherein the lifecycle template is used to define the lifecycle state of the target business object, and the lifecycle state is configured with lifecycle dynamic permissions; the process template is used to define the business process and task nodes associated with the target business object, and the task nodes are configured with process dynamic permissions; a first response unit 220, configured to respond to the process execution of the target business object, and when the flow reaches a target task node, determine the actual participants of the target task node, and assign process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template; a second response unit 230, configured to respond to the task node triggering a change in the lifecycle state of the target business object, determine the actual participants of the target lifecycle state according to the changed target lifecycle state, and assign lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

[0033] The above division of units is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these units can be implemented by a processor calling software; for example, a cutting control device includes a processor coupled to memory, which stores instructions. The processor calls the instructions stored in memory to implement any of the above cutting control methods or to realize the functions of each unit. The processor can be, for example, a general-purpose processor, such as a CPU, and the memory can be memory within a cross-platform acquisition device or memory outside of a cross-platform acquisition device. Alternatively, these units can be implemented as hardware circuits. The functions of some or all units can be realized through the design of the hardware circuit, which can be understood as one or more processors. For example, the hardware circuit includes an application-specific integrated circuit (ASIC), which implements the functions of some or all units by designing the logical relationships between the components within the circuit. Furthermore, the hardware circuit can be implemented using a programmable logic device (PLD), which can include a large number of logic gates. The logical relationships between the logic gates are configured through a configuration file, thereby realizing the functions of some or all units.

[0034] Figure 3 This diagram illustrates the structure of a dynamic permission authorization control system provided in some embodiments of this application. It includes: a business object management module 310, used to manage target business objects, bind target business objects and lifecycle templates, and associate lifecycle templates and process templates; a lifecycle management module 320, used to manage lifecycle templates, wherein the lifecycle templates define the lifecycle states of target business objects, and the lifecycle states are configured with lifecycle dynamic permissions; a process management module 330, used to manage process templates, wherein the process templates define business processes and task nodes associated with target business objects, and the task nodes are configured with process dynamic permissions; and used to run the process of the target business object to flow to the target task node, and trigger changes in the lifecycle state of the target business object; and a permission management module 340, used to, in response to the flow to the target task node, determine the actual participants of the target task node, and assign process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template; and in response to the task node triggering a change in the lifecycle state of the target business object, determine the actual participants of the target lifecycle state according to the changed target lifecycle state, and assign lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

[0035] Based on the same technical concept, this application also provides a computer-readable storage medium including instructions, which, when read by a processor, execute the dynamic permission authorization control method provided in the above embodiments.

[0036] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail or in a particular embodiment can be referred to in the relevant descriptions of other embodiments. Furthermore, the above embodiments can be freely combined as needed.

Claims

1. A dynamic permission authorization control method, characterized in that, include: Obtain the target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; The lifecycle template is used to define the lifecycle state of the target business object, and the lifecycle state is configured with dynamic lifecycle permissions. The process template is used to define the business process and task nodes associated with the target business object, and the task nodes are configured with dynamic process permissions. In response to the flow execution of the target business object, when the flow reaches the target task node, the actual participants of the target task node are determined, and the dynamic flow permissions of the target task node are assigned to the actual participants of the target task node according to the dynamic flow permissions of the target task node in the flow template; and / or, In response to the task node triggering a lifecycle state change for the target business object, the actual participants in the target lifecycle state are determined based on the changed target lifecycle state, and the lifecycle dynamic permissions are assigned to the actual participants in the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

2. The dynamic permission authorization control method according to claim 1, characterized in that, The step of assigning dynamic process permissions to the actual participants of the target task node based on the dynamic process permissions of the target task node in the process template includes: Obtain the first permission information pre-configured for the target task node; Write the actual participants of the target task node and the first permission information into the process dynamic permission field of the target business object; The step of allocating dynamic lifecycle permissions to actual participants in the target lifecycle state based on the dynamic lifecycle permissions of the target lifecycle state in the lifecycle template includes: Obtain the pre-configured second permission information for the target lifecycle state; Write the actual participants of the target lifecycle state and the second permission information into the lifecycle dynamic permission field of the target business object.

3. The dynamic permission authorization control method according to claim 2, characterized in that, The first permission information and the second permission information are configured to limit the operation permission types of actual participants, and the operation permission types include at least one of: read, modify, and download.

4. The dynamic permission authorization control method according to claim 2, characterized in that, It also includes rights: In response to the completion of the target task node, remove the process dynamic permissions of the actual participant of the target task node from the target business object; and / or, In response to the end of the target lifecycle state, the lifecycle dynamic permissions of the actual participants in the target lifecycle state are removed from the target business object.

5. The dynamic permission authorization control method according to claim 1, characterized in that, Also includes: Receive an operation request for the target business object, and obtain the static permissions, process dynamic permissions, and lifecycle dynamic permissions of the target business object; The system determines whether the operation request is allowed based on a preset permission calculation logic. The permission calculation logic includes: If the static permission, the process dynamic permission, and the lifecycle dynamic permission all fail verification, the operation request will be rejected. Alternatively, the operation request may be allowed when any one of the static permissions, the process dynamic permissions, and the lifecycle dynamic permissions passes verification.

6. The dynamic permission authorization control method according to claim 5, characterized in that, Also includes: In response to receiving a task transfer request for the target task node, the actual participant of the target task node is updated from the original handler to the task executor; Modify the dynamic permission field of the target business object to transfer the dynamic permission of the original handler to the task agent.

7. The dynamic permission authorization control method according to claim 1, characterized in that, The process of determining the actual participants in the target task node includes: Based on the participant types configured in the process template, the actual user authentication information is parsed and determined, wherein the participant types include users, organizations, roles, or groups; When the actual participant is a temporarily added user who is not preset in the process template, the dynamic process permissions of the target task node are automatically assigned to the temporarily added user.

8. A dynamic permission authorization control device, characterized in that, include: An acquisition unit is used to acquire a target business object, wherein the target business object is configured to be bound to a lifecycle template, and the lifecycle template is configured to be associated with a process template; wherein the lifecycle template is used to define the lifecycle state of the target business object, the lifecycle state is configured with dynamic lifecycle permissions, and the process template is used to define the business process and task nodes associated with the target business object, and the task nodes are configured with dynamic process permissions. The first response unit is used to respond to the process execution of the target business object. When the flow reaches the target task node, it determines the actual participants of the target task node and assigns the process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template. The second response unit is used to respond to the task node triggering a change in the lifecycle state of the target business object, determine the actual participants in the target lifecycle state based on the changed target lifecycle state, and assign the lifecycle dynamic permissions to the actual participants in the target lifecycle state based on the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

9. A dynamic access control system, characterized in that, include: The business object management module is used to manage target business objects, bind the target business objects to lifecycle templates, and associate the lifecycle templates with process templates. The lifecycle management module is used to manage the lifecycle template, wherein the lifecycle template is used to define the lifecycle state of the target business object, and the lifecycle state is configured with dynamic lifecycle permissions; The process management module is used to manage the process template, wherein the process template is used to define the business process and task nodes associated with the target business object, the task nodes are configured with dynamic process permissions; and is used to run the process of the target business object to flow to the target task node, and to trigger the lifecycle state change of the target business object; The permission management module is used to, in response to the process flow transitioning to the target task node, determine the actual participants of the target task node, and assign the process dynamic permissions to the actual participants of the target task node according to the process dynamic permissions of the target task node in the process template; and in response to the task node triggering a lifecycle state change of the target business object, determine the actual participants of the target lifecycle state according to the changed target lifecycle state, and assign the lifecycle dynamic permissions to the actual participants of the target lifecycle state according to the lifecycle dynamic permissions of the target lifecycle state in the lifecycle template.

10. A computer-readable storage medium, characterized in that, The instruction includes an instruction that, when read by the processor, executes the dynamic permission authorization control method as described in any one of claims 1 to 7.

Images