Role permission management-based piecework reporting data security operation processing method and system

Abstract

This invention relates to the field of industrial informatization and data security management technology, specifically to a method and system for secure operation processing of piecework reporting data based on role-based access control. The method includes: acquiring basic piecework reporting data; establishing sets of subject, resource, and environmental attributes; identifying sensitive fields and assigning them non-zero sensitivity values; generating permission mapping tables with data fields as independent control objects; constructing a hierarchical permission rule library containing conflict handling rules; upon receiving an operation request, first performing basic permission verification, then calculating environmental risk values ​​based on environmental attributes, and determining security thresholds according to field sensitivity, implementing release or downgrade and auditing; writing individual authorizations through a matrix configuration interface and recording permission change traceability information. This invention achieves field-level, scenario-based, and dynamic security control of sensitive piecework reporting data.

Description

Technical Field

[0001] This invention relates to the field of industrial information technology and data security management, specifically to a method and system for secure operation processing of piecework reporting data based on role-based access control. Background Technology

[0002] With the development of manufacturing execution systems and digital workshop management technologies, piecework reporting has become an important data source in production scenarios such as stamping and assembly. In order to achieve standardized management of the reporting process and secure use of pay-related information, access control and operation processing of piecework reporting data have become particularly important.

[0003] In the management of piecework data, existing methods mostly adopt coarse-grained authorization at the menu, page, or order level. While these methods can differentiate the access scope of different positions, they are difficult to implement fine-grained control based on fields of varying sensitivity, such as piecework quantity, unit price, and wage amount, when the same piecework order contains fields of different sensitivity. At the same time, there are dynamic factors in the workshop, such as differences in work groups, process qualifications, changes in account closure status, and changes in terminal location, operation time, and production line status. Traditional static permission models often fail to balance business availability and sensitive data isolation requirements, and are prone to problems such as insufficient authorization granularity, high risk of unauthorized access, inconvenience in adjusting temporary authorizations, and difficulty in post-event auditing and tracing.

[0004] Therefore, how to uniformly process personnel attributes, data attributes, and on-site environment information in piecework reporting, establish an access control mechanism oriented towards field-level objects, and combine access scenarios to dynamically determine and trace sensitive data operations to ensure the safe, flexible, and orderly flow of piecework reporting data on the production site has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for secure operation processing of piecework reporting data based on role-based access control. This method establishes a fine-grained access control and dynamic security judgment mechanism oriented towards field-level objects, avoiding the risks of unauthorized viewing and traceability difficulties caused by traditional static coarse-grained authorization. It also achieves both the availability of piecework reporting data on the production site and the isolation and protection of sensitive pay information. Specifically, the technical solution of this invention is as follows: A method for secure operation processing of piecework reporting data based on role-based access control, comprising the following steps: Step S1: The server obtains the basic data of the piecework reporting business, establishes a subject attribute set, a resource attribute set, and an environment attribute set; identifies sensitive data fields in the basic data, and assigns corresponding non-zero field sensitivity values ​​to the sensitive data fields; Step S2: The server treats the data fields in the basic data as independent control objects, and generates a system containing resource objects, operation instructions, and main... Step S3: Configure a hierarchical permission rule base on the server, store the permission mapping table as the underlying rule in the hierarchical permission rule base, and set permission conflict handling rules in the hierarchical permission rule base; Step S4: The server receives operation requests for piecework reporting data, performs basic permission verification based on the permission mapping table and the hierarchical permission rule base. If the basic permission verification passes, it extracts the current environment attribute corresponding to the operation request based on the environment attribute set, calculates the environment risk value, and determines the security threshold based on the non-zero field sensitivity value of the data field corresponding to the operation request; if the environment risk value is less than the security threshold, it performs a release operation; if the environment risk value is greater than or equal to the security threshold, it performs a downgrade operation and generates a permission anomaly audit record; Step S5: The server writes separate authorization instructions for sensitive data fields to the hierarchical permission rule base through a preset matrix configuration interface and records permission change audit traceability information.

[0006] Preferably, step S1 specifically includes: the main attribute set includes: the operator's job code, skill level, work group, and process qualification; the resource attribute set includes: the data type of the work report, the piecework status, and the sensitive identifiers of the data fields; the sensitive identifiers define the piecework quantity, unit price, and wage amount in a hierarchical manner; the environmental attribute set includes: the current work report terminal network address, the deviation between the current operation time and the scheduled time, and the production line operation status.

[0007] Preferably, step S3 specifically involves: the server dividing the hierarchical permission rule base into top-down categories: function-level rules, data domain-level rules, record-level rules, and field-level rules; the hierarchical permission rule base also includes temporary unauthorized special approval rules for handling emergency situations; a rejection-priority conflict handling logic is set in the hierarchical permission rule base based on field sensitivity values, and the adjudication function of the conflict handling logic is configured as follows: based on the preliminary judgment value given by traversing all rules of the current conflict, and the non-zero field sensitivity value of the corresponding active field, a weighted calculation is performed to obtain the final adjudication result; wherein, the preliminary judgment value is configured as follows: rejection corresponds to a first preset logical judgment value, and permission corresponds to a second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when a temporary unauthorized special approval rule is introduced, the preliminary judgment value of the temporary unauthorized special approval rule is set to a special approval value greater than 1; the conflict handling result is determined to be allowed only when the final adjudication result is greater than the preset adjudication threshold, otherwise it is rejected.

[0008] Preferably, step S4 specifically involves: pre-configuring the system's global security constant, risk weight coefficient, and the network address of the workshop's fixed industrial control computer; the server combines the network address of the workshop's fixed industrial control computer, the current work reporting terminal's network address, the production line's operating status, the deviation between the current operation time and the scheduled time, and the risk weight coefficient to construct an environmental risk assessment model and output the environmental risk value.

[0009] Preferably, step S5 specifically involves: the matrix configuration interface being presented as a cross matrix of rows and columns, with rows representing job positions or work groups, and columns representing processes, data types, or specific data fields; the server receiving the selection operation of nodes in the cross matrix in the matrix configuration interface and writing a separate authorization instruction; based on a preset permission change audit and traceability mechanism, recording the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change.

[0010] The piece-rate reporting data security operation processing system based on role-based access control includes the following modules: a basic information collection module, used to acquire basic data for piece-rate reporting business, establish subject attribute sets, resource attribute sets, and environment attribute sets; identify sensitive data fields in the basic data, and assign corresponding non-zero field sensitivity values ​​to sensitive data fields; a permission mapping table generation module, used to treat data fields in the basic data as independent control objects, and generate a permission mapping table containing resource objects, operation instructions, and subject identities based on the subject attribute sets and resource attribute sets; and a hierarchical rule management module, used to configure a hierarchical permission rule base, store the permission mapping table as the underlying rules in the hierarchical permission rule base, and set permission conflicts in the hierarchical permission rule base. The system includes several modules: a handling rule module and a permission assessment module. The permission assessment module receives operation requests for piecework data, performs basic permission checks based on the permission mapping table and the hierarchical permission rule base. If the basic permission check passes, it extracts the current environment attributes corresponding to the operation request based on the environment attribute set, calculates the environment risk value, and determines the security threshold based on the non-zero sensitivity value of the data field corresponding to the operation request. If the environment risk value is less than the security threshold, it performs a release operation; if the environment risk value is greater than or equal to the security threshold, it performs a downgrade operation and generates a permission anomaly audit record. The authorization configuration module writes individual authorization instructions for sensitive data fields to the hierarchical permission rule base through a preset matrix configuration interface and records permission change audit traceability information.

[0011] Preferably, the basic information collection module is specifically used for: establishing a main attribute set, which includes: the operator's job code, skill level, work group, and process qualification; establishing a resource attribute set, which includes: the data type of the work report, the piecework status, and sensitive identifiers for data fields; the sensitive identifiers are used to define the piecework quantity, unit price, and wage amount in a hierarchical manner; and establishing an environmental attribute set, which includes: the current work report terminal network address, the deviation between the current operation time and the scheduled time, and the production line operation status.

[0012] Preferably, the hierarchical rule management module is specifically used to: divide the hierarchical permission rule base from top to bottom into: function-level rules, data domain-level rules, record-level rules, and field-level rules; the hierarchical permission rule base also includes temporary unauthorized special approval rules for dealing with emergency situations; set up a rejection priority conflict handling logic based on field sensitivity values ​​in the hierarchical permission rule base, and configure the adjudication function of the conflict handling logic as follows: based on the preliminary judgment value given by traversing all rules of the current conflict, and the non-zero field sensitivity value of the corresponding active field, calculate the final adjudication result by weighting; wherein, the preliminary judgment value is configured as follows: rejection corresponds to a first preset logical judgment value, and permission corresponds to a second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when a temporary unauthorized special approval rule is introduced, the preliminary judgment value of the temporary unauthorized special approval rule is set to a special approval value greater than 1; the conflict handling result is determined to be allowed only when the final adjudication result is greater than the preset adjudication threshold, otherwise it is rejected.

[0013] Preferably, the permission assessment module is specifically used for: pre-configuring system global security constants and risk weight coefficients determined based on business time period attributes, and obtaining the network address of the fixed industrial control computer in the workshop; the logic for calculating the environmental risk value is as follows: determining the quantified value of the network location identifier based on the obtained network address of the fixed industrial control computer in the workshop and the network address of the current reporting terminal, determining the production line status anomaly coefficient based on the production line operation status; and determining the environmental risk value based on the deviation between the current operation time and the scheduled time, the quantified value of the network location identifier, the production line status anomaly coefficient, and the risk weight coefficient.

[0014] Preferably, the authorization configuration module is specifically used for: presenting the matrix configuration interface as a cross matrix of rows and columns, with rows representing job positions or work groups, and columns representing processes, data types, or specific data fields; receiving the selection operation of nodes in the cross matrix in the matrix configuration interface and writing individual authorization instructions; and recording the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change based on a preset permission change audit and traceability mechanism.

[0015] Compared with the prior art, the present invention has the following beneficial effects:

[0016] 1. This invention acquires basic data from piecework reporting and establishes a set of main attributes, resource attributes, and environmental attributes. Simultaneously, it identifies sensitive data fields such as piecework quantity, unit price, and wage amount and assigns corresponding non-zero field sensitivity values ​​to them. This enables the unified conversion of personnel attributes, data attributes, and on-site environmental information into calculable inputs, thereby allowing different fields in the same piecework order to be processed according to their sensitivity. This solves the problem that existing coarse-grained authorization at the menu level, page level, or whole order level is difficult to achieve fine-grained field-level control.

[0017] 2. This invention further extracts environmental attributes such as the current reporting terminal, the deviation between the operation time and the scheduling time, and the production line operation status after the basic permission verification is passed. It calculates the environmental risk value based on the preset global security constant, risk weight coefficient, and fixed industrial control computer network location identifier. At the same time, it determines the security threshold based on the non-zero sensitivity value of the field. This invention can dynamically determine the security of requests from the same subject at different access times, different access locations, and different production line states, thereby making up for the shortcomings of static permission mode in covering dynamic changes on site.

[0018] 3. This invention performs a degradation operation when the environmental risk value reaches or exceeds the safety threshold, and forces plaintext viewing to be changed to anonymized viewing or directly hides fields according to the subject's skill level. At the same time, it generates an audit record of abnormal permissions. This can take into account both necessary business continuity and sensitive data protection when the risk increases, and solve the problem that business availability and data isolation are difficult to balance in the traditional model.

[0019] 4. This invention, by setting up a matrix configuration interface and using job positions or work groups as rows and processes, data types, or specific data fields as columns to receive node selection operations, can transform the individual authorization adjustment of sensitive data fields into a visual configuration behavior. This makes it easier for workshop administrators to quickly complete field-level permission changes in scenarios such as shift changes, secondments, and special reviews, solving the problem of low response efficiency caused by relying on manual modification in the background for temporary authorization adjustments.

[0020] 5. This invention records the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change when writing a separate authorization instruction, and retains the old version rules to continue to take effect when the writing fails. This can form a complete permission change audit traceability chain and avoid the lack of authorization control caused by the half-write state, thereby improving the traceability, stability and engineering implementation capability of the permission management of sensitive fields in piecework reporting. Attached Figure Description

[0021] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0022] Figure 1 A flowchart illustrating the secure operation processing method for piecework reporting data based on role-based access control provided in this application embodiment;

[0023] Figure 2 This is a schematic diagram of the module of the piecework reporting data security operation processing system based on role-based access control in this application embodiment. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0025] The method for secure operation processing of piecework reporting data based on role-based access control includes the following steps: Step S1: The server obtains the basic data of piecework reporting business, establishes a subject attribute set, a resource attribute set, and an environment attribute set; identifies sensitive data fields in the basic data, and assigns corresponding non-zero field sensitivity values ​​to the sensitive data fields; Step S2: The server treats the data fields in the basic data as independent control objects, and generates an access control table containing resource objects, operation instructions, and subject identities based on the subject attribute set and resource attribute set; Step S3: The server configures a hierarchical access control rule base, stores the access control table as the underlying rules in the hierarchical access control rule base, and sets access conflict handling rules in the hierarchical access control rule base. Then; Step S4: The server receives the operation request for piecework reporting data, performs basic permission verification according to the permission mapping table and the hierarchical permission rule base. If the basic permission verification passes, it extracts the current environment attribute corresponding to the operation request based on the environment attribute set, calculates the environment risk value, and determines the security threshold based on the non-zero field sensitivity value of the data field corresponding to the operation request. If the environment risk value is less than the security threshold, it performs the allow operation; if the environment risk value is greater than or equal to the security threshold, it performs the downgrade operation and generates a permission anomaly audit record; Step S5: The server writes the separate authorization instruction for the sensitive data field to the hierarchical permission rule base through the preset matrix configuration interface and records the permission change audit traceability information.

[0026] This embodiment provides a layered safety control mechanism for piece-rate reporting in stamping workshops, such as... Figure 1 As shown; specifically, the server is deployed at the application layer of the manufacturing execution system, and the piecework reporting terminals are set up on stamping line 1, stamping line 2, and the workshop statistics room. The terminals communicate with the server through the factory intranet. This mechanism revolves around the complete business chain of day shift production, post-shift accounting, and anomaly tracing, so that the same piecework sheet is subject to field-level constraints at each stage of generation, viewing, modification, accounting, and auditing.

[0027] The specific processing procedure is as follows: The server obtains basic data; the basic data can come from the work order table, personnel master data table, team table, process table, production line status table, and shift schedule table; after the data is entered into the database, the server establishes three types of attribute sets: one type corresponds to operators, another type corresponds to work reporting resources, and the third type corresponds to the current access environment; at the same time, the server scans the fields in the piecework work reporting data, identifies sensitive fields such as piecework quantity, unit price, and wage amount, and assigns sensitivity values ​​to non-zero fields respectively.

[0028] The sensitivity value of a non-zero field is determined by the server based on a pre-written database dictionary table. This dictionary table stores a unique correspondence between the name of each data field and its business confidentiality level. The sensitivity value of a non-zero field is positively correlated with the business confidentiality level of the data field.

[0029] For ease of understanding, in a specific embodiment: a piecework order D1001 includes an employee number field F1, a piecework quantity field F2, a piecework price field F3, a wage amount field F4, and a pass rate field F5; the server can mark the piecework quantity field F2, the piecework price field F3, and the wage amount field F4 as sensitive fields, and set their sensitivity values ​​to 1, 4, and 5 respectively, while the remaining fields can be marked as 0 or ordinary field identifiers; the non-zero setting here allows the subsequent threshold calculation to directly distinguish between sensitive fields and non-sensitive fields.

[0030] The server generates an access control table for each data field as an independent control object. This table does not use the entire piecework order as the smallest unit of authorization, but rather a triple of resource object, operation instruction, and subject identity as the smallest record unit. For example, the resource object can be the third field of piecework order D1001, namely the unit price field. The operation instruction can be plaintext viewing, anonymized viewing, or numerical editing. The subject identity can be determined by the job position, work group, and qualifications.

[0031] If there are four personnel: Operator A, Quality Inspector B, Statistician C, and Workshop Foreman D, the server can generate the following fine-grained permission records: For example, it can generate a first permission record containing the piece-rate quantity field F2, the plaintext viewing instruction, and the position to which Operator A belongs; a second permission record containing the unit price field F3, the anonymized viewing instruction, and the position to which the Quality Inspector belongs; a third permission record containing the wage amount field F4, the plaintext viewing instruction, and the position to which the Statistician belongs; and a fourth permission record containing the wage amount field F4, the plaintext viewing instruction, and the position to which the Workshop Foreman belongs. Through this separation, even if the Quality Inspector enters the same piece-rate sheet interface, he can only see the fields that are allowed, and cannot indirectly see the wage amount through menu permissions.

[0032] Based on this, the server builds a hierarchical permission rule base; the bottom layer first writes the above permission correspondence table, and then overlays function-level, data domain-level, record-level and field-level rules, and configures conflict handling logic; function-level rules are used to control whether access to the stamping work reporting page is allowed; data domain-level rules are used to control whether access to the data domain of stamping line 1 is allowed; record-level rules are used to restrict access to only the records of this shift; and field-level rules directly control whether the wage amount is visible.

[0033] When multiple levels give different judgments on the same request, the server calls the conflict handling logic to obtain the final result. For example, statistician C has field-level permission to view salary amounts in plain text, but the data record requested in the current request belongs to a historical month after the account is closed. The record-level rule stipulates that only querying is allowed and modification is prohibited after the account is closed. Therefore, the system directly intercepts the request to modify the salary amount and only retains the query result.

[0034] When the server receives an operation request, it first performs basic permission verification. The basic permission verification can be performed in order from coarse to fine: verify whether the subject can enter the menu, determine whether it belongs to the accessible data domain, check whether the record is within the allowed range, and confirm whether the corresponding operation is available for the target field. If any of the conditions are not met, the request is directly rejected, and the rejection level can be marked in the log. If the basic permission verification passes, the current environment attributes are further extracted and the environment risk value is calculated.

[0035] Here's a numerical calculation example: Suppose statistician C views salary amounts during normal daytime hours on a fixed terminal in the statistics office. The calculated environmental risk value is 1.2, while the sensitivity value of the salary amount field is 5, corresponding to a security threshold of 2. Since 1.2 is less than 2, the server allows plaintext viewing. If the same statistician accesses the same field at night through a non-fixed terminal, the environmental risk value rises to 3.6. Since 3.6 is greater than or equal to 2, the server performs a downgrade operation, rewriting the plaintext viewing to de-identified viewing or hiding the field, and generating an abnormal permission audit record.

[0036] In step S5, the administrator writes individual authorizations through the matrix configuration interface. This interface can use job positions or work groups as rows, processes, data types, or fields as columns, with cross nodes corresponding to selectable operation permissions. When the server detects a change in the selection, it does not simply overwrite the original rules, but writes the changed content into the incremental area of ​​the rule base and records the operator's account, operation time, reason for change, and differences before and after. Thus, when temporary transfers, shift replacements, or abnormal audits occur in the workshop, field-level permission adjustments can be quickly completed while maintaining a complete traceability chain.

[0037] Regarding the exception handling mechanism, if the server fails to identify the sensitivity level of a newly emerging field in step S1, the field can be placed in the field set to be reviewed and access restrictions will be imposed at a higher level than ordinary fields by default, so as to avoid the new field being in a security risk of being unrestricted in the early stage of its launch.

[0038] If the current environmental attribute collection is incomplete, such as the scheduling system being temporarily unavailable or the production line status interface returning late, the system can enable the default risk control mode: high-sensitivity fields will be directly downgraded for display, low-sensitivity fields will be allowed read-only access, and the missing environmental attribute flag will be added in the background; if the matrix configuration interface fails to write, the old version of the rules will be retained to continue to take effect, so as to avoid the lack of authorization control due to the half-write state.

[0039] During the daytime production process on the No. 1 stamping line of a certain auto parts company, operator Zhang submitted piecework order D1001, and the system recorded a piecework quantity of 300 pieces. Quality inspector Li viewed the order and could only see the quantity and pass rate, with the unit price per piece displayed as ***. After the shift, statistician Wang calculated wages on the fixed industrial control computer in the statistics room and could view the wage amount in plain text.

[0040] When Wang accessed his salary again after get off work via a mobile terminal outside the factory area, the system automatically downgraded the display due to the increased environmental risk value and generated an abnormal audit record. The next day, because the workshop director approved a special review, the administrator temporarily selected the review permission for a specific work group to a certain process's salary field in the matrix interface, and the system simultaneously recorded the differences before and after the change and the reasons for approval.

[0041] The purpose of this step is to refine the traditional order-level and menu-level authorization into field-level, scenario-based, and dynamic control, thereby achieving both the availability of piecework reporting data on the production site and the isolation and protection of sensitive pay information.

[0042] Further, step S1 specifically includes: the main attribute set includes: the operator's job code, skill level, work group, and process qualification; the resource attribute set includes: the data type of the work report, the piecework status, and the sensitive identifiers of the data fields; the sensitive identifiers define the piecework quantity, unit price, and wage amount in a hierarchical manner; the environmental attribute set includes: the current work report terminal network address, the deviation between the current operation time and the scheduled time, and the production line operation status.

[0043] This embodiment provides a refined modeling mechanism for the composition of attribute sets. Specifically, in the aforementioned workshop scenario, simply distinguishing between subjects with and without access permissions may not be sufficient, because two statisticians may have different qualifications, one with payroll calculation qualifications and the other only with report export qualifications. If the subject attributes are too coarse, it will result in insufficient authorization granularity. Therefore, this embodiment further writes the three types of attributes—subject, resource, and environment—into a unified attribute table in a structured manner.

[0044] The specific processing procedure is as follows: The main attribute set includes at least the job code, skill level, work group, and process qualification; the job code is used to identify the basic identity, such as the operator code for operators, the quality inspector code for quality inspectors, and the statistician code for statisticians; the skill level is used to describe the capability boundary for processing highly sensitive data, such as level one, level two, and level three; the work group is used to isolate early shifts, late shifts, or specific production line work groups; the process qualification is used to confirm whether the applicant is qualified to report work for processes such as stamping, welding, or packaging.

[0045] For ease of understanding, three individuals can be defined: Zhang's main attributes are configured as a combination of operator job code OP, skill level L1, day shift team of Line 1, and stamping material loading qualification; Li's main attributes are configured as a combination of quality inspector job code QC, skill level L2, day shift team of Line 1, and first inspection qualification; Wang's main attributes are configured as a combination of statistician job code ST, skill level L3, statistics team, and payroll calculation qualification. In this way, for the same action of viewing piecework sheets, the system can make different judgments based on the four attribute dimensions.

[0046] The resource attribute set includes at least the work report data type, piecework status, and sensitive identifiers for data fields; the work report data type can be divided into real-time production work report, rework work report, scrap work report, and wage calculation related data; the piecework status can be divided into draft, submitted, approved, and closed; and the sensitive identifiers are directly attached to the field layer.

[0047] In a specific example, the piece count field can be set to Level 1 sensitivity, the unit price per piece to Level 4 sensitivity, and the wage amount to Level 5 sensitivity. The classification here can be implemented using a database dictionary table, for example, by storing the field names and their corresponding sensitivity levels, which can be directly called during subsequent dynamic evaluations without needing to be re-judged in each request.

[0048] The environmental attribute set includes the current reporting terminal network address, the deviation value between the current operation time and the scheduled time, and the production line operation status; the terminal network address is used to identify whether the current request comes from a fixed industrial control computer, a mobile terminal in the factory area, or an external network; the time deviation value is used to quantify whether the operation occurred within the current shift window; the production line operation status is used to identify the status of normal production, waiting for materials shutdown, maintenance shutdown, etc.

[0049] In one specific implementation: if the day shift schedule is from 08:00 to 16:00 and the current access time is 15:30, the deviation value can be recorded as 0; if the access time is 18:30, the deviation value can be recorded as 2.5 hours; if the production line is in a maintenance shutdown state, even if a person originally has viewing permissions, the system can increase the risk in subsequent assessments.

[0050] Regarding the fault tolerance mechanism, if an operator lacks the process qualification field, the system can first process it according to the minimum qualification and restrict its editing permissions for sensitive fields; if a field has not yet completed the sensitive identification configuration, it will default to the pending classification state and be displayed externally in a desensitized or hidden manner; if the terminal network address cannot resolve its network location, it can first be processed as a non-fixed terminal to prevent bypassing risk control by taking advantage of address resolution anomalies.

[0051] During the day shift on the No. 1 stamping line, Zhang submitted the shift's output through a fixed industrial control computer. The system identified his job code as OP, skill level as L1, shift as the No. 1 day shift, and qualification as stamping material handling; the corresponding resource was real-time output reporting, status as draft, and the sensitivity level of the piecework quantity field was 1; the current operation time was within the scheduled shift, the network address was a fixed terminal on the workshop intranet, and the production line status was normal.

[0052] Based on these attributes, the system allows him to fill in the piecework quantity, but does not display the unit price and wage amount fields; later, when Li viewed the same record as a quality inspector, because he had the qualification for first inspection but not the qualification for wage calculation, the system continued to allow him to view the quantity and quality fields, while displaying the unit price field in an anonymized form; the purpose of this mechanism is to clearly encode the differences between personnel, data and environment as computable attributes, so as to achieve a unified input basis for subsequent permission matching, risk assessment and anomaly handling.

[0053] Further, step S3 specifically involves: the server dividing the hierarchical permission rule base into top-down categories: function-level rules, data domain-level rules, record-level rules, and field-level rules; the hierarchical permission rule base also includes temporary unauthorized approval rules for handling emergency situations; a rejection-priority conflict handling logic is set in the hierarchical permission rule base based on field sensitivity values, and the adjudication function of the conflict handling logic is configured as follows: based on the preliminary judgment value given by traversing all rules of the current conflict, and the non-zero field sensitivity value of the corresponding active field, a weighted calculation is performed to obtain the final adjudication result; wherein, the preliminary judgment value is configured as follows: rejection corresponds to a first preset logical judgment value, and permission corresponds to a second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when a temporary unauthorized approval rule is introduced, the preliminary judgment value of the temporary unauthorized approval rule is set to a special approval value greater than 1; the conflict handling result is determined to be allowed only when the final adjudication result is greater than the preset adjudication threshold, otherwise it is rejected.

[0054] This embodiment provides a conflict resolution mechanism applicable to scenarios with multiple coexisting strategies. Specifically, in piecework reporting scenarios, if there is only a single-layer rule, ambiguity can easily arise between overall permission, partial prohibition, regular prohibition, and emergency release. For example, workshop supervisors can usually view all data, but during cross-line support or closed audit, they may be temporarily restricted by record-level or field-level rules. To avoid losing interpretability after rules from different sources overlap, this embodiment stores rules layer by layer and uses a computable decision function for unified decision-making.

[0055] The specific processing procedure is as follows: The hierarchical permission rule base includes functional, data domain, record, and field level rules from top to bottom; functional level rules are used to control whether a certain module can be accessed, for example, statisticians can access the payroll calculation interface; data domain level rules are used to control data boundaries, for example, only the No. 1 stamping line can be viewed; record level rules are used to control the record range, for example, only the unsealed records of the current day can be edited.

[0056] Field-level rules are used to control field operations. For example, salary amounts can only be viewed in plain text and cannot be edited. The server can maintain a four-level rule index in memory, with each level pointing to the applicable subject, applicable resource, and set of allowed operations. In this way, when a request arrives, the range of candidate rules can be narrowed down level by level.

[0057] In the event of an emergency, a temporary unauthorized approval rule can be written. This rule does not replace the regular rule, but participates in the same round of adjudication as an additional rule. For example, during an investigation into a sudden batch of equipment scrapping, the factory manager can authorize the audit team to temporarily view the wage amount and unit price fields of the relevant shifts in order to verify whether abnormal incentives exist. At this time, the system writes a temporary rule with a validity period, scope of application, and source of approval into the rule base.

[0058] The conflict handling logic employs a weighted calculation method based on field sensitivity. To truly reflect the rejection-first control principle and prevent allowable rules from masking security risks through sheer numbers, the pre-set adjudication threshold is not a fixed constant but dynamically linked to the total number of rules participating in the conflict assessment. The formula for calculating the adjudication threshold is configured as: T = (N - 0.5) × S; where T represents the adjudication threshold, N represents the total number of regular rules participating in the conflict, and S represents the non-zero field sensitivity value of the target field. A numerical tolerance lower bound is established by subtracting a bias constant of 0.5, ensuring that the summation result is strictly greater than the adjudication threshold if and only if the initial judgment values ​​of all regular rules participating in the conflict are allowed.

[0059] In a specific embodiment: Assume that for the field "salary amount", the sensitivity value is 5, and there are three regular conflict rules: the first rule is data domain level allow, with an initial judgment value of 1; the second rule is record level reject, with an initial judgment value of 0; the third rule is field level allow, with an initial judgment value of 1; then the cumulative result is 1×5+0×5+1×5=10; since the total number of regular rules involved in the conflict is 3, the corresponding preset adjudication threshold is dynamically set to (3-0.5)×5=12.5.

[0060] Clearly, because there is a rejection rule with an initial judgment value of 0, the final result 10 is less than the threshold of 12.5, and the system decides to reject it. This is achieved from a mathematical perspective: without special approval, as long as one layer of rules gives a rejection, its corresponding product is 0, causing the overall sum to be unable to cross the threshold. This is the principle of rejection priority.

[0061] If a temporary unauthorized special approval rule is added at this time, and its initial judgment value is set to a special approval value greater than 1, such as 3, then the new cumulative result becomes 10 + 3 × 5 = 25, which is greater than the set adjudication threshold, and the system allows the request accordingly. In this way, the system can leave a calculation trace of why the request was finally approved without destroying the original rejection rule record.

[0062] Compared to a simple "reject if there is a rejection" approach, the above mechanism is more suitable for manufacturing sites with special approval processes. In real business operations, after the accounts are closed, the data usually does not allow viewing of wage amounts. However, in cases such as internal audits, labor dispute reviews, or work-related injury suspensions for supplementary data entry, there is indeed a legitimate need to exceed authority. If the original rules are modified manually, it is not only risky but also disrupts the historical permission status. This embodiment sets a special approval value greater than 1 to mathematically distinguish special approval behavior from ordinary permission.

[0063] Regarding the exception handling mechanism, if the same field simultaneously matches multiple contradictory rules at the same level, the system can prioritize the rule with the latest timestamp and the smallest authorization granularity to participate in the accumulation, avoiding a surge in rule conflicts that could lead to distorted decision values. If a field's sensitivity value is abnormally missing, it will not be allowed to participate in ordinary accumulation and will be transferred to manual review or processed according to the highest sensitivity level. If a temporarily approved rule expires, the system will automatically invalidate it before the next evaluation request and it cannot be used again.

[0064] After the No. 1 stamping line closed its accounts at the end of the month, it was discovered that a certain team had wage amounts exceeding the preset normal range. Auditor Chen was temporarily assigned to investigate. Under normal circumstances, Chen, as an audit support staff member, only had report browsing permissions and could not view individual wage amounts. The system met the function-level and data domain-level permissions, but the record-level rules rejected the closed records, and the field-level rules rejected the wage amounts. Therefore, the cumulative result was lower than the threshold.

[0065] The factory manager issued a special approval rule in the system that was only effective for 24 hours for the night shift record sealing of the No. 1 stamping line in April 2024, with the special approval value set at 3. When Chen accessed the system again, the cumulative value exceeded the threshold, and the system allowed him to view the relevant fields and noted in the audit log that this release was due to the special approval rule rather than the regular permission. The purpose of this mechanism is to transform multi-level policy conflicts into a unified adjudication process that is traceable, calculable, and temporarily overridable, so as to achieve strict control of sensitive fields while taking into account the operability of emergency business processing.

[0066] Further, step S4 specifically involves: pre-configuring the system's global security constant, risk weight coefficient, and the network address of the workshop's fixed industrial control computer; the server combines the network address of the workshop's fixed industrial control computer, the current work reporting terminal's network address, the production line's operating status, the deviation between the current operation time and the scheduled time, and the risk weight coefficient to construct an environmental risk assessment model and output the environmental risk value.

[0067] This embodiment provides a runtime environment risk assessment and permission downgrade mechanism. Specifically, even though the aforementioned hierarchical rules can determine whether something is theoretically permissible, there may still be situations where the rules allow it but the current environment is insecure. For example, a statistician may have permission to view salary amounts, but if they access the information outside of their shift, via a mobile terminal, and while the production line is shut down for maintenance, continuing to display the information in plaintext will increase the risk of data leakage. Therefore, this embodiment adds an environmental risk assessment after the basic authorization is approved.

[0068] The specific processing procedure is as follows: The system pre-configures global security constants, risk weight coefficients, and fixed industrial control computer network addresses in the workshop; the global security constant can be uniformly set to 10 to convert different sensitivity fields into different thresholds; the risk weight coefficient is used to amplify or compress the risk level; the risk weight coefficient is automatically retrieved by the system based on the business time period attribute of the current operation, the risk weight coefficient corresponding to the core production period is 1, and the risk weight coefficient corresponding to the non-production period or the end-of-month closing period is greater than 1.

[0069] A list of fixed industrial control computer network addresses is used to identify trusted terminals. To avoid the technical defect that causes the overall product to directly become zero due to the ideal extreme value of a single dimension parameter in the multiplication calculation, such as a deviation value of 0, the deviation value and various coefficients are preset with non-zero base values ​​before participating in the multiplication.

[0070] Specifically, the deviation between the current operation time and the scheduled shift time is quantified as the sum of a constant 1 and the actual deviation time. For ease of understanding, in a specific embodiment, assuming the sensitivity value of the salary amount field is 5, the safety threshold is 10 ÷ 5 = 2. The environmental risk value R is calculated according to the formula: ;in, This is the ratio of the actual deviation between the current operating time and the scheduled time to the preset baseline unit time. In other words, it is the dimensionless deviation coefficient. Quantization value for network location identifier, This is the production line status anomaly coefficient. It is the risk weighting coefficient; if and only if hour, The system uses the field sensitivity conversion security threshold to determine if the current environment meets security conditions; if the current access comes from a fixed industrial control computer, the network location identifier quantization value is set to 1.

[0071] The current time is exactly during the shift, that is, the actual deviation is 0, and the deviation value used in the calculation is 1; the production line status is normal, and the corresponding production line status abnormality coefficient is 1; the risk weight coefficient is 1, so the environmental risk value is 1×1×1×1=1, which is less than 2. Therefore, it is determined that the current environment meets the safety conditions and the operation is allowed.

[0072] If the same person accesses the site via an external terminal 3 hours after get off work, and the actual deviation is 3, then the deviation value used in the calculation is 1+3=4. The network location identifier quantification value becomes 3, the production line status is downtime inventory, the corresponding production line status anomaly coefficient is 2, and the risk weight coefficient is still 1. Then the environmental risk value is 4×3×2×1=24, which is greater than the safety threshold of 2, and the system triggers a downgrade.

[0073] The network location identifier quantization value is set according to the network segment type to which the current reporting terminal network address belongs. The quantization value corresponding to the fixed industrial control computer network segment is 1, and the quantization value corresponding to the mobile terminal or external network segment is greater than 1. The production line status anomaly coefficient is obtained based on the production line operation status dictionary. The anomaly coefficient corresponding to the normal production status is 1, and the anomaly coefficient corresponding to the shutdown or maintenance status is greater than 1.

[0074] Downgrading is not a blanket rejection, but rather a differentiated approach based on the subject's skill level. If the subject's skill level is higher than the preset level, such as a statistics supervisor or audit manager at level L3 or above, the system will force the plaintext viewing in the original operation instruction to be changed to de-identified viewing. The field will still be displayed in place, but the content will be masked or partially hidden. The preset level is set as the minimum skill certification threshold in the system's hierarchical permission rule base that allows de-identified viewing of highly sensitive data fields.

[0075] If the main skill level does not meet the threshold, such as ordinary operators or low-level statisticians, the data field is directly hidden and the field value is not returned on the interface; this can maintain necessary business continuity when the risk increases, while avoiding the complete exposure of sensitive content.

[0076] Compared to the aforementioned basic scheme, the additional environmental assessment features here are mainly to address the difficulty of static authorization in covering dynamic parameter changes in environmental attributes such as changes in access time, access location, and production line status. In particular, when temporary secondment to the workshop, night shift overtime, and equipment maintenance occur simultaneously, it is difficult to accurately reflect access risks by relying solely on the identity of the subject. By incorporating time deviation, network location, and production line status into the calculation, the same subject can obtain different final display results in different environments.

[0077] Regarding the anomaly handling mechanism, if the network location identifier cannot be quantified, for example, if the mobile terminal is in a newly accessed network segment, the system can first assign a high-risk default value; if the production line status interface returns an anomaly, it can be handled in a conservative manner with an anomaly coefficient not lower than the normal coefficient; if the skill level field is missing, it is considered that the preset level has not been reached, and the hiding strategy is directly adopted; if a field sensitivity value of 0 is encountered when calculating the security threshold, it means that the field is not a sensitive field, and the system can skip this downgrade process and only perform basic access control.

[0078] On the end-of-month payroll calculation day, statistician Wang checked the day shift pay amount for stamping line No. 1 on the fixed industrial control computer in the statistics room at 15:00. Since it was within the scheduled shift time, the actual time deviation was 0, and the basic deviation value after multiplication was 1. The environmental risk value was calculated to be 1, which was lower than the safety threshold of 2. The system then released the data in plaintext.

[0079] At 7:30 PM, Wang accessed the same field again on his laptop outside the factory area. At this time, the actual shift schedule deviation was 3.5, the deviation value calculated was 4.5, the network location identifier quantification value was 3, and the abnormal coefficient of the production line status due to maintenance shutdown was 2. The risk value after multiplication was significantly higher than the threshold. Since Wang's skill level was L3, which was higher than the preset L2, the system changed the salary amount to be viewed in an anonymized manner.

[0080] Meanwhile, if Zhang, an ordinary operator in the same shift, tries to view the field via his mobile phone, the system will directly hide the wage amount field and record it in the permission abnormality audit log because his skill level is only L1. The purpose of this mechanism is to make the permission result depend not only on whether it is possible, but also on whether it is appropriate at this time and place, so as to achieve dynamic protection of highly sensitive piece-rate pay data.

[0081] Further, step S5 specifically involves: the matrix configuration interface being presented as a cross matrix of rows and columns, with rows representing job positions or work groups, and columns representing processes, data types, or specific data fields; the server receiving the selection operation of the nodes in the cross matrix in the matrix configuration interface and writing a separate authorization instruction; based on the preset permission change audit and traceability mechanism, recording the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change.

[0082] This embodiment provides a matrix-based authorization configuration mechanism that is easy for workshop administrators to operate directly. Specifically, in the aforementioned scheme, although the system is already able to evaluate field-level permissions, if developers need to modify the backend rules every time personnel are seconded, work groups are adjusted, or special reviews are conducted, the operational steps and computational complexity of the system implementation and configuration process will increase significantly. Therefore, this embodiment further provides a visual matrix interface, enabling non-developers to complete individual authorizations under controlled conditions.

[0083] The specific processing procedure is as follows: The matrix configuration interface is presented in a row × column format; rows can be selected as positions or work groups, such as operators, quality inspectors, statisticians, day shift on Line 1, and night shift on Line 2; columns can be selected as processes, data types, or specific fields, such as stamping, welding, real-time work reporting, wage amount, and unit price; each cross node corresponds to a set of optional operation permissions, such as view, de-identified view, edit, and prohibit.

[0084] For ease of understanding, a 3×4 configuration matrix can be constructed: three rows represent operators, quality inspectors, and statisticians, and four columns represent piecework quantity, pass rate, unit price, and wage amount; by default, the statistician row has the wage amount column checked for plaintext viewing, the quality inspector row has desensitized viewing, and the operator row has prohibited viewing; every change in the administrator's selection on the interface is converted into a structured authorization instruction and written into the rule base.

[0085] The writing process can include three sub-actions: first, reading the original state of the current node; second, generating the target state after the change; and third, calculating and persisting the differences before and after. For example, if an administrator changes the permission for viewing the day shift × salary amount on Line 1 from prohibited to anonymized, the system can generate an incremental instruction that points to a specific shift, a specific field, and a specific operation, without having to rewrite the entire permission table. This reduces the risk of configuration overwrite and preserves an independent trace of each change.

[0086] Compared to the basic solution, this additional feature mainly solves the implementation problem when temporary business changes are rapid and permissions are frequently adjusted; without a graphical matrix, authorization delays can easily occur in the workshop during line changeovers, shift support, or anomaly reviews due to the disconnect between the approval chain and technical implementation; through node selection and differentiated writing, configuration instructions can be directly generated by triggering node status changes, thereby achieving real-time updates of permission rule status.

[0087] Regarding fault tolerance mechanisms, if an administrator selects mutually exclusive operations on the same interface, such as setting plaintext viewing and prohibition for the same node, the system can perform front-end verification before submission, retaining only the higher-priority restrictive option, or prompting that only one of the two must be selected; if there are too many matrix nodes, the system can load them in pages by process and shift to avoid single rendering failures; if the reason for the change is not filled in, the system can refuse to submit authorized modifications to highly sensitive fields to ensure the integrity of the audit chain.

[0088] After the statistician on the No. 1 stamping line took a temporary leave during the night shift, the workshop director arranged for Wang, the statistician on the day shift, to cross-shift to support the night shift pay review. The administrator selected the night shift statistics support group in the matrix interface, then selected the pay amount column, changed the node from prohibited to de-identified viewing, and filled in the reason for the change: temporary night shift replacement. The permission was valid for 8 hours.

[0089] The system immediately generates the corresponding authorization instruction, and records the operation account, change time, and the difference between the node being prohibited and viewed in anonymized form. After the shift ends, the administrator unchecks the box again, and the system generates a recovery instruction and retains the second change record. The purpose of this mechanism is to provide a low-threshold, traceable, and low-overwrite-risk permission configuration entry point, thereby enabling rapid adjustment and full-process traceability of authorization for sensitive fields in piecework reporting.

[0090] The piece-rate reporting data security operation processing system based on role-based access control includes the following modules: a basic information collection module, used to acquire basic data for piece-rate reporting business, establish subject attribute sets, resource attribute sets, and environment attribute sets; identify sensitive data fields in the basic data, and assign corresponding non-zero field sensitivity values ​​to sensitive data fields; a permission mapping table generation module, used to treat data fields in the basic data as independent control objects, and generate a permission mapping table containing resource objects, operation instructions, and subject identities based on the subject attribute sets and resource attribute sets; and a hierarchical rule management module, used to configure a hierarchical permission rule base, store the permission mapping table as the underlying rules in the hierarchical permission rule base, and set permission conflicts in the hierarchical permission rule base. The system includes several modules: a handling rule module and a permission assessment module. The permission assessment module receives operation requests for piecework data, performs basic permission checks based on the permission mapping table and the hierarchical permission rule base. If the basic permission check passes, it extracts the current environment attributes corresponding to the operation request based on the environment attribute set, calculates the environment risk value, and determines the security threshold based on the non-zero sensitivity value of the data field corresponding to the operation request. If the environment risk value is less than the security threshold, it performs a release operation; if the environment risk value is greater than or equal to the security threshold, it performs a downgrade operation and generates a permission anomaly audit record. The authorization configuration module writes individual authorization instructions for sensitive data fields to the hierarchical permission rule base through a preset matrix configuration interface and records permission change audit traceability information.

[0091] This embodiment provides a systematic device architecture for implementing the aforementioned method, such as... Figure 2 As shown; specifically, the system can be deployed between the manufacturing execution system server, the database server, and several workshop terminals, and uses a modular collaborative approach to handle the collection, modeling, rule management, runtime adjudication, and authorization configuration of piecework reporting data.

[0092] The specific processing procedure is as follows: The basic information collection module is responsible for aggregating data from multiple sources, including personnel master data, job information, shift information, process qualifications, work order data, production line status, and terminal network information.

[0093] This module can update attribute data in two ways: timed synchronization and event triggering. For example, it can synchronize the production line status table every 5 minutes and collect the terminal network address and operation time in real time when personnel log in and submit work reports. After the collected data is cleaned, it forms a main attribute set, a resource attribute set, and an environmental attribute set, and writes sensitivity values ​​to sensitive fields.

[0094] The permission mapping table generation module is used to break down the entire authorization into field authorizations. After reading the subject attributes and resource attributes, this module generates a mapping record containing resource objects, operation instructions, and subject identities, and caches it in the high-speed query area. In one specific implementation, the field identifier, operation code, and subject tag can be combined into an index key for fast matching at runtime. For example, when the field identifier is four, the operation code is "allow plaintext viewing", and the subject tag is "level three statistician", it corresponds to a basic mapping that allows plaintext viewing.

[0095] The hierarchical rule management module is responsible for storing and maintaining multi-level policies. Internally, the module can be divided into a rule storage unit, a rule index unit, and a conflict resolution unit. The rule storage unit stores function-level, data domain-level, record-level, and field-level rules. The rule index unit builds an inverted index according to subject, process, team, field, and validity period. The conflict resolution unit performs the final decision after detecting multiple matching rules. Through this division of labor, the system can support large-scale rule persistence while maintaining runtime query efficiency.

[0096] The permission assessment module is the core of the runtime. This module receives user requests for viewing, editing, and submitting, first calls the basic mapping and rule base to perform basic permission verification, and then retrieves environment attributes to perform risk assessment. If the result is safe, it returns a permission instruction; if the result exceeds the threshold, it outputs the downgrade result and the abnormal audit content.

[0097] This module can also agree on return codes with the front-end interface. For example, a code that allows plaintext means plaintext display, a code that allows de-identification means de-identification display, and a code that refuses to hide means hiding the field. In this way, the front-end does not need to understand complex rules and only needs to render the interface according to the return code.

[0098] The authorization configuration module serves as the management entry point and is directly connected to the hierarchical rule management module. After the administrator selects a node on the matrix interface, the authorization configuration module converts the change into a rule writing instruction and writes it to the audit log simultaneously. If the configuration involves highly sensitive fields, an approval status field can be added, and the configuration will officially take effect after confirmation by the superior.

[0099] Regarding the fault tolerance mechanism, if the basic information collection module loses connection with the external scheduling system for a short period of time, the data from the most recently successfully synchronized system can continue to be used and its timestamp can be marked. If the permission mapping table generation module encounters an unknown field, it will first add it to the configuration queue and not directly open access.

[0100] If the hierarchical rule management module reads a rule with an incorrect format, the system can refuse to load the rule and retain the old version; if the permission assessment module times out under high concurrency, it will return a conservative result for highly sensitive fields and provide basic judgment output for ordinary fields within a preset time window based on the most recent stable judgment result; if the authorization configuration module receives duplicate submissions, it will use idempotent keys to remove duplicates and prevent the same authorization from being written repeatedly.

[0101] During the daytime production process of the No. 1 stamping line, the basic information acquisition module discovers the newly generated piecework order No. 1001 in the work report table of the manufacturing execution system, and simultaneously obtains Zhang's job position, team and qualification information; based on this, the permission mapping table generation module establishes a mapping for Zhang that allows him to edit the piecework quantity but not the unit price of a single piece.

[0102] The hierarchical rule management module also retains record-level rules that are not editable for closed accounts. When Wang opens the piecework order in the statistics room, the permission assessment module first determines that he is qualified to view the salary field, then calculates the risk value based on the current network address and shift schedule, and finally allows viewing in plaintext. Subsequently, the workshop director adds a temporary substitute shift authorization on the matrix interface through the authorization configuration module, and the system simultaneously completes the rule writing and log tracking. The purpose of this system is to implement field-level permission control and environment-aware adjudication into a deployable software architecture, thereby achieving stable, secure, and traceable processing of piecework reporting data on the manufacturing site.

[0103] Furthermore, the basic information collection module is specifically used for: establishing a main attribute set, which includes: the operator's job code, skill level, work group, and process qualification; establishing a resource attribute set, which includes: the data type of the work report, the piecework status, and sensitive identifiers for data fields; the sensitive identifiers are used to define the piecework quantity, unit price, and wage amount in different levels; and establishing an environmental attribute set, which includes: the current work report terminal network address, the deviation between the current operation time and the scheduled time, and the production line operation status.

[0104] This embodiment provides a detailed implementation of a basic information collection module. Specifically, if the system only collects personnel information and work reporting information in a general way, it is difficult to support field-level strategies in workshops with multiple shifts and multiple processes running in parallel. Therefore, this embodiment further limits what the module collects, how it organizes the information, and how it updates the information.

[0105] The specific processing procedure is as follows: The main attribute set can be formed by combining the personnel master data table and the real-time login context; the personnel master data table provides job code, skill level and process qualification, and the real-time login context provides the current work group or current secondment relationship; when personnel log in, the module first reads the static attributes and then overlays the current work group information to form a main snapshot that can be used for this session; this can avoid the problem that personnel have been seconded but their permissions are still calculated according to the original work group.

[0106] Resource attribute sets can be jointly established using piecework reports, process configuration tables, and field dictionary tables. When reading a piecework report, the module must not only identify whether it is a real-time report or a rework report, but also its current status: draft, approved, or closed. Meanwhile, the field dictionary table has pre-defined sensitivity markers, such as marking piecework quantity as Level 1 sensitivity, unit price as Level 4 sensitivity, and wage amount as Level 5 sensitivity. The module can automatically compare the dictionary table each time a new field is added. If a field is found to be unregistered, it is moved to the queue for marking.

[0107] The environmental attribute set is obtained through terminal access information, system clock, and production line monitoring interface. The terminal access information provides the network address, the system clock and the shift schedule jointly calculate the deviation value, and the production line monitoring interface returns the operating status. In order to make the data directly usable for subsequent evaluation, the module can uniformly convert these heterogeneous data sources into standardized session attribute records. For example, a single access will create a session item with terminal network address = 10.10.1.20, deviation value = 0, and status = normal operation.

[0108] Regarding the fault tolerance mechanism, if a person has not completed the skill level certification, the module can first mark it as the lowest level; if the piecework status field is missing, high-risk editing is not allowed by default; if the production line status interface times out, the environment attribute set can be filled with an unknown status for the subsequent evaluation module to handle according to conservative logic; in this way, even if the external system is temporarily incomplete, it will not lead to the loss of control over sensitive permissions.

[0109] At 08:15 on the morning shift of the No. 1 stamping line, Zhang logged into the work reporting terminal on the industrial control computer; the basic information collection module read that his job code was operator, skill level L1, his work group was the day shift of the No. 1 line, and his process qualification was stamping material loading.

[0110] Simultaneously, the current piecework order type is identified as real-time reporting, status as draft, with the piecework quantity field classified as Level 1 sensitive and the wage amount as Level 5 sensitive; the environmental attributes are recorded as fixed terminal network address, deviation value of 0, and production line status as normal; later, when Li logs into the quality inspection terminal, the system generates another snapshot of the main body for subsequent differentiated authorization; the purpose of this module is to organize the discrete information of people, orders, and on-site status into unified attribute inputs, so as to enable subsequent modules to perform stable and precise permission calculations.

[0111] Furthermore, the hierarchical rule management module is specifically used to: divide the hierarchical permission rule base from top to bottom into: function-level rules, data domain-level rules, record-level rules, and field-level rules; the hierarchical permission rule base also includes temporary unauthorized special approval rules for handling emergency situations; set up a rejection priority conflict handling logic based on field sensitivity values ​​in the hierarchical permission rule base, and configure the adjudication function of the conflict handling logic as follows: based on the preliminary judgment value given by traversing all rules of the current conflict, and the non-zero field sensitivity value of the corresponding field, the final adjudication result is obtained by weighted calculation; wherein, the preliminary judgment value is configured as: rejection corresponds to the first preset logical judgment value, and permission corresponds to the second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when a temporary unauthorized special approval rule is introduced, the preliminary judgment value of the temporary unauthorized special approval rule is set to a special approval value greater than 1; the conflict handling result is determined to be allowed only when the final adjudication result is greater than the preset adjudication threshold, otherwise it is rejected.

[0112] This embodiment provides an internal working method for a hierarchical rule management module. Specifically, in the early stages of system deployment, the number of rules is usually small, and simple priority is sufficient. However, as the workshop expands to multiple production lines, multiple shifts, month-end closing, special audit approvals, and other scenarios, simple sequential matching will gradually reveal its shortcomings: on the one hand, it is difficult to explain why a certain rule was rejected, and on the other hand, it is difficult to achieve emergency release without deleting or modifying the original rules. Therefore, this embodiment introduces a decision-making method that is organized by layer and weighted by field sensitivity.

[0113] The specific processing procedure is as follows: The module first classifies and stores the rules in different areas: function-level rule storage area, data domain-level rule storage area, record-level rule repository, field-level rule repository, and special approval rule repository; each rule, in addition to the subject scope, resource scope, and operation type, can also include the effective time, approval source, and applicable reason; when processing a request, the module first retrieves the matching rules from each repository, and then submits them to the adjudication unit for weighted accumulation.

[0114] In a specific embodiment, suppose Mr. Wang requests to view the salary amount field in D1001, which has a sensitivity value of 5. The four rules that are hit are: function-level allow, data domain-level allow, record-level deny, and field-level allow. According to the initial judgment value definition, each of the three allow rules is recorded as 1, and the deny rule is recorded as 0. The cumulative result is 1×5+1×5+0×5+1×5=15. If the system threshold is set to 16, the request will still be denied. At this time, even if the majority of requests are allowed, the module will still output a denial result because the cumulative result does not cross the threshold.

[0115] If the factory manager issues a special approval rule with a special approval threshold of 2.5, the new cumulative result will be 15 + 2.5 × 5 = 27.5, which is greater than the threshold of 16, so the request will be changed to allow. The original rejection rule will not be deleted in the whole process, so the subsequent audit can restore the complete chain of reasons why it should be rejected under normal circumstances but was allowed due to special approval.

[0116] The reason why this module adopts the above-mentioned adjudication structure is that in workshop scenarios, there is often a coexistence of local restrictions under general permission and legal special approvals under local restrictions. If a simple overriding is used, it is easy to forget to restore after the special approval expires. If absolute rejection is prioritized, it cannot handle approved emergency scenarios. By introducing a special approval value higher than 1, regular permission and emergency release can be clearly distinguished at the numerical level.

[0117] Regarding fault tolerance mechanisms, if too many rules are hit, the module can pre-aggregate them by field, work group, and time window to avoid slow single-time decisions; if the threshold configuration is abnormally low, it may cause almost all requests to be allowed, and the system can perform rule simulation verification before release.

[0118] If a special approval rule lacks an expiration date, it will be invalid by default to prevent the formation of a permanent channel for exceeding authority. If two different special approval rules exist for the same field, the module can prioritize the one with a higher approval level and narrower scope, while the other is only reserved for auditing.

[0119] During the end-of-month closing and review, auditor Chen needed to view the wage amounts for the three night shifts on the No. 1 stamping line. The hierarchical rule management module first identified rules from the record-level rule repository that prohibited viewing of individual wage amounts after closing the accounts, and then identified emergency rules from the special approval rule repository that allowed viewing of anonymized or plaintext information for special audit reviews within 24 hours. After the system accumulated data based on field sensitivity and special approval criteria, it determined the allowed result and marked the release as a special approval release, rather than a regular permission release. The purpose of this module is to enable hierarchical storage of complex rules, unified adjudication, and support for compliant special approvals, thereby achieving the controllable flow of highly sensitive piecework data in complex workshop organizations.

[0120] Furthermore, the permission assessment module is specifically used to: pre-configure the system's global security constants and risk weight coefficients determined based on business time period attributes, and obtain the network address of the fixed industrial control computer in the workshop; the logic for calculating the environmental risk value is as follows: determine the quantified value of the network location identifier based on the obtained network address of the fixed industrial control computer in the workshop and the network address of the current reporting terminal, determine the production line status anomaly coefficient based on the production line operating status; and determine the environmental risk value based on the deviation between the current operation time and the scheduled time, the quantified value of the network location identifier, the production line status anomaly coefficient, and the risk weight coefficient.

[0121] This embodiment provides a module-level implementation of a permission assessment module. Specifically, after system deployment, the permission assessment module is the one that directly faces user requests. Therefore, this module must not only perform authorization judgments, but also be responsible for converting environmental changes into executable display results on the front end. Without this layer, even if the rule base is fully defined, it will be impossible to dynamically respond to increased risk at the moment of access.

[0122] The specific processing procedure is as follows: The module may include a request parsing unit, a basic verification unit, an environmental risk calculation unit, a degradation decision unit, and an audit output unit; the request parsing unit is responsible for extracting the subject identifier, target field, operation type, and target record number from the Hypertext Transfer Protocol request, terminal session, or manufacturing execution system interface call.

[0123] The basic verification unit first calls the permission mapping table and rule base to filter out requests that are theoretically allowed to continue evaluation; the environmental risk calculation unit then reads the current network address, scheduling deviation value and production line status anomaly coefficient, and calculates the risk value in combination with the preset risk weight; the degradation decision unit calculates the security threshold and decides whether to return plaintext, de-identify or hide the result; the audit output unit writes the threshold-exceeding event to the log.

[0124] In one specific embodiment, the fixed industrial control computer network address is set to 10.10.1.20. If the current request comes from 10.10.1.20, the network location identifier quantization value is 1; if the request comes from an external virtual private network terminal, it can be 3.

[0125] To avoid the logical flaw of the overall environmental risk assessment model failing due to a single risk assessment dimension being zero, the time deviation value is set to a base of 1 plus the actual deviation amount when participating in the multiplication; the sensitivity value of the salary amount field is 5, corresponding to a safety threshold of 2; when Wang checks his salary amount on time during his day shift, the actual time difference is 0, so the deviation value substituted is 1, the anomaly coefficient is 1, the weight is 1, and the risk value is 1×1×1×1=1, which is lower than the safety threshold of 2.

[0126] At this point, the module directly determines that the current environment meets the safety conditions and allows the operation; if access is made through an off-site terminal at night, the actual deviation is 3, then the deviation value is 4, the network location identifier quantification value is 3, the production line status anomaly coefficient is 2, and the risk weight coefficient is 1, the risk value is 4×3×2×1=24, which is greater than or equal to the safety threshold of 2; assuming that Wang's skill level is L3, which is higher than the preset L2, the module triggers a downgrade operation to forcibly change plaintext viewing to de-identified viewing; if the requester is an L1 operator, then the data field is directly hidden and an abnormal permission audit record is generated.

[0127] Compared to the aforementioned basic system solution, this refined implementation addresses the issue of how to break down internal actions at runtime. Especially when there are many concurrent requests, processing parsing, basic verification, risk calculation, and degradation decision-making in separate units is more conducive to cache reuse and fault isolation. For example, the results of basic verification can be cached for a short time to avoid frequent database queries in the same session. Environmental risks must be calculated in real time to ensure that states such as night shift, downtime, and external network can be reflected in the adjudication results immediately.

[0128] Regarding fault tolerance mechanisms, if the risk weight coefficient is configured too high, causing most normal requests to be downgraded, the system can identify the false alarm rate through log statistics and prompt the administrator to adjust it; if the current network address happens to belong to a new unregistered fixed terminal, it can be temporarily treated as a mobile terminal, and the administrator can be allowed to add it to the list of trusted terminal network addresses later; if the audit log writing fails, the module can first return the result to the caller, and then write the log to the local buffer queue, and rewrite it after the storage is restored, so as to avoid production reporting being interrupted due to log failure.

[0129] On the afternoon of the month-end payroll review, Wang sat in front of the industrial control computer in the statistics room to check the payroll amount for the No. 1 stamping line. After parsing the request, the permission assessment module completed the basic verification and risk calculation, and returned the data for plaintext viewing. During equipment maintenance in the evening, Wang temporarily continued to check the same batch of data on his laptop in the maintenance office. The module detected that the network address no longer belonged to the fixed industrial control computer, the operation had deviated from the scheduled time, and the production line was in a shutdown state. Therefore, it returned the payroll amount for de-identified viewing. If a regular operator, Zhang, tried to access the data under the same conditions, the module would directly hide the field and report an anomaly. The purpose of this module is to link static rules with the dynamic environment to achieve real-time security adjudication at the request level and field level.

[0130] Furthermore, the authorization configuration module is specifically used for: presenting the matrix configuration interface as a cross matrix of rows and columns, with rows representing job positions or work groups, and columns representing processes, data types, or specific data fields; receiving selection operations for nodes in the cross matrix in the matrix configuration interface and writing individual authorization instructions; and recording the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change based on a preset permission change audit and traceability mechanism.

[0131] This embodiment provides a front-end and back-end collaborative implementation method for an authorization configuration module. Specifically, in a systematic deployment scenario, no matter how perfect the permission model is, if the authorization entry is not intuitive, on-site management personnel will still find it difficult to use. Therefore, this embodiment further implements the authorization configuration module into three parts: matrix interface, writing logic, and audit chain.

[0132] The specific processing procedure is as follows: The front end of the matrix interface displays the authorization status in the form of a cross table; rows can be switched between job view and team view, and columns can be switched between process view, data type view, and specific field view; node display can use three-state or multi-state icons, such as blank indicating prohibited, half color indicating de-identified viewing, full color indicating plain text viewing, and additional labels can be used to indicate editable; after the administrator clicks on a node, the front end submits the current node's original status, target status, scope of application, and reason for the remarks to the back end.

[0133] After receiving the checkbox operation, the backend first performs a legality check and then generates a separate authorization instruction. The legality check includes at least: whether the operator has management privileges, whether the target field is a highly sensitive field, whether the reason for the change is filled in, and whether it exceeds the authorized scope. After the check passes, the system converts the node change into a structured instruction. For example, for the statistical support group, stamping process, and wage amount fields, add de-identified viewing permission, valid until 08:00 the next day. This instruction will take effect after being written into the hierarchical rule base.

[0134] The audit traceability mechanism preserves the differences before and after. In a specific embodiment, if the original node status is 0, it means that the access is prohibited; if the new node status is 2, it means that the access is viewed in anonymized form. The system can record the difference 0→2. If the original status is restored the next day, the system can record 2→0. In this way, during post-event auditing, we can not only know who changed the permissions, but also see what changes occurred before and after the change, rather than just a vague record of successful modification.

[0135] Compared to simply providing a backend configuration table, this embodiment addresses the technical shortcomings of long static authorization configuration cycles and missing security audit links. Especially in the mainline scenario, there are many short-cycle authorization changes in the workshop, such as shift changes, secondments, special reviews, and closed account investigations. Without node-level difference records, it is difficult to restore the true permission status at a certain point in time. By directly converting matrix selection actions into differentiated instructions, the risk of accidental operation overwriting the entire table can be significantly reduced.

[0136] Regarding the fault tolerance mechanism, if an administrator submits the same node and the same target status twice in a row, the module can determine it as a duplicate submission and record only one valid change; if there is an unexpired temporary authorization for the same node, the interface can display the remaining validity period to avoid duplicate authorization; if the reason for the change does not match the approval number, the modification of highly sensitive fields can enter a pending confirmation state and will not take effect immediately; if the front-end display is inconsistent with the actual back-end status, the system can retrieve the latest snapshot from the rule base and correct it when loading the matrix.

[0137] In the event of a shortage of night shift statisticians on the No. 1 stamping line, the workshop director authorized Wang to support the night shift wage review across shifts. The administrator entered the matrix interface, switched to the shift view, selected the row of the night shift statistics support group and the column of the wage amount field, changed the node from prohibited to de-identified view, and filled in the temporary night shift support, which is valid for 8 hours.

[0138] After the authorization configuration module passes the verification, a separate authorization instruction is written, and the operation account, submission time, node difference, and reason for change are recorded in the audit table. After the support ends, the administrator restores the node to prohibited, and the system generates a reverse difference record again, thus fully preserving the permission lifecycle. The purpose of this module is to transform the adjustment process of complex field authorization into a visible, controllable, and auditable configuration behavior, thereby realizing the engineering implementation of sensitive data permission management in the manufacturing site.

[0139] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for securely processing piecework reporting data based on role-based access control, characterized in that: Includes the following steps: Step S1: The server obtains the basic data of piecework reporting business, establishes the main attribute set, resource attribute set and environmental attribute set; identifies the sensitive data fields in the basic data, and assigns corresponding non-zero field sensitivity values ​​to the sensitive data fields; Step S2: The server treats the data fields in the basic data as independent management objects, and generates an permission mapping table containing resource objects, operation instructions and subject identities based on the subject attribute set and the resource attribute set; Step S3: Configure the hierarchical permission rule base on the server, store the permission mapping table as the underlying rule in the hierarchical permission rule base, and set permission conflict handling rules in the hierarchical permission rule base; Step S4: The server receives an operation request for piecework reporting data, performs basic permission verification based on the permission mapping table and the hierarchical permission rule base. If the basic permission verification passes, the server extracts the current environment attribute corresponding to the operation request based on the environment attribute set, calculates the environment risk value, and determines the security threshold based on the non-zero field sensitivity value of the data field corresponding to the operation request. If the environmental risk value is less than the safety threshold, then a release operation is performed; If the environmental risk value is greater than or equal to the security threshold, a downgrade operation is performed, and an abnormal permission audit record is generated. Step S5: The server writes individual authorization instructions for sensitive data fields to the hierarchical permission rule base through the preset matrix configuration interface, and records permission change audit traceability information.

2. The method for secure operation processing of piecework reporting data based on role-based access control according to claim 1, characterized in that, Step S1 specifically involves: The main attribute set includes: the operator's job code, skill level, work group, and process qualification; The resource attribute set includes: work report data type, piecework status, and sensitive identifiers for data fields; the sensitive identifiers provide hierarchical definitions for piecework quantity, unit price, and wage amount. The set of environmental attributes includes: the current work reporting terminal network address, the deviation between the current operation time and the scheduled time, and the production line operating status.

3. The method for secure operation processing of piecework reporting data based on role-based access control according to claim 1, characterized in that, Step S3 specifically involves: The server divides the hierarchical permission rule base into: function-level rules, data domain-level rules, record-level rules, and field-level rules from top to bottom; the hierarchical permission rule base also includes temporary unauthorized special approval rules for dealing with emergency situations. In the hierarchical permission rule base, a rejection priority conflict handling logic is set up based on the field sensitivity value weighting. The adjudication function of the conflict handling logic is configured as follows: based on the preliminary judgment value given by traversing all rules of the current conflict and the non-zero field sensitivity value of the corresponding field, the final adjudication result is obtained by weighted calculation. The initial judgment value is configured as follows: reject the corresponding first preset logical judgment value, allow the corresponding second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when the temporary unauthorized special approval rule is introduced, the initial judgment value of the temporary unauthorized special approval rule is set to a special approval value greater than 1. The conflict resolution result is deemed acceptable only if the final decision is greater than a pre-set decision threshold; otherwise, it is deemed unacceptable.

4. The method for secure operation processing of piecework reporting data based on role-based access control according to claim 2, characterized in that, Step S4 specifically involves: Pre-configure the system's global security constants, risk weight coefficients determined based on business time period attributes, and the fixed industrial control computer network address in the workshop; The server combines the network address of the fixed industrial control computer in the workshop, the network address of the current reporting terminal, the production line operation status, the deviation between the current operation time and the scheduled time, and the risk weight coefficient to construct an environmental risk assessment model and output the environmental risk value.

5. The method for secure operation processing of piecework reporting data based on role-based access control according to claim 1, characterized in that, Step S5 specifically involves: The matrix configuration interface is presented as a cross matrix of rows and columns, where the rows are job positions or work groups, and the columns are work processes, data types, or specific data fields. The server receives the selection operation of the nodes of the cross matrix in the matrix configuration interface and writes the separate authorization instruction. Based on the preset permission change audit and traceability mechanism, the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change are recorded.

6. A piece-rate reporting data security operation processing system based on role-based access control, used to implement the piece-rate reporting data security operation processing method based on role-based access control as described in any one of claims 1-5, characterized in that, Includes the following modules: The basic information collection module is used to acquire basic data for piecework reporting business, establish a main attribute set, a resource attribute set, and an environmental attribute set; identify sensitive data fields in the basic data, and assign corresponding non-zero field sensitivity values ​​to the sensitive data fields. The permission mapping table generation module is used to treat the data fields in the basic data as independent management objects and generate a permission mapping table containing resource objects, operation instructions and subject identities based on the subject attribute set and the resource attribute set. The hierarchical rule management module is used to configure the hierarchical permission rule library, store the permission mapping table as the underlying rules in the hierarchical permission rule library, and set permission conflict handling rules in the hierarchical permission rule library; The permission assessment module is used to receive operation requests for piecework reporting data, perform basic permission verification based on the permission mapping table and the hierarchical permission rule base, and if the basic permission verification passes, extract the current environment attribute corresponding to the operation request based on the environment attribute set, calculate the environment risk value, and determine the security threshold based on the non-zero field sensitivity value of the data field corresponding to the operation request. If the environmental risk value is less than the safety threshold, then a release operation is performed; If the environmental risk value is greater than or equal to the security threshold, a downgrade operation is performed, and an abnormal permission audit record is generated. The authorization configuration module is used to write individual authorization instructions for sensitive data fields to the hierarchical permission rule base through a preset matrix configuration interface, and to record permission change audit traceability information.

7. The piecework reporting data security operation processing system based on role-based access control according to claim 6, characterized in that, The basic information collection module is specifically used for: Establish the subject attribute set, which includes: the operator's job code, skill level, work group, and process qualification; Establish the resource attribute set, which includes: work report data type, piecework status, and sensitive identifiers for data fields; the sensitive identifiers are hierarchically defined for piecework quantity, unit price, and wage amount. Establish the environmental attribute set, which includes: the current work reporting terminal network address, the deviation value between the current operation time and the scheduled time, and the production line operation status.

8. The piecework reporting data security operation processing system based on role-based access control according to claim 6, characterized in that, The hierarchical rule management module is specifically used for: The hierarchical permission rule base is divided from top to bottom into: function-level rules, data domain-level rules, record-level rules, and field-level rules; the hierarchical permission rule base also includes temporary unauthorized special approval rules for dealing with emergency situations. In the hierarchical permission rule base, a rejection priority conflict handling logic is set up based on the field sensitivity value weighting. The adjudication function of the conflict handling logic is configured as follows: based on the preliminary judgment value given by traversing all rules of the current conflict and the non-zero field sensitivity value of the corresponding field, the final adjudication result is obtained by weighted calculation. The initial judgment value is configured as follows: reject the corresponding first preset logical judgment value, allow the corresponding second preset logical judgment value, and the second preset logical judgment value is greater than the first preset logical judgment value; when the temporary unauthorized special approval rule is introduced, the initial judgment value of the temporary unauthorized special approval rule is set to a special approval value greater than 1. The conflict resolution result is deemed acceptable only if the final decision is greater than a pre-set decision threshold; otherwise, it is deemed unacceptable.

9. The piecework reporting data security operation processing system based on role-based access control according to claim 7, characterized in that, The permission assessment module is specifically used for: Pre-configure the system's global security constants and risk weight coefficients determined based on business time period attributes, and obtain the network address of the fixed industrial control computer in the workshop; The logic for calculating the environmental risk value is as follows: determine the network location identifier quantization value based on the obtained network address of the fixed industrial control computer in the workshop and the network address of the current reporting terminal, and determine the production line status anomaly coefficient based on the production line operating status; The environmental risk value is determined based on the deviation between the current operating time and the scheduled time, the quantified value of the network location identifier, the production line status anomaly coefficient, and the risk weight coefficient.

10. The piecework reporting data security operation processing system based on role-based access control according to claim 6, characterized in that, The authorization configuration module is specifically used for: The matrix configuration interface is presented as a cross matrix of rows and columns, where the rows are job positions or work groups, and the columns are work processes, data types, or specific data fields. The matrix configuration interface receives the selection operation of the nodes of the cross matrix and writes the separate authorization instruction. Based on the preset permission change audit and traceability mechanism, the operator's account, change time, differences in the permission correspondence table before and after the change, and the reason for the change are recorded.

Images