A plug-in dynamic management method based on a tree architecture of an organization and related equipment

Abstract

The present disclosure provides a plug-in access method based on an organization tree architecture and related equipment, the method comprising: obtaining organization information of a plug-in accesser; encoding the organization information according to a preset rule based on the organization information to obtain an access organization code; performing bitwise operation on the access organization code and a permission code of a plug-in to obtain an operation result; and in response to the operation result being consistent with the permission code, allowing the plug-in accesser to access the plug-in.

Description

Technical Field

[0001] This disclosure relates to the field of business information technology, and in particular to a plug-in access method and related equipment based on an organizational tree architecture. Background Technology

[0002] Organizational management systems commonly employ a role-based access control (RBAC) model, managing permissions through a three-tiered "user-role-permission" structure. For example, a user assigned the "administrator" role can access specific plugins. Current technology relies on manual approval processes; plugin removal or addition requires submitting applications at each level, undergoing multiple approvals, and then the administrator manually updates the database.

[0003] The existing organizational management system only supports two levels of plugin visibility control, failing to achieve more sophisticated management at multiple levels. Plugin removal and removal require approval at each level, and updating a plugin on the upper-level platform typically takes several business days to complete system-wide synchronization. Dedicated plugins for important events cannot be automatically enabled / disabled at scheduled times, relying on manual intervention. Summary of the Invention

[0004] In view of this, the purpose of this disclosure is to propose a plug-in access method and related devices based on an organizational tree architecture.

[0005] The first aspect of this disclosure provides a plugin access method based on an organizational tree architecture, including: Obtain organizational information of plugin visitors; Based on the organizational information, an access organization code is obtained by encoding it according to preset rules. The access organization code and the plugin permission code are performed bitwise to obtain the calculation result; In response to the fact that the calculation result matches the permission code, the plugin visitor is allowed to access the plugin.

[0006] A second aspect of this disclosure provides a plug-in access device based on an organizational tree architecture, comprising: The acquisition module is used to obtain organizational information of plugin visitors; The encoding module is used to encode the organization information according to preset rules to obtain the access organization code; The calculation module is used to perform bitwise operations on the access organization code and the plugin permission code to obtain the calculation result; The permission module is used to allow the plugin visitor to access the plugin in response to the fact that the calculation result matches the permission code.

[0007] A third aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in the first aspect.

[0008] In a fourth aspect, this disclosure provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method described in the first aspect.

[0009] A fifth aspect of this disclosure provides a computer program product including computer program instructions that, when executed on a computer, cause the computer to perform the method described in the first aspect.

[0010] As described above, this disclosure provides a plugin access method and related device based on an organizational tree architecture. By obtaining the visitor's organizational information and generating a unique access organization code according to preset rules, this code is then subjected to bitwise logical operations (such as AND operations) with the plugin's preset permission code. Access is granted only when the result of the operation completely matches the original permission code. This achieves fine-grained permission control, accurately matching access permissions at different levels / branches within the organizational tree. Furthermore, by replacing traditional string matching with encoded operations, it significantly improves the efficiency and security of permission verification, effectively preventing unauthorized access. It is particularly suitable for dynamic plugin access management in multi-level organizations or complex permission scenarios. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic diagram of a plugin access architecture based on an organization tree architecture according to an embodiment of this disclosure.

[0013] Figure 2 This is a schematic diagram of the structure of an exemplary electronic device according to an embodiment of the present disclosure.

[0014] Figure 3 This is a schematic flowchart illustrating the plug-in access method based on an organization tree architecture according to an embodiment of this disclosure.

[0015] Figure 4 This is a schematic flowchart illustrating the plug-in time control strategy of an embodiment of this disclosure.

[0016] Figure 5This is a schematic flowchart illustrating the plug-in access method based on an organization tree architecture according to an embodiment of this disclosure.

[0017] Figure 6 This is a schematic diagram of a plug-in access device based on an organization tree architecture according to an embodiment of the present disclosure. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0019] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0020] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0021] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0022] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0023] Figure 1 A schematic diagram of a plugin access architecture based on an organization tree architecture, according to an embodiment of this disclosure, is shown. (See reference...) Figure 1The plug-in access architecture 100 based on an organizational tree structure may include a server 110, a terminal 120, and a network 130 providing a communication link. The server 110 and the terminal 120 can be connected via a wired or wireless network 130. The server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, security services, and CDN.

[0024] Terminal 120 can be implemented in hardware or software. For example, when terminal 120 is implemented in hardware, it can be various electronic devices with a display screen and support page display, including but not limited to smartphones, tablets, e-book readers, laptops, and desktop computers. When terminal 120 is implemented in software, it can be installed in the electronic devices listed above; it can be implemented as multiple software programs or software modules (e.g., software programs or software modules used to provide distributed services) or as a single software program or software module, without specific limitations.

[0025] It should be noted that the plugin access method based on the organizational tree architecture provided in this embodiment can be executed by the terminal 120 or by the server 110. It should be understood that... Figure 1 The number of terminals, networks, and servers shown is for illustrative purposes only and is not intended to be a limitation. Any number of terminals, networks, and servers can be used depending on implementation needs.

[0026] Figure 2 A schematic diagram of the hardware structure of an exemplary electronic device 200 provided in an embodiment of this disclosure is shown. For example... Figure 2 As shown, the electronic device 200 may include: a processor 202, a memory 204, a network module 206, a peripheral interface 208, and a bus 210. The processor 202, memory 204, network module 206, and peripheral interface 208 are interconnected within the electronic device 200 via the bus 210.

[0027] Processor 202 may be a Central Processing Unit (CPU), a Neural Processing Unit (NPU), a Microcontroller (MCU), a programmable logic device, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits. Processor 202 can be used to perform functions related to the techniques described in this disclosure. In some embodiments, processor 202 may also include multiple processors integrated as a single logic component. For example, such as... Figure 2 As shown, processor 202 may include multiple processors 202a, 202b and 202c.

[0028] Memory 204 can be configured to store data (e.g., instructions, computer code, etc.). Figure 2 As shown, the data stored in memory 204 may include program instructions (e.g., program instructions for implementing the plug-in access method based on the organizational tree architecture of this disclosure) and data to be processed (e.g., the memory may store configuration files of other modules, etc.). Processor 202 may also access the program instructions and data stored in memory 204 and execute the program instructions to operate on the data to be processed. Memory 204 may include volatile storage devices or non-volatile storage devices. In some embodiments, memory 204 may include random access memory (RAM), read-only memory (ROM), optical disk, magnetic disk, hard disk, solid-state drive (SSD), flash memory, memory stick, etc.

[0029] Network module 206 can be configured to provide communication with other external devices to electronic device 200 via a network. This network can be any wired or wireless network capable of transmitting and receiving data. For example, the network can be a wired network, a local wireless network (e.g., Bluetooth, WiFi, Near Field Communication (NFC), etc.), a cellular network, the Internet, or a combination thereof. It is understood that the type of network is not limited to the specific examples described above. In some embodiments, network module 206 may include any combination of any number of network interface controllers (NICs), radio frequency modules, transceivers, modems, routers, gateways, adapters, cellular network chips, etc.

[0030] The peripheral interface 208 can be configured to connect the electronic device 200 to one or more peripheral devices to enable information input and output. For example, peripheral devices may include input devices such as keyboards, mice, touchpads, touch screens, microphones, and various sensors, as well as output devices such as displays, speakers, vibrators, and indicator lights.

[0031] Bus 210 can be configured to transmit information between various components of electronic device 200 (e.g., processor 202, memory 204, network module 206, and peripheral interface 208), such as internal buses (e.g., processor-memory bus), external buses (USB port, PCI-E bus), etc.

[0032] It should be noted that although the architecture of the above-described electronic device 200 only shows the processor 202, memory 204, network module 206, peripheral interface 208, and bus 210, in specific implementations, the architecture of the electronic device 200 may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the architecture of the above-described electronic device 200 may only include the components necessary for implementing the embodiments of this disclosure, and does not necessarily include all the components shown in the figures.

[0033] Organizational management systems commonly employ a role-based access control (RBAC) model, managing permissions through a three-tiered "user-role-permission" structure. For example, a user assigned the "administrator" role can access specific plugins. Current technology relies on manual approval processes; plugin removal or addition requires submitting applications at each level, undergoing multiple approvals, and then the administrator manually updates the database.

[0034] It is evident that the organizational structure matching granularity in the organizational management system is insufficient, resulting in low control precision. Existing technology only supports two levels of access control, failing to adapt to multi-level organizational structures, leading to a lack of control over intermediate-level plugins. This could result in sensitive plugins (such as the expense management system) being accessed by unauthorized groups. Furthermore, the manual approval process leads to low synchronization efficiency. Plugin releases require manual approval at each level; for example, each plugin approval takes an average of 6.5 hours per level, and full system synchronization takes 3 working days, causing urgent plugins (such as thematic educational learning materials) to fail to take effect promptly. The current system's polling synchronization mechanism wastes network resources, as mobile devices poll the server every 6 hours, requiring the transmission of the complete plugin package (averaging 50MB per poll) even without configuration changes, generating 35% redundant traffic. This results in a high synchronization failure rate for remote county-level organizations due to insufficient network bandwidth. Moreover, the current system's single-time control leads to significant timeliness errors. Because current plugin access relies on the mobile device's local clock to determine plugin activation time, without mandatory synchronization with the national time service center, significant time discrepancies between different devices cause inconsistent plugin start and stop times.

[0035] See Figure 3 , Figure 3 A schematic flowchart illustrating a plugin access method based on an organizational tree architecture according to an embodiment of the present disclosure is shown. The plugin access method based on an organizational tree architecture according to an embodiment of the present disclosure can be deployed on a server-side or client-side. Figure 3In the process, the plugin access method 300 based on the organizational tree architecture may further include the following steps.

[0036] In step S310, obtain the organization information of the plugin visitor.

[0037] When a plugin access request is triggered, the system can automatically extract a unique identifier from the visitor's identity credentials (such as account, token, or session information) and use this identifier to query the organizational database to obtain structured information such as the visitor's organizational path, hierarchical relationship, and role tags. Ultimately, this multi-dimensional organizational data is aggregated into a standardized organizational information object. This enables dynamic perception and precise positioning of the visitor's organizational attributes, providing a reliable data foundation for subsequent permission coding. It ensures that access control strictly matches the actual hierarchy of the organizational structure and business boundaries, while also supporting cross-system organizational data synchronization. This avoids the risk of permission invalidation or unauthorized access due to organizational changes, improving the system's adaptability to complex organizational scenarios.

[0038] In step S320, the organization information is encoded according to a preset rule to obtain the access organization code.

[0039] Based on the pre-defined hierarchical priorities in the organizational tree structure (e.g., group-department-team-role), the visitor's organizational information is mapped layer by layer to independent codes (e.g., the first level corresponds to the group code, the second level to the department code), and these codes are concatenated in priority order to form a structured access organization code, ensuring a strict correspondence between the codes and the hierarchical relationship of the organizational structure. This hierarchical coding achieves a precise digital representation of organizational location, enabling the access control system to directly match the visitor's organizational affiliation through code bitwise operations, improving the accuracy and efficiency of access verification. Simultaneously, it supports automatic code updates when the organizational structure is dynamically adjusted, ensuring the continuous effectiveness of access control.

[0040] In some embodiments, the organization information is encoded according to a preset rule to obtain an access organization code, including: The organizational information is determined to be organized at multiple hierarchical levels within the organizational tree; The access organization code is generated based on the corresponding code of each hierarchical organization according to the priority order of the hierarchical organization; The hierarchical organization includes a first level, a second level, a third level, and a fourth level with decreasing priority. The access organization code includes a first code, a second code, a third code, and a fourth code. The first code corresponds to the first level, the second code corresponds to the second level, the third code corresponds to the third level, and the fourth code corresponds to the fourth level.

[0041] Specifically, a four-level coding rule can be adopted, for example: Level 1 - 001 002 005 008 def generate_party_code(party): return f"{party.first level:03d}{party.second level:03d}{party.third level:03d}{party.fourth level:03d}" This system enables precise control over plugins across a four-tiered organizational structure. Compared to previous systems that only supported two levels of management, this system can be refined to four levels, meeting the diverse plugin management needs of different organizational levels and enhancing the system's applicability and usability.

[0042] In step S330, the access organization code and the plugin permission code are performed bitwise to obtain the calculation result.

[0043] This process involves uniformly converting access organization codes and plugin permission codes into binary format, then performing bitwise logical operations (such as bitwise AND operations). By comparing the visitor's organizational level with the plugin's preset visible level permission bits, a binary operation value containing the matching results is generated, which is finally converted to decimal as the result. This bitwise operation achieves efficient permission matching, leveraging the computer's low-level binary processing capabilities to transform complex multi-level organizational permission verification into simple bitwise operations, significantly improving verification speed (nanosecond-level response) while ensuring the accuracy of permission judgment (passing only when all visible permission bits match), effectively balancing system performance and security requirements.

[0044] In some embodiments, the method 300 further includes: The permission code is generated based on the visibility level range configured for the plugin; the visibility level range is used to indicate the visibility level organization that allows access to the plugin. The generation of the permission code based on the visibility level range configured in the plugin further includes: Based on the first preset code corresponding to the visible hierarchy organization and the second preset code of the non-visible hierarchy organization, the visible hierarchy code is obtained; Based on the visible level encoding, a corresponding binary mask is generated to obtain the permission encoding.

[0045] The plugin configures the visible hierarchy (e.g., allowed department / team levels), mapping visible organizational levels to a first preset code (e.g., binary "1") and non-visible levels to a second preset code (e.g., "0"). This visible hierarchy code is then converted into a binary mask as the permission code. During access, the visitor's organizational code is converted to a binary mask and bitwise ANDed with the permission code. If the result equals the permission code (i.e., all visible level bits are 1), access is authorized. This hierarchical binary permission control precisely matches the visible organizational range through mask operations, ensuring efficient permission verification (extremely fast bitwise operations) while supporting dynamic adjustment of the visible hierarchy (only requiring mask modification). It also prevents unauthorized access at unauthorized levels, making it particularly suitable for fine-grained permission management scenarios in multi-level organizational structures.

[0046] In some embodiments, the access organization code and the plugin permission code are bitwise operated to obtain the operation result, including: Based on the access organization code, a corresponding binary mask is generated to obtain the access organization mask; Perform a bitwise AND operation on the access organization code and the permission code to obtain a binary result; The decimal result is generated based on the binary result.

[0047] Specifically, the dynamic bitmask matching algorithm may include: def check_permission(user_code, plugin_code): # Generate a dynamic mask based on the control level set in the plugin. level = plugin_code.count('0', -3) # The number of consecutive trailing zeros indicates the level. mask = int('1' (12 - level 3) + '0' (level 3))# Dynamic truncation mask return (user_code&mask) == (plugin_code&mask) Example: If the plugin is set to "Level 1" (the last 6 bits of the encoding are 0), then the mask is 111111000000, which only matches the first 6 bits.

[0048] In step S340, in response to the calculation result being consistent with the permission code, the plugin visitor is allowed to access the plugin.

[0049] This system employs a bitwise logical operation (such as an AND operation) between the access organization code and the plugin permission code to generate a binary result, which is then converted to a decimal value. The system determines that the visitor's organizational level perfectly matches the plugin's preset visibility range only when the result of this operation completely matches the original permission code, thus triggering the authorization process to allow access. This achieves precise permission verification based on organizational level, leveraging the efficiency of binary bitwise operations (millisecond-level response) to ensure accurate permission judgment. Simultaneously, numerical consistency checks prevent partial matches or unauthorized access, ensuring the security of plugin resources while avoiding performance bottlenecks that may arise from traditional string matching. This approach is particularly suitable for high-frequency permission verification scenarios in large-scale organizational structures.

[0050] In some embodiments, method 300 further includes: Configure the effective time period of the plugin, which includes a single effective time period or a periodic effective time period; If the current time falls within the specified valid time period, the plugin is allowed to start. If the current time is outside the specified valid time period, the plugin startup is denied.

[0051] Specifically, by configuring a valid time period for plugins to execute once (a fixed time point accurate to the second) or cycle repeatedly (repetitive rules defined based on Cron expressions), the system verifies in real time whether the current time falls within this range when the plugin starts. If the current time is within the valid time period, the plugin loading process is triggered; if it exceeds the valid time range, the startup request is directly blocked and a permission denial prompt is returned. The effect is to achieve fine-grained control over plugin access in terms of time, supporting both timed triggering of temporary tasks (such as single data synchronization) and automated execution needs of periodic business (such as monthly report generation). Simultaneously, real-time time verification prevents unauthorized use during unauthorized periods, effectively improving system security and resource utilization.

[0052] Specifically, such as Figure 4 As shown, Figure 4 This is a schematic flowchart illustrating the plug-in time control strategy of an embodiment of this disclosure. Figure 4 In Cron, single execution: set the time point to the second (e.g., 2024-07-01 08:00:00); periodic loop: define rules through Cron expressions (e.g., 0 8 1). The question mark (?) indicates 8:00 AM on the 1st of each month. Time verification can initially be based on the national time service model, for example, prioritizing connection to ntp.ntsc.ac.cn to obtain Beijing time, with an error range of ±1 second (compliant with GB / T 33601-2017 standard). When the error range of the national time service model exceeds 1 second, a local compensation mode (disaster recovery) is adopted, for example: def compensate_time(): historical_error = get_historical_offset() # Get the average error over the last 7 days return local_time() + historical_error 0.8# Smoothing coefficient 0.8 In practical applications, the plugin's activation conditions can be met simultaneously: current time ≥ activation time and current time ≤ end time. For exception handling, the reason for failure can be recorded (e.g., NTP unavailable, local compensation error + 2.3 seconds), and / or, the administrator can be notified via message queue (email / SMS).

[0053] In some embodiments, method 300 further includes: In response to receiving national time information, the current time is determined; In response to the number of times the error between the current time and the local time is outside the preset error range reaching a preset number, the current time is determined based on the local time; Determining the current time based on the local time includes: Obtain historical national time information and historical local time information within a preset time period; Based on the historical national time information and the historical local time information, the average historical error within the preset time period is obtained; The current time is obtained based on the local time and the first proportion of the average historical error.

[0054] The system prioritizes obtaining standard time from the national time service (such as NTP) as the current time reference. When the error between the local time and the national time service exceeds a preset threshold multiple times consecutively, it automatically switches to local compensation mode. By analyzing historical time service deviation data within a preset time period, it calculates the average historical error and generates the corrected current time based on a weighted average of this error (e.g., 80% weight) added to the local time. This achieves dual-mode time synchronization and dynamic error compensation, ensuring high-precision time service (compliant with national standards) in daily scenarios while smoothly correcting the local time using historical error data in case of network anomalies or time service failures. This avoids business anomalies caused by time drift and significantly improves the system's time availability and fault tolerance, making it particularly suitable for time-sensitive scenarios such as financial transactions and industrial control. Specifically, in standard mode, it connects to the National Time Service Center (NTP) to achieve ±1-second synchronization; in disaster recovery mode, it uses a local clock compensation algorithm with an error of <±200ms / day.

[0055] public void scheduleTask(LocalDateTime executeTime) { if (NTP.isAvailable()) { NTPClock.schedule(executeTime); } else { LocalClock.compensateSchedule(executeTime); / / Predict based on historical deviation } }

[0056] Table 1 As can be seen, the method disclosed herein significantly shortens the synchronization time of the plugins. Employing a hierarchical synchronization strategy and an efficient compression algorithm, as shown in Table 1, the synchronization time of the entire system is drastically reduced from the original 3 working days to within 15 minutes, improving system response speed and user experience. Furthermore, the method disclosed herein also achieves automated timed start and stop of the plugins. Combined with the high-precision time management of the BeiDou time synchronization system, this disclosure can ensure that plugins for important organizational activities are automatically activated or deactivated at predetermined times, with errors controlled within ±1 second, greatly reducing the burden of manual operation and improving management efficiency.

[0057] In some embodiments, method 300 may further include at least one of the following: In response to the discrepancy between the calculation result and the permission code, the plugin visitor is denied access to the plugin; In response to the unavailability of the national time synchronization information or the average historical error exceeding the error threshold, an anomaly is determined to have occurred, and the anomaly information is recorded. The exception information was generated via the message queue.

[0058] Specifically, when the bitwise operation result between the access organization code and the plugin permission code does not match, the system immediately blocks the access request and returns a rejection response. Simultaneously, if the national time service is unavailable or the historical error compensation value of the local time exceeds the security threshold, it is determined to be a time synchronization anomaly. The system automatically captures key information such as the anomaly type and occurrence time, and asynchronously sends the anomaly log to the monitoring center for alarm analysis via a message queue (such as Kafka / RabbitMQ). This constructs a dual-dimensional security protection system of permissions and time, preventing unauthorized access through real-time permission verification and promptly detecting time tampering or time synchronization failure risks through an anomaly detection mechanism. The message queue decouples the anomaly handling process, ensuring that the system can stably record anomaly data even under high-concurrency scenarios, providing reliable evidence for operation and maintenance audits and security tracing.

[0059] Specifically, such as Figure 5 As shown, Figure 5 A schematic flowchart of a plug-in access method based on an organizational tree architecture according to this disclosure is shown. Figure 5 In this system, when a user logs in, for example, through an organizational system, the system verifies their identity and retrieves their organizational information. The system obtains the user's organization code, which follows these rules: a 12-digit number, categorized into four organizational levels. First-level organization (3 digits): e.g., 001 represents the first level; Second-level organization (3 digits): e.g., 002 indicates the second level; Third-level organization (3 digits): e.g., 005 indicates the third level; Fourth-level organization (3 digits): such as 008 indicating the fourth level.

[0060] Example code: 001-002-005-008.

[0061] Then, query the plugin permission code. The plugin visibility range generates a code based on its configured control level: if the plugin is set to "first level visible", then the last 6 bits (third level + fourth level) are set to zero, and the code is 001-002-000-000.

[0062] Next, a bitmask is dynamically generated, and a binary mask is generated based on the plugin's control level: First level: Keep the first 3 bits, the mask is 111000000000; Second level: Keep the first 6 bits, the mask is 111111000000; Third level: Keep the first 9 bits, the mask is 111111111000; Fourth level: Keep all 12 bits, the mask is 111111111111.

[0063] Example (first level): 111111000000.

[0064] Then, a bitwise AND operation is performed to combine the user code and the plugin mask: User code: 001 002 005 008 → Binary: 00000001 00000010 0000010100001000 Plugin mask: 111111 000000 → Binary: 11111100 00000000 (or 01101111 011011110000000 0000000) Calculation result: 00000001 00000010 00000000 00000000 → Decimal: 001-002-000-000 Access is allowed if the result matches the plugin code.

[0065] Finally, the matching result is judged: if yes, the user's permissions match and the plugin is allowed; if no, access is denied and a security log (including user ID, plugin ID, and timestamp) is recorded.

[0066] As can be seen, this disclosure achieves plug-in visibility control through a four-level organizational coding system (12-bit numbers) and a dynamic bitmasking algorithm, combines it with the BeiDou time synchronization system to achieve high-precision time management, and employs a hierarchical synchronization strategy to optimize network transmission. It achieves precise multi-level organizational control, such as supporting four levels of plug-in visibility control: "first level - second level - third level - fourth level". It shortens synchronization time, automates timed start-stop, supports timed start-stop of plug-ins, and controls the error within ±1 second.

[0067] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0068] Based on the same technical concept, corresponding to any of the above embodiments, this disclosure also provides a plug-in access device based on an organizational tree architecture, see [link to relevant documentation]. Figure 6 The plugin access device based on the organizational tree architecture includes: The acquisition module is used to obtain organizational information of plugin visitors; The encoding module is used to encode the organization information according to preset rules to obtain the access organization code; The calculation module is used to perform bitwise operations on the access organization code and the plugin permission code to obtain the calculation result; The permission module is used to allow the plugin visitor to access the plugin in response to the fact that the calculation result matches the permission code.

[0069] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0070] The apparatus described above is used to implement the corresponding plugin access method based on the organizational tree architecture in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0071] Based on the same technical concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the plug-in access method based on the organizational tree architecture as described in any of the above embodiments.

[0072] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0073] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the plug-in access method based on the organizational tree architecture as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0074] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0075] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0076] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0077] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A plugin access method based on an organizational tree architecture, comprising: Obtain organizational information of plugin visitors; Based on the organizational information, an access organization code is obtained by encoding it according to preset rules. The access organization code and the plugin permission code are performed bitwise to obtain the calculation result; In response to the fact that the calculation result matches the permission code, the plugin visitor is allowed to access the plugin.

2. The method according to claim 1, wherein, Based on the organizational information, an access organization code is obtained by encoding according to preset rules, including: The organizational information is determined to be organized at multiple hierarchical levels within the organizational tree; The access organization code is generated based on the corresponding code of each hierarchical organization according to the priority order of the hierarchical organization; The hierarchical organization includes a first level, a second level, a third level, and a fourth level with decreasing priority. The access organization code includes a first code, a second code, a third code, and a fourth code. The first code corresponds to the first level, the second code corresponds to the second level, the third code corresponds to the third level, and the fourth code corresponds to the fourth level.

3. The method according to claim 1, further comprising: The permission code is generated based on the visibility level range configured in the plugin. The visibility level range is used to indicate the visibility level organization that allows access to the plugin; The generation of the permission code based on the visibility level range configured in the plugin further includes: Based on the first preset code corresponding to the visible hierarchy organization and the second preset code of the non-visible hierarchy organization, the visible hierarchy code is obtained; Based on the visible level encoding, a corresponding binary mask is generated to obtain the permission encoding.

4. The method according to claim 2, wherein, The access organization code and the plugin permission code are performed bitwise to obtain the calculation result, including: Based on the access organization code, a corresponding binary mask is generated to obtain the access organization mask; Perform a bitwise AND operation on the access organization code and the permission code to obtain a binary result; The decimal result is generated based on the binary result.

5. The method according to claim 1, further comprising: Configure the effective time period of the plugin, which includes a single effective time period or a periodic effective time period; If the current time falls within the specified valid time period, the plugin is allowed to start. If the current time is outside the specified valid time period, the plugin startup is denied.

6. The method according to claim 5, further comprising: In response to receiving national time information, the current time is determined; In response to the number of times the error between the current time and the local time is outside the preset error range reaching a preset number, the current time is determined based on the local time; Determining the current time based on the local time includes: Obtain historical national time information and historical local time information within a preset time period; Based on the historical national time information and the historical local time information, the average historical error within the preset time period is obtained; The current time is obtained based on the local time and the first proportion of the average historical error.

7. The method of claim 6, further comprising at least one of the following: In response to the discrepancy between the calculation result and the permission code, the plugin visitor is denied access to the plugin; In response to the unavailability of the national time synchronization information or the average historical error exceeding the error threshold, an anomaly is determined to have occurred, and the anomaly information is recorded. The exception information was generated via the message queue.

8. A plug-in access device based on an organizational tree architecture, comprising: The acquisition module is used to obtain organizational information of plugin visitors; The encoding module is used to encode the organization information according to preset rules to obtain the access organization code; The calculation module is used to perform bitwise operations on the access organization code and the plugin permission code to obtain the calculation result; The permission module is used to allow the plugin visitor to access the plugin in response to the fact that the calculation result matches the permission code.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as claimed in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1 to 7.

Images