CN117743402A

CN117743402A - Data authority management and control method, system, device and storage medium

Info

Publication number: CN117743402A
Application number: CN202311808677.3A
Authority: CN
Inventors: 鲁金殿; 孙宁波; 白文斌
Original assignee: Beijing Jinhui Technology Co ltd
Current assignee: Beijing Jinhui Technology Co ltd
Priority date: 2023-12-26
Filing date: 2023-12-26
Publication date: 2024-03-22

Abstract

The application relates to a data authority control method, a system, a device and a storage medium, which belong to the technical field of data authority control, wherein the method comprises the following steps: intercepting a query request, wherein the query request is used for requesting to query data in a client relationship management system, and the query request comprises a user role and query content; obtaining upper authority data according to user role matching; determining a query interval according to the upper authority data; searching the data which are the same as the query content in the query interval to obtain target data. The CRM system query efficiency improving method and device have the effect of improving the query efficiency of the CRM system.

Description

Data authority management and control method, system, device and storage medium

Technical Field

The present disclosure relates to the field of data authority control technologies, and in particular, to a data authority control method, system, device, and storage medium.

Background

When a customer relationship management (customer relationship management, CRM) system is deployed, a corresponding data authority inquiry algorithm is established, and whether a user has authority to inquire data is judged through the algorithm, so that whether the data is displayed to the user is determined, and the aim of guaranteeing data safety is achieved.

The process of establishing the data authority query algorithm is generally as follows: the users are classified according to the roles of the users, corresponding rights are matched for the users of different levels, and associated data are bound for each right. Therefore, when the user queries data, the user needs to spell complex and lengthy database Sql sentences for query or query in a fuzzy query mode. If the data authority query algorithm also has scene configuration (such as a white list, a black list, multiple levels, an invisible level and the like), the scene and the corresponding configuration also need to be judged, so that the whole query flow is complex, the query efficiency is low, and the accuracy of the query result is difficult to ensure.

Disclosure of Invention

In order to solve the problem of low query efficiency of a CRM system, the application provides a data authority management and control method, a system, a device and a storage medium.

In a first aspect of the present application, a method, a system, an apparatus, and a storage medium for managing and controlling data rights are provided. The method comprises the following steps:

intercepting a query request, wherein the query request is used for requesting to query data in a client relationship management system, and comprises a user role and query content;

obtaining upper authority data according to the user role matching;

determining a query interval according to the upper authority data;

searching the data which are the same as the query content in the query interval to obtain target data.

By adopting the technical scheme, when a user has the requirement of inquiring the data in the customer relationship management system, the user does not directly perform global search, but intercepts the inquiry request firstly, then matches corresponding upper authority data according to the user role in the inquiry request, locates an inquiry interval according to the upper authority data, and finally searches the same data as the inquiry content in the inquiry interval to obtain target data, so that the user only refers to the target data in the customer relationship management system, and cannot override to refer to the data, thereby ensuring the safety of the data. In addition, the data with the same query content is searched in the query interval, and compared with the original fuzzy query, the query mode greatly improves the query efficiency and the accuracy of the query result.

In one possible implementation: the method further comprises the steps of:

establishing a binding relation between the user role and the authority level according to the closeness between the user role and the node; or alternatively

The user of the upper authority level designates the user possessing the lower authority level, the inquiry authority of the lower authority level is smaller than that of the upper authority level, and one user has the user role.

By adopting the technical scheme, the application provides two methods for establishing the binding relation between the user role and the authority level, so that different setting modes can be selected according to different application scenes in actual use, and the application range of the method is improved.

In one possible implementation: the obtaining the upper authority data according to the user role matching comprises the following steps: and taking the authority level with the binding relation with the user role as the upper authority data.

By adopting the technical scheme, the binding relation between the user roles and the authority levels is established in advance, so that the authority levels with the binding relation can be directly matched according to the user roles in actual use, thereby providing technical support for quickly obtaining the upper authority data.

In one possible implementation: the determining the query interval according to the upper authority data comprises the following steps:

taking the upper authority data as an Sql query statement to be spliced;

splicing the Sql query statement to be spliced to the original Sql query statement to obtain a complete Sql query statement;

and positioning the nodes with the right inquiry and the partial data with the right inquiry in the nodes according to the complete Sql inquiry statement, and taking the nodes with the right inquiry and the partial data with the right inquiry in the nodes as the inquiry interval.

By adopting the technical scheme, as the whole Sql query statement is complete, the nodes which can be queried by the user and the partial data which can be queried in the nodes can be rapidly positioned, so that technical support is provided for rapidly obtaining the query interval.

In one possible implementation: the method further comprises the steps of:

determining a node needing confidentiality, wherein the node is one of business processes in a customer relationship management system;

configuring a permission identifier on the node needing confidentiality, wherein the permission identifier triggers the operation of intercepting the query request when receiving the query request.

By adopting the technical scheme, the permission identifier is configured on the node needing confidentiality, and the permission identifier intercepts the query request for accessing the node, so that the application is prevented from directly and globally searching the data corresponding to the query request after receiving the query request, the safety of the data is ensured, and the user role in the query request is used as an additional filtering condition during query, so that the query range is ensured to be smaller, and the query efficiency is higher.

In one possible implementation: the method further comprises the steps of: setting a user role of a user;

when the user is an enterprise member, the setting the user role of the user includes:

and setting the user roles according to the positions and the position levels of the users in the enterprise.

when the user is an employee of the dealer, the setting the user role of the user includes:

and setting the user role according to the commodity of the dealer where the user is and the cooperation of the enterprise.

By adopting the technical scheme, the method and the device set different user roles for different users, and can select corresponding setting modes according to different application scenes when in actual use, so that the application range of the method is improved.

In a second aspect of the present application, a data rights management and control system is provided. The system comprises:

the data processing module is used for intercepting a query request, wherein the query request is used for requesting to query data in the client relationship management system, and the query request comprises a user role and query content;

the data matching module is used for obtaining upper authority data according to the role matching of the user;

the data determining module is used for determining a query interval according to the upper authority data;

and the data query module is used for searching the data which are the same as the query content in the query interval to obtain target data.

In a third aspect of the present application, a data right management and control apparatus is provided. The device comprises: the system comprises a memory and a processor, wherein the memory is stored with a computer program, and the processor realizes any one of the data authority management and control methods when executing the program.

In a fourth aspect of the present application, there is provided a computer readable storage medium having stored thereon a computer program which when executed by a processor implements any of the data rights management methods described above.

In summary, the present application includes at least one of the following beneficial technical effects:

when a user has the requirement of inquiring data in the client relationship management system, the user does not directly conduct global search, but intercepts an inquiry request, matches corresponding upper authority data according to a user role in the inquiry request, locates an inquiry interval according to the upper authority data, and finally searches data which are the same as inquiry contents in the inquiry interval to obtain target data, so that the user only refers to the target data in the client relationship management system, and cannot override to refer to the data, and the safety of the data is ensured. In addition, the data with the same query content is searched in the query interval, and compared with the original fuzzy query, the query mode greatly improves the query efficiency and the accuracy of the query result.

Drawings

FIG. 1 is a schematic diagram of an exemplary operating environment of an embodiment of the present application.

Fig. 2 is a flowchart of a data authority management method according to an embodiment of the present application.

Fig. 3 is a block diagram of a data rights management and control system of an embodiment of the present application.

Reference numerals illustrate: 10. a server; 11. a data processing module; 12. a data matching module; 13. a data determination module; 14. a data query module; 20. and a terminal device.

Detailed Description

For the purposes of making the objects, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without making any inventive effort, are intended to be within the scope of the present application.

Fig. 1 shows a schematic diagram of an exemplary operating environment in which an embodiment of the present application can be implemented, where the operating environment includes a server 10 and a plurality of terminal devices 20 connected to the server 10, and the server 10 and the terminal devices 20 are connected through a wireless network, where the wireless network may be a wide area internet of things system based on communication such as a 4G network or a 5G network, or may be a local area internet of things.

A customer relationship management system is deployed in the server 10, where the customer relationship management system refers to a customer-centric enterprise management theory, business idea, and business operation mode, and is also a specific software system that uses information technology as a means to effectively improve enterprise profits and customer satisfaction. Because the information of enterprises and dealers related to the enterprises is related in the client relation management system, a confidentiality mechanism needs to be set for the data in the client management system, namely, corresponding query authorities are set for different enterprise staff and different dealers, only the enterprise staff and the dealers with the query authorities are allowed to query the data under the query authorities, and accordingly the risk of data leakage caused by unauthorized data review is avoided. The original security mechanism is to implement the flow of data authority inquiry in the system development process, namely the security mechanism is coupled with the business of the customer relationship management system, the coupling mode not only increases the maintenance cost, but also all nodes in the customer relationship management system need security, so that the coupling of the security mechanism and the customer relationship management system also increases the inquiry cost, namely each node needs authority verification, so that the inquiry efficiency is low.

The terminal device 20 is an intelligent device such as a mobile phone, a tablet, a computer and the like, the terminal device 20 is used for a user to send a query request to the server 10, the server 10 searches data under the authority of the user according to the query request after receiving the query request, and the searched data is returned to the terminal device 20, so that the user can acquire the required data conveniently, and the data security can be ensured.

It should be noted that, the above-mentioned user may be an enterprise employee, or may be a dealer employee, and the present application sets a user role for a post and a post level of the enterprise employee, if there are a user a and a user b, where the user a is a market manager, and the user b is a market manager, and since the post level of the market manager is usually smaller than the post level of the market manager, the user role of the user a may be a management level iii, and the user role of the user b may be a management level ii, where the management level ii > manages a level iii. The method and the system also set different user roles for staff of different dealers, such as a dealer A, a dealer B and a dealer C, wherein the dealer A is delivered from an enterprise and is delivered by a product U, the dealer B is delivered from the same enterprise and is delivered by a product V, the dealer is delivered by the same enterprise and is delivered by a product W, the product P and the product G are different series of the same product, the product W is different from the product P and the product G, the user role of staff of the dealer A can be P_1, the user role of staff of the dealer B can be P_2, and the user role of staff of the dealer C can be W_0.

It should be noted that the setting of the user roles is merely exemplary, and in other examples, the setting of the user roles may be other, for example, setting the user roles in an area where an enterprise employee is located, so long as different users can be distinguished, which is not limited herein.

It should also be noted that the operating environment illustrated in fig. 1 is merely illustrative and is in no way intended to limit the application or uses of embodiments of the present invention. For example, multiple servers 10 may be included in the operating environment, and each server 10 may support multiple terminal devices 20 for data queries simultaneously.

Fig. 2 shows a flow chart of a data rights management method according to an embodiment of the present application, which is performed by the server 10 in fig. 1. Specifically, the main flow of the data right management and control method is described as follows.

Step S101, intercepting a query request, wherein the query request comprises a user role and query content.

First, a configuration file is written. The developer writes an xml format configuration file according to the specific business of the following project, wherein the configuration file comprises a business data table, a permission level for inquiring the data table, an application scene, a white list, a black list and other data, the data table is a data table of one node in the client relation management system, the data table comprises all data information of the corresponding node, for example, the data table on a sales node comprises all sales commodity types, and sales volume, stock volume, sales volume and other data information of each sales commodity. The permission hierarchy of a query data table refers to the hierarchy having the ability to query the data table, i.e., which user roles can query the data table. The application scenario is mainly divided into a business query scenario and a dealer query scenario, wherein the business query scenario refers to the query of enterprise staff on business processes, and the dealer query refers to the query of different dealers on the corresponding business processes.

It should be noted that, the client relationship management system of the present application is further provided with a custom interface, and a developer or a user may modify a configuration file through the custom interface, for example, modify an acquisition manner of a white list and a black list or modify a manner of inserting new data content into a data table, so as to support the developer and the user to complete custom development, thereby promoting an application scenario of the present application.

Based on the written configuration file, when the customer relation management system is deployed or maintained, a developer sets a permission identifier at a node needing data confidentiality, wherein the permission identifier is an application program. When the data table of the node needing to be kept secret is accessed, the permission identifier is triggered, the inquiry request is intercepted by the permission identifier, and the problem that when the terminal equipment 20 sends the inquiry request to the server 10, the server 10 directly responds and returns corresponding data to cause data leakage is avoided. Therefore, the method and the device can only set the permission identification for the node needing data confidentiality, and intercept the query request for the node by the permission identification, so that the aim of decoupling the flow of checking the query permission and the business of the client relationship management system is fulfilled, the subsequent maintenance and management of the permission identification are facilitated, the interception is performed only when the node needing data confidentiality is queried, and the flow of checking the query permission for a large number of nodes is avoided when each query is performed, namely, the query efficiency can be improved.

The permission identifier set at the node not only intercepts the query request input by the terminal device 20, but also intercepts the data for supplementing and perfecting the data table input by the terminal device 20, specifically: when receiving the insertion data, the configuration file is called, whether the user has the authority for modifying the data table is judged according to the configuration file, if yes, a binding data is generated according to the insertion data and the authority level corresponding to the insertion data, the authority level is converted into a code of a digital format and then is inserted into the corresponding data table, for example, a client AA is newly added to an employee xiao Li in a z area in a client relation management system, the authority identification automatically intercepts the operation when the client AA is newly added, then the employee in w-y city-z area is determined xiao Li in the configuration file, if the employee in x-y city-z area has the authority of a newly added client, the authority level of an employee xiao Li in x-y city-z area is converted into binding data in "005-07-05" in the digital format, the employee in 005 corresponds to the x-y city, and the employee in the z area corresponds to the z area, and binding data of "AA+ xiao Li +0050705" is obtained, and the binding data is newly added into the data table.

The above is a process of adding data to the data table, and when querying the data in the data table, the terminal device 20 needs to send a query request to the server 10 to trigger the permission identifier to perform the permission checking work. In a specific example, the query request includes a user role and query content, where the user role is related to an identity of the user, and when the identity of the user is an enterprise member, the user role is obtained according to a post and a post job level of the user in the enterprise, where the user role has a management level i, a management level ii, a management level iii, and a management level iv, and different user roles correspond to different query authorities. When the identity of the user is the employee of the dealer, the user role of the employee of the dealer is obtained according to the commodity of the dealer where the user is located and the enterprise, if the user role is P_1, the commodity P is indicated to be cooperated, and the commodity P is indicated to be cooperated by 1. Of course, the corresponding user roles may also be set according to the positions and the position levels of the staff of the dealer in the dealer, which is not limited herein.

The above-mentioned query content refers to data that the user needs to acquire in the server 10, and also refers to data returned after the server 10 has performed the query operation.

And step S102, obtaining upper authority data according to user role matching.

In this example, corresponding query rights are configured for different user roles in advance, that is, a binding relationship is established between the user roles and the rights hierarchy, the binding relationship can be determined according to the closeness of the user and the node, for example, an employee mainly responsible for managing data of the node has the right to query the data table of the node, and a user having a next-level rights hierarchy can be specified by a user having a previous-level rights hierarchy, but this case must be for the same node, for example, a user having a previous-level rights hierarchy of the query node o can be specified, the query rights of the next-level rights hierarchy are smaller than those of the previous-level rights hierarchy, but the user having a previous-level rights hierarchy of the query node o cannot be specified, and the node o and the node q are two different nodes.

Therefore, after the query request is intercepted by the rights label, the rights hierarchy corresponding to the user role can be positioned according to the user role in the query request, and the rights hierarchy corresponding to the user role is also marked as the upper rights data.

Step S103, determining a query interval according to the upper authority data.

In a specific example, the upper authority data is used as the Sql query statement to be spliced, and after the Sql query statement to be spliced is spliced to the original Sql query statement in the client relationship management system, the whole Sql query statement is complete, so that the server 10 can conveniently execute the query operation.

In addition, because the whole Sql query statement is complete, the user can quickly locate the node which can be queried and the partial data which can be queried in the node, and the user can query the node and the partial data which can be queried in the node are also called as query intervals in the application. Therefore, the method and the device realize the filtering of the query authority during the query, namely only the queriable nodes and part of data in the nodes are called as query intervals, and the query efficiency is improved.

To facilitate the description of the above process of determining the query interval, examples are as follows: if the enterprise employee sheet uses the customer relation management system to inquire all customer lists, the original customer relation management system does not judge his authority in the development process, but in maintenance, a developer sets an authority identification here to inform the customer relation management system that the authority filtering is needed at the node, so the authority identification automatically intercepts the original direct inquiry process, upper authority data obtained by matching the roles of the sheet users is added to the execution process as an additional filtering condition, and finally the sheet customer list with the inquiry authority is obtained by matching, so that the inquiry interval is obtained.

Step S104, searching data corresponding to the query content in the query interval to obtain target data.

In the query section, the data identical to the query content is searched as target data and returned to the terminal device 20, so that the user can conveniently query the data which is required by the user and is under the query authority of the user.

In summary, the implementation principle of the data authority management and control method in the embodiment of the present application is as follows: first, a rights identification is set at a secure node of a customer relationship management system, which will be automatically intercepted when a user accesses the data of the node. Based on the intercepted query request, the upper authority data is obtained according to the user role matching in the query request, the query interval is positioned according to the upper authority data, the data which is the same as the query content is searched in the query interval and is used as target data, and the target data is returned to the terminal equipment 20, so that the safety of the data is ensured while the query work is finished, and the data which is the same as the query content is searched in the query interval, compared with the original fuzzy query, the query efficiency and the accuracy of the query result are greatly improved.

Fig. 3 shows a block diagram of a data rights management and control system including a data processing module 11, a data matching module 12, a data determination module 13, and a data query module 14 according to an embodiment of the present application.

The data processing module 11 is configured to intercept a query request, where the query request is used to request to query data in the client relationship management system, and the query request includes a user role and query content.

And the data matching module 12 is used for obtaining the upper authority data according to the role matching of the users.

The data determining module 13 is configured to determine a query interval according to the upper authority data.

The data query module 14 is configured to search data corresponding to the query content in the query interval, and obtain target data.

The modules involved in the embodiments described in the present application may be implemented by software, or may be implemented by hardware. The described modules may also be provided in a processor, for example, as: a processor comprises a data processing module 11, a data matching module 12, a data determination module 13 and a data query module 14. The names of these modules do not constitute a limitation on the module itself in some cases, and the data processing module 11 may also be described as "a module for intercepting a query request", for example.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the described modules may refer to corresponding procedures in the foregoing method embodiments, which are not described herein again.

In order to better execute the program of the above method, the present application also provides an apparatus, which includes a memory and a processor.

Wherein the memory may be used to store instructions, programs, code, sets of codes, or sets of instructions. The memory may include a storage program area and a storage data area, wherein the storage program area may store instructions for implementing an operating system, instructions for at least one function, instructions for implementing the above-described data right management method, and the like; the storage data area may store data and the like involved in the above-described data authority management and control method.

The processor may include one or more processing cores. The processor performs the various functions of the present application and processes the data by executing or executing instructions, programs, code sets, or instruction sets stored in memory, calling data stored in memory. The processor may be at least one of an application specific integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller, and a microprocessor. It will be appreciated that the electronic device for implementing the above-mentioned processor function may be other for different apparatuses, and embodiments of the present application are not specifically limited.

The present application also provides a computer-readable storage medium, for example, comprising: a U-disk, a removable hard disk, a Read Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes. The computer readable storage medium stores a computer program that can be loaded by a processor and that performs the data right management method described above.

The foregoing description is only of the preferred embodiments of the present application and is presented as a description of the principles of the technology being utilized. It will be appreciated by persons skilled in the art that the scope of the disclosure referred to in this application is not limited to the specific combinations of features described above, but it is intended to cover other embodiments in which any combination of features described above or equivalents thereof is possible without departing from the spirit of the disclosure. Such as the above-described features and technical features having similar functions (but not limited to) disclosed in the present application are replaced with each other.

Claims

1. A method for managing and controlling data rights, comprising:

obtaining upper authority data according to the user role matching;

determining a query interval according to the upper authority data;

2. The data rights management method of claim 1, further comprising:

3. The method for managing and controlling data rights according to claim 2, wherein said obtaining upper rights data according to the user role matching includes: and taking the authority level with the binding relation with the user role as the upper authority data.

4. The method of claim 1, wherein the determining the query interval according to the upper authority data comprises:

taking the upper authority data as an Sql query statement to be spliced;

5. The data rights management method of claim 1, further comprising:

6. The data rights management method of claim 1, further comprising: setting a user role of a user;

7. The data rights management method of claim 1, further comprising: setting a user role of a user;

8. A data rights management and control system, comprising:

a data processing module (11) for intercepting a query request for requesting a query of data in a client relationship management system, the query request including a user role and query content;

the data matching module (12) is used for obtaining upper authority data according to the role matching of the user;

the data determining module (13) is used for determining a query interval according to the upper authority data;

and the data query module (14) is used for searching the data which are the same as the query content in the query interval to obtain target data.

9. A data rights management device comprising a memory and a processor, the memory having stored thereon a computer program, the processor implementing the method of any of claims 1-7 when executing the program.

10. A computer readable storage medium, characterized in that a computer program is stored thereon, which program, when being executed by a processor, implements the method according to any of claims 1-7.