EA044374B1 - ACCOUNT MANAGEMENT METHOD FOR INSTANT MESSAGING IN THE MANAGEMENT SYSTEM - Google Patents

Description

Field of technology

The present invention relates to a method for managing an instant messaging account in a management system such as ERP (Enterprise Resource Planning) or CRM (Customer Relationship Management).

Prior Art

Role-Based Access Control (RBAC) is one of the most studied and developed permission management mechanisms for databases in recent years. It is considered an ideal option to replace the conventional Mandatory Access Control (MAC) and Discretionary Access Control (DAC). The traditional selective access control system has high flexibility but low security. Traditional mandatory access control systems are highly secure but overly restrictive. A role-based access control system combines elements of both of the above systems: it is not only easy to manage, but at the same time reduces complexity, costs and the likelihood of errors. Therefore, role-based access control has developed rapidly in recent years. The basic idea of role-based access control (RBAC) is to separate different roles according to different functional positions within an enterprise organization, encapsulate access permission to database resources in roles, and allow users indirect access to database resources by assigning different roles for users.

Large-scale application systems often have a large number of tables and views built into them, making database resource management and authorization significantly more complex. It is very difficult for the user to directly control access and permissions of database resources. This requires the user to have a deep understanding of the database structure and knowledge of the SQL language. As the application system structure or security requirements change, a large number of complex and extensive permission changes are required, which is very likely to result in information security vulnerabilities caused by some unexpected authorization errors. Therefore, developing a simple and effective way to manage permissions for large-scale application systems has become a common requirement for systems and system users. Therefore, developing a simple and effective way to manage permissions for large-scale application systems has become a common requirement for systems and system users.

The role-based permission management mechanism makes it easy and efficient to manage system permissions, which greatly reduces the burden and cost of system rights management, and makes system rights management more compatible with the technical requirements of business management in the application system.

However, the traditional way of managing user permissions based on roles uses a one-to-many role-to-user relationship mechanism, where the role represents a group or class. This means that one role can simultaneously correspond to or be associated with many users; role is similar to position, title, type of work and other concepts.

According to this communication mechanism, authority authorization for a user is mainly divided into three forms.

1. As shown in FIG. 1, direct authorization of user authority has the disadvantage of high workload and frequency and volume of operations. When employee changes occur (such as transfer or termination), all authority associated with the employee must be adjusted accordingly. In particular, there are a lot of privileges used for administrators in a company. Because authority adjustments are workload-intensive and voluminous, errors or omissions are possible, affecting the normal operations of the enterprise and even leading to unpredictable losses.

2. As shown in FIG. 2, to authorize a role of class/group/position/job type (one role can be associated with many users), the user obtains authority through his role, and the subject of the authorization operation is a role of a group or class nature.

3. As shown in FIG. 3, the above two kinds are combined.

In the above descriptions 2 and 3, it is necessary to carry out authorization of the class or group type role. The authorization method through the class/group/position/job type role has the following disadvantages.

1. Difficulties in performing operations if user permissions change. During actual use of the system, user permissions are subject to frequent changes. For example, during the process of changing an employee's authority, when the employee's authority associated with a role changes, it is not practical to change the authority of the entire role because an individual employee's authority has changed, because the role is also associated with other employees whose authority has remained the same. Therefore, the result is either a new role is created that matches the employee whose permissions were changed, or the permissions are directly granted to the employee (not associated with the role) based on the permission requirements. The two above

- 1 044374 processing methods are not only labor-intensive, but also easily lead to errors when authorizing a role if the role has relatively large powers. The user has to do a lot of work, which results in errors that lead to losses for the system user.

When an employee or user's permission to use a form changes, either the employee/user is removed from the role or a new role is added to meet job requirements. The disadvantage of the first method is the same as that of the method of direct authorization for the user described above. In the second case, adding a new role involves creating, associating, and authorizing the role. In particular, when there are many roles and many users associated with those roles, it is difficult to remember which specific users are associated with a role.

2. It is difficult to retain the specific powers contained in the role in memory for a long time. If a role has many functional authorities, over time it is difficult to remember the role's specific authorities, and even more difficult to remember the differences in authority between roles with similar authorities. It is also easy to confuse the responsibilities of similar roles with each other. If you need to associate a new user, it is not possible to know exactly how to select an association.

3. As user permissions change, more roles will be created (if new roles are not created, the immediate authorization for the user will increase significantly), and it will be more difficult to find specific differences between role permissions.

4. When transferring a user to another position and the need to assign a large number of powers of the transferred user to other users, it is necessary to separate the powers of the transferred user and create roles for communication with other users, respectively, necessary for processing. Such operations are not only complex and time-consuming, but also prone to error.

Instant messaging is an important means of internal and external communication for various businesses and institutions. Nowadays, commonly used instant messaging software includes QQ, WeChat, MSN, Fetion, etc. In normal enterprise management modes, instant messaging accounts such as QQ numbers are usually directly assigned to individual entities or users. During use, the following problems will occur.

A. If an employee works in multiple positions within a business, job transfer cannot be accomplished effectively when the employee leaves or transfers. For example, Zhang San is simultaneously a sales engineer in the sales department of the building materials business division I and a sales engineer in the sales department of the aviation business division I. Now Zhang San is to be removed from his position as Sales Engineer in the Sales Department of Aviation Division I, and Li Si will take over this position. However, Zhang San's QQ account cannot be directly transferred to Li Si, because many customers related to construction materials still remain in Zhang San's QQ account, and it is necessary to further contact and track them. To add aircraft related clients, Li Si must use a new QQ account (adding a client depends on the client's consent, which not only increases the workload and delays the work, but also faces the possibility of being rejected by the client, due to the client's ignorance of who requests to be added, which affects the operation). Thus, on the one hand, it may create a bad impression on the client. On the other hand, Li Si is also unaware of Zhang San's previous communications (message records) with aircraft-related clients, and aircraft-related clients are likely to continue to contact Zhang San, resulting in leakage of sensitive information of aircraft-related clients. by plane.

Q. If Zhang San resigns and Li Si takes over Zhang San's QQ account, Li Si can view QQ message records and new messages from customers related to building materials (Li Si takes over the sales work of only the aviation business division), which leads to leakage of confidential customer information related to construction materials. Similarly, an employee who only undertakes sales work in the building materials business division cannot accept Zhang San's QQ account, because the employee who accepts Zhang San's QQ account will see QQ message records and new messages from customers related to aviation.

C. A QQ account is assigned to an individual without being linked to a fixed individual or user forever, and is manually assigned to an employee for use (manual linking/manual assignment of a QQ account to an employee has obvious disadvantages: a long-term process of repeated and continuous assignment, after Once a QQ account is allocated to an employee, it is very likely that the amount of work corresponding to the employee will be sharply different from the amount of work corresponding to the QQ account allocated to the employee, or even an error may occur in between, but the QQ account is still in use, and even used for a relatively long or very long period of time, which can lead to great difficulties and problems in subsequent work and lead to huge losses). So

- 2 044374 Thus, during the separation process, leakage of confidential information of the enterprise is very likely. For example, a QQ account was first allocated to salesperson Zhang San for use (Zhang San is in charge of sales in the building materials sector). Later, Zhang San gave up the QQ account due to resignation or other reasons, and the QQ account was allocated to the salesman Li Si for use (Li Si is in charge of sales in the aviation sector), and then after the QQ account is no longer used by Li Si, she is allocated to Wang Wu, who was in charge of sales in the software sector, etc. Thus, the incoming and outgoing messages in the QQ account can affect customers in all sectors of the company. The Company separates the market scope of sellers in terms of industrial sectors and prohibits sellers from obtaining any information about other sectors outside the sector for which the seller is responsible. The above problem is quite grim, but even worse: if customers from a sector not affected by the seller's contact have contacted the seller through a QQ account previously, and can continue to send subsequent messages to the QQ account, subsequent messages will be constantly examined by the seller, who should not know about it. The situation could be even worse. If a QQ account that was used by financial personnel and a QQ account that was used by R&D personnel are linked to the seller after the connection is re-established, the currently linked seller will receive confidential R&D information or confidential financial information, and, most likely, confidential information will be leaked, which can lead to serious losses for the company.

D. When an employee joins a company or is transferred to a new position, an instant messaging account must be associated with the employee, which entails a huge workload (or communication errors may occur). In addition, there is some lag in re-linking the instant messaging account to the employee, which will affect the normal progress of the related work. For example, when Employee A is transferred from a Production Manager to a Sales Manager, after Employee A's existing Instant Messaging account is transferred to his successor, if Employee A is not associated with the new Instant Messaging account, Employee A will not be able to perform related work due to lack of an instant messaging account. If Employee A's existing instant messaging account is not transferred to his successor, the successor will not be able to know the relevant archived business-related communication information, which is detrimental to the normal course of business. In another example, Employee A, who serves as the production and after-sales manager, is now removed from his position as production manager (Employee A's instant messaging account is not suitable for transfer to his successor because it contains communication information about the after-sales manager's job). If a new instant messaging account is re-allocated to a successor production manager, the appropriate individuals involved in the messaging (such as equipment maintenance personnel and third-party manufacturers) must be notified individually. This not only requires a large workload, but also imposes additional work on the partner. Additionally, Employee A may still receive subsequent production-related communications (for example, if the sender of the information is unaware that Employee A has been removed from his position as production manager). In another example, when Employee A is transferred from a Production Manager position to a Sales Manager position, if a new Instant Messaging account is not allocated to Employee A immediately after Employee A's existing Instant Messaging account is transferred to his successor, Employee A will not be able to perform the job through an instant messaging account during a delay, which is unfavorable to the normal flow of work.

Disclosure of the invention

Technical tasks

The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method for managing an instant messaging account in a management system in which one instant messaging account is associated with one role. An employee (on hire) is given a role-based instant messaging account through the role associated with the relevant user. When an employee leaves, the system administrator (or corresponding administrator) directly unassociates the employee's user from the role, so that the terminated employee automatically loses permission to use the role-based instant messaging account, avoiding the risk of leaking sensitive enterprise information. When an employee is transferred from a position, the system administrator (or the corresponding administrator) directly unassociates the employee (the user corresponding to the employee) from the original role and then associates the employee to the new role, so that the employee automatically receives a role-specific instant messaging account corresponding to new role. This ensures a smooth transfer and ensures that the user's instant messaging account is updated on time, without the messaging account transfer being delayed or missed, and does not impact the employee's normal use of the messaging account. The risks of leaking confidential information are also eliminated.

The solution of the problem

Technical solutions.

The purpose of this invention is achieved through the use of the following technical solutions. The method for managing an instant messaging account in the management system includes the following steps:

(1) creating a role in the system, wherein said role is an independent subject rather than a group/class, wherein during one period one role can only be associated with a unique user, while a user is associated with one or more roles;

(2) associating a role-based instant messaging account with a role according to the workload of the role in the management system, and during one period, one role-based instant messaging account can only be associated with one role, and one role can be associated with only one instant messaging account; and (3) creating an association between a user and a role, whereby for any user, the role-based instant messaging accounts associated with all roles associated with the user are used as the user's and/or employee's role-based instant messaging accounts , corresponding to the user.

Step (3) may be performed after step (1), before step (2), or after step (2).

Once a role-based IM account is associated with a role, the role-based IM account associated with the role cannot be replaced; or Once a role-based instant messaging account is associated with a role and is in use, the role-based instant messaging account associated with the role cannot be replaced.

When the role-based instant messaging account of a role needs to be replaced, the role is unlinked from the original role-based instant messaging account and the role is associated with the new role-based instant messaging account.

The method for managing an instant messaging account further includes: selecting one or more roles as controlling roles, and setting a controlled role for each controlling role respectively, so that a user associated with a controlling role or an employee corresponding to the user can manage accounts. Role-based instant messaging records associated with all controlled roles corresponding to the controlling role, which operation includes viewing communication materials.

The method for managing an instant messaging account further includes: associating an individual instant messaging account with a user/employee, wherein during one period, one user/employee can be associated with only one individual instant messaging account nature, and one personal instant messaging account can only be associated with one user/one employee. In this application, the user and the employee are in a one-to-one relationship. That is, one user corresponds to one employee, and one employee corresponds to one user. A match between a user and an employee, once established, is always maintained, and a user who is already matched with an employee cannot be matched with another employee.

Once a personal instant messaging account is associated with a user/employee, the personal instant messaging account associated with the user/employee cannot be replaced; or Once a personal instant messaging account is associated with a user/employee and is in use, the personal instant messaging account associated with the user/employee cannot be replaced.

When a personal instant messaging account is associated with a user, the personal instant messaging account associated with the user is used as the personal instant messaging account of an employee corresponding to the user.

When a personal instant messaging account is associated with an employee, the personal instant messaging account associated with the employee is used as the personal instant messaging account of a user corresponding to the employee.

- 4 044374

The method for managing an instant messaging account further includes: selecting one or more roles as controlling roles, and setting a controlled role for each controlling role respectively, so that: a user associated with a controlling role or an employee corresponding to the user can control individual user instant messaging accounts associated with all controlled roles corresponding to the controlling role; or a user associated with a controlling role, or an employee corresponding to a user, can manage individual instant messaging accounts of an employee corresponding to the user associated with all controlled roles corresponding to the controlling role.

A role-based instant messaging account is an instant messaging application account on a system or an instant messaging software account provided by a third party, and a personal instant messaging account is an instant messaging application account. messages on the system or an instant messaging software account provided by a third party.

Positive effects of the invention

Positive effects.

The present invention has the following beneficial effects. (1) The present invention provides a method for managing an instant messaging account in a management system in which one instant messaging account is associated with one role. An employee (on hire) is given a role-based instant messaging account through the role associated with the relevant user. When an employee leaves, the system administrator (or corresponding administrator) directly unassociates the employee's user from the role, so that the terminated employee automatically loses permission to use the role-based instant messaging account, avoiding the risk of leaking sensitive enterprise information. When an employee is transferred from a position, the system administrator (or corresponding administrator) directly unassociates the employee (user corresponding to the employee) from the original role and then associates the employee to the new role, so that the employee automatically receives an instant messaging account corresponding to the new role . This ensures a smooth transfer and ensures that the instant messaging account used by the user is updated on time, without the messaging account transfer being delayed or missed, and does not impact the employee's normal use of the messaging account. The risks of leaking confidential information are also eliminated.

Example of dismissal.

The role-based instant messaging account associated with the role production worker 1 is QQ number 123456. When the user corresponding to employee Zhang San is associated with production worker 1, Zhang San uses the QQ number 123456. When Zhang San quits, the system administrator ( or the corresponding administrator) directly unlinks the user corresponding to Zhang San from the role of production worker 1, and therefore Zhang San automatically loses the authority to use QQ number 123456, which avoids leaking the confidential information of production worker 1 to Zhang San due to transmission delay QQ numbers. When newly hired employee Li Si takes over Zhang San's work, the administrator directly associates the user corresponding to Li Si with production worker 1, so that Li Si is automatically authorized to use the role-specific QQ number 123456, according to the role production worker 1, without the need to re-allocate a new QQ number to Li Si. This operation is simple and fast, and the workload is greatly reduced. In addition, Li Si, who takes over the work, can view the archived messages previously exchanged between Zhang San and the QQ contact, thus achieving a better transmission effect, promoting the normal execution of the work, and achieving ease of use.

An example of a transfer from a position.

Employee Zhang San needs to be transferred from the production department to the after-sales department. The system administrator unassociates the user corresponding to Zhang San from the original role production employee 1, and then associates Zhang San to the new role after-sales personnel 3 in the after-sales service department, so that Zhang San is automatically authorized to use the role-character QQ number 987654 corresponding to the role after sales staff 3.

(2) According to the present invention, a role-based instant messaging account is associated with each role, and a corresponding role-based instant messaging account is allocated to an employee along with the position number or job

- 5 044374 are assigned to an employee at the same time, without the need to allocate the employee an account for instant messaging of a role-based nature separately. In case of dismissal, transfer from position, recruitment, etc. There is no lag in role-based IM account provisioning, which reduces the burden of IM account provisioning.

For example, after a user corresponding to Employee A is associated with Role A and Role B, the role-based IM accounts associated with Role A and Role B are automatically allocated to Employee A, without the need to separately allocate an IM account. exchanging messages with employee A.

(3) Once an employee is transferred or terminated, a role-based instant messaging account associated with a role that needs to be allocated to another employee will not be allocated to an employee who does not perform the role's workload, since in the present invention the role has the nature of the position number or station number. This prevents communication messages from leaking to unrelated parties even though the instant messaging account has been transferred to another user.

For example, the user corresponding to Employee A is associated with both the Device Seller 1 role and the Software Seller 1 role. Since Employee A has resigned (when Employee A leaves, both the Device Seller 1 role and the Software Seller 1 role are released from being associated with the user corresponding to Employee A, and therefore Employee A or the user corresponding to Employee A automatically loses authority to using a role-based instant messaging account associated with device vendor 1 and a role-based instant messaging account associated with software vendor 1), device vendor 1 is associated with a user corresponding to employee B (employee B receives the account role-based instant messaging associated with device vendor 1), and software vendor 1 is associated with a user corresponding to employee C (employee C receives a role-based instant messaging account associated with software vendor 1). Thus, Employee B can only receive device sales information through the role-based messaging account corresponding to Device Seller 1, without access to software sales information. Similarly, Employee C can only receive software sales information through the role-based messaging account corresponding to software seller 1, without access to device sales information.

(4) In the present invention, a role is associated with a role-based instant messaging account according to the scope of work. Therefore, when sending a message to a contact person in an instant messaging account, there is no need to worry about whether the contents of the message will be leaked to unrelated persons, since at the moment the current user of the role-based instant messaging account is undoubtedly responsible for relevant work. For example, role A's workload is attendance statistics, and role A is associated with instant messaging account X. Therefore, once role A is associated with the user corresponding to employee A, employee A becomes the current user of A's instant messaging account X, and employee A's current workload certainly includes attendance statistics. Once a contact on IM account X sends an attendance-related message to IM account X, the attendance-related message will be invisible to anyone not associated with them.

(5) Once a role is associated with a role-based instant messaging account, the role-based instant messaging account associated with the role cannot be replaced. This way, all messages related to the role's workload are sent to the same IM account, and there is no need to worry about whether the IM account is changed midway.

For example, once role A is associated with instant messaging account X, role A cannot be associated with another instant messaging account, and instant messaging account X cannot be associated with another role.

(6) A user associated with a control role, or an employee corresponding to a user if the user is allowed a control role, has the right to view the communication materials of the instant messaging account of the user associated with the controlled role or the employee corresponding to the user (or view the communication materials of the account instant messaging records associated with the controlled role), thereby making it easier for the manager to monitor and manage the work of subordinates (or related roles).

(7) A personal instant messaging account is established for a user/employee to send and receive the user's personal information.

- 6 044374 employee/employee, thus separating the work IM account (a role-based IM account that is used to process work information in IM) from the personal IM account (the individual instant messaging records, which are used to process personal instant messaging information). Since the user's/employee's individual IM account will not be allocated to other employees/users (if the individual's IM account is associated with an employee or user, the association is always stable and irreplaceable), the user/employee does not need to worry about leakage of personal information caused by the transfer of an account after a job change.

For example, if employee A is late for work, but his manager refrains from deducting employee A's wages due to employee A's good business performance, the manager can explain this by sending a message to employee A's personal instant messaging account without worrying about the risk of adverse the impact on the company due to the leak of a message to a successor who takes over Employee A's job after Employee A is fired or transferred.

(8) In this application, the role is related to the user one-to-one. During one period, one role can only be associated with a unique user, and one user can be associated with one or more roles. The advantage of this is that permissions can be acquired while the user is associated with a role (that is, the user receives the permissions of the associated role), and the changes to the role's permissions are much smaller than changes to the user's permissions in a normal mechanism. Due to minor changes in the number of roles that have the nature of an independent entity (the nature of the position number or station number), despite the high turnover of personnel, minor changes occur in the position number/station number (changes are not even made for a certain period, that is, the role does not change). This greatly simplifies the management of user permissions and reduces system overhead.

(9) Operations such as dynamic management, recruitment and transfer of personnel are simple, convenient, efficient and highly reliable. The application of hiring, firing or transfer in authority management is simple. When replacing an employee or user, there is no need to update permissions. You only need to unassociate the user or associate him with a role. For a user who is no longer associated with a role, the association with the role is unassociated; and the user who assumes the role is associated with the role corresponding to the job number. A user associated with a role automatically receives a role-related account and their work credentials, without the need to re-authorize the role, which significantly improves the efficiency, security and reliability of system setup.

For example, since user Zhang San quits or is transferred from a position, Zhang San is no longer acting as buyer 3, and Zhang San then cancels the association with buyer 3. Meanwhile, Li Si takes over the job as buyer 3, and only needs to associate Li Si with the role, so Li Si automatically receives the authority of the buyer role 3 (since the role was authorized according to the role's workload) and the role's messaging account.

(10) The traditional authority management mechanism defines a role as the nature of a group, job (position), class, or the like. The role is in a one-to-many relationship with the user. During actual use of the system, user permissions are subject to frequent changes. For example, during the process of changing an employee's authority, when the employee's authority associated with a role changes, it is not appropriate to change the authority of the entire role because the authority of an individual employee has changed, since the role is also associated with other employees whose authority has remained unchanged. As a result, either a new role is created corresponding to the employee whose permissions were changed, or the permissions are directly allocated to the employee (not associated with the role) based on the permission requirements. The above two processing methods are not only time-consuming, but also easily lead to errors in role authorization in case the role has high authority. The user has to do a lot of work, which results in errors that lead to losses for the system user.

However, according to the method proposed in this application, since the role is an independent entity, the goal can be achieved by changing the authority of the role. Although the method of the present application appears to increase the workload during system initialization, by copying or the like, a role can be created or authorized more efficiently than conventional roles having a group/class nature. Since there is no need to consider the generality of roles having a group/class nature when satisfying associated users, the solutions proposed in this application make the setting of permissions clear and unambiguous. In particular, after using the system for a certain period of time (after dynamic changes in user/role permissions), solutions according to this application can significantly

- 7 044374 increase the efficiency of managing permissions for the system user when using the system, make dynamic authorization simpler, more convenient, clearer and more understandable, as well as increase the efficiency and reliability of setting permissions.

(11) The usual method of authorizing a role with a group/class character is prone to error. The method provided in this application significantly reduces the likelihood of authorization errors, since the method described in this application must consider the role only as an independent entity, without taking into account the commonality of multiple users associated with the role having a group nature in the conventional method. Even if authorization errors occur, only the user associated with the role is affected. However, in the case of a generic role that is in the nature of a group, all users associated with that role are affected. Even if authorization errors occur, the correction method according to the present application is simple and takes little time, while in the case of a normal role having the nature of a group, the commonality of authority of all users related to the needs of the role must be taken into account when correcting errors. If a role has large functionality, the fix is large, complex, and error-prone, and in many cases the problem cannot be resolved until a new role is created.

(12) In the traditional group-based role authorization method, if a role has many functional powers, over time it is difficult to remember the specific powers of the role, and even more difficult to remember the differences in powers between roles with similar powers. If you need to associate a new user, it is not possible to know exactly how to select an association. In the method according to the present application, the role itself has the character of a job number or a station number, so that the selection can be made easily.

(13) When transferring a user to another position and needing to assign a large number of powers of the transferred user to other users, during processing it is necessary to separate the powers of the transferred user and create roles for communication with other users accordingly. Such operations are not only complex and time-consuming, but also prone to error.

The method according to the present application is as follows: the transferred user is associated with several roles. When you transfer a user, you first unassociate the user from roles in the original department (unlinked roles can be reassigned to other users), and then associate the user with a role in the new department. The operation is simple and not prone to errors.

Brief description of graphic materials

Description of graphic materials.

In fig. 1 is a schematic representation of direct user authorization by the system in the prior art;

In fig. 2 shows a schematic representation of authorization in the system of a group or class role in the prior art;

In fig. 3 shows a schematic representation of direct authorization in the system of both the user and the role of a group or class nature in the prior art;

In fig. 4 shows a schematic diagram of user authorization in the system through a role having the nature of an independent subject, according to the present invention; And

In fig. 5 is a diagram of a control method according to an embodiment of the present invention.

Carrying out the invention

Description of embodiments of the invention.

The technical solutions of the present invention will be described below in more detail with reference to the accompanying drawings, but the scope of the present invention is not limited to the following description.

Embodiment 1.

As shown in FIG. 5, the method of managing an instant messaging account in the management system includes the following steps: creating a role in the system. As shown in FIG. 4, the role represents an independent entity, not a group/class. During one period, one role can only be associated with a unique user, and one user can be associated with one or more roles. One user corresponds to one employee, one employee corresponds to one user, and the employee assigns (gets) permissions based on the role associated with the user corresponding to the employee. Employee and user are in a one-to-one relationship, and are forever connected. Once a user is associated with an employee, the user is owned by the employee and the user cannot be associated with other employees. If an employee leaves, the user cannot match other employees as well. When an employee is rehired, they are still the same as the original user.

The method further includes: associating an instant messaging account of a role nature with a role in accordance with the scope of work of the role in the management system (for a role, this step can also be considered as: associating an instant messaging account

- 8 044374 messages with a role in accordance with the scope of work of the role in the management system, and using the instant messaging account as a role-based instant messaging account), wherein the role-based instant messaging account is an account for instant messaging in the nature of a position number/station number. During the same period, an IM account can only be associated with one role, and one role can only be associated with one IM account. When the role-based instant messaging account of a role needs to be replaced, the role is unlinked from the original role-based instant messaging account and the role is associated with the new role-based instant messaging account.

The role-based instant messaging account is an instant messaging application (software) account on the system (that is, the instant messaging account is an instant messaging account on the system; in this case, the method further includes yourself the step of creating an instant messaging account/role-playing instant messaging account) and/or an instant messaging software account provided by a third party (that is, the instant messaging account is a QQ number, WeChat number or etc.).

A method for managing an instant messaging account in a management system further includes: creating an association between a user and a role, wherein for any user, role-based instant messaging accounts associated with all roles associated with the user are used as accounts records for instant messaging of a role-based user and/or employee corresponding to the user.

In the present invention, one instant messaging account is associated with one role. The employee receives a role-based instant messaging account through the role associated with the corresponding user. When an employee leaves, the system administrator (or corresponding administrator) directly unassociates the employee's user from the role, so that the terminated employee automatically loses permission to use the role-based instant messaging account, avoiding the risk of leaking sensitive enterprise information. When an employee is transferred from a position, the system administrator (or appropriate administrator) directly unassociates the employee from the original role and then associates the employee from the new role, so that the employee automatically receives a role-based instant messaging account corresponding to the new role. This ensures a smooth transfer and ensures that the instant messaging account used by the user is updated on time, without the messaging account transfer being delayed or missed, and does not impact the employee's normal use of the messaging account. The risks of leaking confidential information can also be eliminated.

Example of dismissal.

The role-based instant messaging account associated with the role production worker 1 is QQ number 123456. When the user corresponding to employee Zhang San is associated with production worker 1, Zhang San uses the QQ number 123456. When Zhang San quits, the system administrator ( or the corresponding administrator) directly unlinks the user corresponding to Zhang San from the role of production worker 1, and therefore Zhang San automatically loses the authority to use QQ number 123456, which avoids leaking the confidential information of production worker 1 to Zhang San due to transmission delay QQ numbers. When newly hired employee Li Si takes over Zhang San's work, the administrator directly associates the user corresponding to Li Si with production worker 1, so that Li Si is automatically authorized to use the role-specific QQ number 123456, according to the role production worker 1, without the need to re-allocate a new QQ number to Li Si. This operation is simple and fast, and the workload is greatly reduced. In addition, Li Si, who takes over the work, can view the archived messages previously exchanged between Zhang San and the QQ contact, thus achieving a better transmission effect, promoting the normal execution of the work, and achieving ease of use.

An example of a transfer from a position.

Employee Zhang San needs to be transferred from the production department to the after-sales department. The system administrator unlinks the user corresponding to Zhang San from the original role of production employee 1, and associates Zhang San to the new role of after-sales personnel 3 in the after-sales service department, so that Zhang San is automatically authorized to use the role-specific QQ number 987654 corresponding to the role of after-sales staff 3.

- 9 044374

Once an employee is transferred or terminated, a role-based instant messaging account associated with a role that needs to be allocated to another employee will not be allocated to an employee who does not perform the role's workload, since in the present invention the role is in the nature of a job number or station numbers. This prevents communication messages from leaking to unrelated parties even though the instant messaging account has been transferred to another user.

For example, the user corresponding to Employee A is associated with Device Vendor 1 and Software Vendor 1. Since Employee A is fired, Device Seller 1 is associated with the user corresponding to Employee B, and Software Seller 1 is associated with the user corresponding to Employee C. Thus, Employee B can only receive device sales information through the role-based messaging account. corresponding to the seller of device 1, without access to software sales information. Similarly, Employee C can only receive software sales information through the role-based messaging account corresponding to software seller 1, without access to device sales information.

In the present invention, a role is associated with a role-based instant messaging account according to the scope of work, so that the contents of messages from contacts in the messaging account cannot be shared with unrelated persons because the current user of the instant messaging role account Messaging is certainly currently responsible for the related work. For example, Role A's workload is attendance statistics, and Role A is associated with instant messaging account X. Therefore, once role A is associated with the user corresponding to employee A, employee A becomes the current user of A's instant messaging account X, and employee A's current workload certainly includes attendance statistics. Once a contact on IM account X sends an attendance-related message to IM account X, the attendance-related message will be invisible to anyone not associated with them.

Embodiment 2.

As shown in FIG. 5, the method of managing an instant messaging account in the management system includes the following steps: creating a role in the system. As shown in FIG. 4, the role represents an independent entity, not a group/class. During one period, one role can only be associated with a unique user, while one user is associated with one or more roles; creating an association of a role-based instant messaging account with a role according to the workload of the role in the management system, and during one period, one role-based instant messaging account can be associated with only one role, and one role can be associated with only one instant messaging account; and creating an association between a user and a role and for any user, using the role-based instant messaging accounts associated with all roles associated with the user as the role-based instant messaging accounts of the user and/or the employee corresponding to the user .

In this embodiment, once a role-based instant messaging account is associated with a role, the role-based instant messaging account associated with the role cannot be replaced; or Once a role-based instant messaging account is associated with a role and is in use, the role-based instant messaging account associated with the role cannot be replaced. Therefore, the role is associated with the IM account forever. If a role is disabled, the associated role-based IM account cannot be associated with any other roles, but a user associated with the controlling role corresponding to the role, or an employee corresponding to that user can still manage the account for role-based instant messaging. After you re-enable a role, it still uses the original associated role-based instant messaging account.

Once a role is associated with a role-based IM account, the role-based IM account associated with the role cannot be replaced. This way, all messages related to the role's workload are sent to the same IM account, and there is no need to worry about whether the IM account is changed midway.

For example, once role A is associated with instant messaging account X, role A cannot be associated with another instant messaging account, and instant messaging account X cannot be associated with another role.

Embodiment 3.

In this embodiment, the instant exchange account management method

- 10 044374 messages additionally includes: selecting one or more roles as controlling roles and setting up a controlled role for each controlling role respectively, so that the user associated with the controlling role, or the employee corresponding to the user, can manage accounts for instant sharing role-based messages associated with all controlled roles corresponding to the controlling role, wherein said operation includes viewing communication materials.

If communication content is not verified by a user associated with a controlled role, the communication content will still appear as being in an unverified state, but the controlling role's audit records will be displayed, such as the controlling role that performed the transactions, the user associated with the controlling role, and the employee corresponding to the user, operation time, operation content, etc.

Deletion of role-based IM account communications is subject to the consent and approval of the controlling role (or appropriate administrator), thereby preventing malicious deletion of useful communications materials.

Embodiment 4.

In this embodiment, a method for managing an instant messaging account further includes: selecting one or more roles as controlling roles, and setting a controlled role for each controlling role, respectively, so that: a user associated with a controlling role, or an employee corresponding user, can manage individual instant messaging accounts associated with all controlled roles corresponding to the controlling role; or a user associated with a controlling role, or an employee corresponding to a user, can manage individual instant messaging accounts of an employee corresponding to the user associated with all controlled roles corresponding to the controlling role.

Once authorized, the user associated with the supervising role has the right to view the IM account communications content of the user/employee associated with the supervising role, making it easier for the manager to monitor and manage the work of subordinates.

Embodiment 5.

In this embodiment, the method of managing an instant messaging account further includes: associating the individual instant messaging account with the user/employee (for the user/employee, this step can be further considered as associating the instant messaging account with the user/employee serving as the user's/employee's individual instant messaging account), and during the same period, one user/employee may be associated with only one individual instant messaging account, and one individual instant messaging account of an individual nature can only be associated with one user/one employee.

The personal instant messaging account is an instant messaging application (software) account on the system (i.e., the instant messaging account is an instant messaging account on the system; in this case, the method further includes step of creating an instant messaging account/personal instant messaging account) and/or instant messaging account software provided by a third party (i.e. the instant messaging account is a QQ number, WeChat number, etc. .P.).

Once a user/employee leaves, the Personal Instant Messaging account associated with the user/employee will be suspended and the Personal Instant Messaging account will also not be assigned to another employee/user, thereby preventing communication materials from being leaked to individual account for instant messaging. However, if allowed, the employee's manager can still manage the individual instant messaging account. If an employee is rehired by a company after being terminated, the employee's original IM account is automatically re-allocated to the employee/user in question (in an individual IM account once associated with the user, the association is always persistent and cannot be replaced; in a personal instant messaging account once associated with an employee, the connection is always persistent and cannot be replaced).

Once a Personal Instant Messaging account is associated with a user/employee, the Personal Instant Messaging account associated with the user/employee cannot be replaced; or Once a personal instant messaging account is associated with a user/employee and is in use, the personal instant messaging account associated with the user/employee cannot be replaced.

When a personal instant messaging account is associated with a user, the personal instant messaging account associated with the user is used as the personal instant messaging account of an employee corresponding to the user. When a personal instant messaging account is associated with an employee, the personal instant messaging account associated with the employee is used as the personal instant messaging account of the user corresponding to the specified employee.

A personal IM account is set up for a user/employee to send and receive personal information of the user/employee, thereby separating the work account (a role-based instant messaging account that is used to process work-related information). , corresponding to the account) from a personal account (a personal instant messaging account that is used to exchange personal information). Since a user/employee's individual IM account is never allocated to other employees/users, the user/employee does not have to worry about leakage of private information caused by handing over the messaging account after changing jobs.

For example, if employee A is late for work, but his manager refrains from deducting employee A's wages due to employee A's good business performance, the manager can explain this by sending a message to employee A's personal instant messaging account without worrying about the risk of adverse the impact on the company due to the leak of a message to a successor who takes over Employee A's job after Employee A's dismissal or transfer.

In this application, when creating a role, a department must be selected for it. After selecting a department for a role, the role belongs to the department. The role name is unique within the department, the role number is unique within the system, and the role is authorized based on the role's scope of work.

If the user needs to be transferred to another department, the method further includes the step of managing the transfer of the user to another department, specifically including: (1) unassociating the user with a role in the original department; and (2) associating the user with a role in the new department so that the user automatically receives the permissions associated with the instant messaging account associated with the role.

In the above embodiment, as shown in FIG. 4, in this application, the management of the instant messaging account assumes a role in the nature of an independent entity. Next, we analyze the advantages of the method of authorizing user powers based on a role that has the nature of an independent subject: The user defines (receives) powers through association with the role. If a user's permissions need to be changed, the permissions held by the role are adjusted to achieve the goal of changing the user permissions associated with the role. Once a user is associated with a role, they have full permissions to perform the operations of that role.

A role has a one-to-one relationship with a user (if a role is associated with one user, other users can no longer be associated with the role; if a role is not associated with a specific user, the role can be selected to associate with another user within one period, one role can be associated with only one user). A user is in a one-to-many relationship with roles (one user can be associated with multiple roles at the same time).

Role definition.

A role is not inherently a group/class/category/position/position/job type or the like, and is not collective in nature. The role is unique and represents an independent entity. The role used in an enterprise or institution is equivalent to the position number (in this case, the position number is not a position, and one position can simultaneously have several employees, but during one period one position number can correspond to only one employee).

For example, the following roles can be created in the company's system: General Manager, Deputy General Manager 1, Deputy General Manager 2, Beijing Sales Manager I, Beijing Sales Manager II, Beijing Sales Manager III, Shanghai Sales Engineer 1, Shanghai Engineer Sales 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5 and so on. Connection

- 12 044374 between users and roles is as follows: If Zhang San, an employee of a company, acts as deputy general manager 2 and at the same time acts as a manager of Beijing Sales Department I, then Zhang San should be associated with the role of deputy general manager 2 and the role of Beijing Sales Department Manager I, that is, Zhang San has the authority of two roles.

The concept of traditional roles is essentially a group/class/position/position/job type, and one role can correspond to multiple users. However, in this application, the concept of role is equivalent to the position number/station number, and is also similar to the role in film and television drama: one role during the same period (childhood, adolescence, middle age...) can only be performed by one actor or actress, but one actor or actress can play multiple roles.

After a role is created, a user can be associated with the role during the user creation process, or can be associated with a role at any time after the user is created. Once a user is associated with a role, the user can be released from the role's association at any time, and an association between the user and another role can be created at any time.

A role consists of: a job title and a job number, for example, shop 1 employee, shop 2 employee, shop 3 employee, etc. The role is an independent entity, and is equivalent to the concept of job number or station number, but is different from the role in a conventional system authority management. The concept of a role in a traditional authority management system is of a group or class nature, such as title, position, job type, or the like.

The following example shows the relationship between employee, user and role after Zhang San, an employee, joined the company as follows.

1. Recruitment: Once an employee is hired, the role of the corresponding job number or station number is directly selected for the user (employee) with whom he is associated. For example, when Zhang San joined the company (the company assigned a user to Zhang San) and works in Sales Department I, which will be responsible for selling refrigeration products in the Beijing area (the corresponding role is Sales Engineer 5 in Sales Department I), then user Zhang San is directly selected and assigned to the role of Sales Engineer 5.

2. Adding a position: After Zhang San has worked for a certain period of time, the company further appoints Zhang San to be in charge of the sales of television products in the Beijing area (the corresponding role is Sales Engineer 8 in Sales Department I) and serve as the head of the after-sales department service (corresponding role - head 1 of after-sales service). Therefore, user Zhang San additionally has two roles associated with him, that is, Sales Engineer 8 in Sales Department I and After-Sales Service Manager 1 in After-Sales Service Department. In this case, employee Zhang San is associated with three roles: sales engineer 5 and sales engineer 8 in sales department I, and after-sales service manager 1 in after-sales department, so user Zhang San has the authority of three roles. Thus, Zhang San has the authority of three roles.

3. Job Reduction: After some time, the company decided to give Zhang San the position of After-Sales Service Manager (according to the role of After-Sales Service Manager in the After-Sales Service Department), without further holding other positions. Therefore, the user Zhang San is associated with the role of After-Sales Service Manager in the After-Sales Service Department and is freed from the connection with the previous three roles (Sales Engineer 5 and Sales Engineer 8 in Sales Department I, and After-Sales Service Manager 1 of the Sales Department). In this case, the user Zhang San only has the authority of the After Sales Manager role in the After Sales Department.

4. Setting up permissions for a role (setting up permissions for the role itself): If the company decides to add permissions for the After Sales Manager, permissions need to be added only to the After Sales Manager role. As the authority of the after-sales service manager role increases, the user authority of Zhang San also increases.

5. Dismissal: Zhang San resigns after a year. You only need to unassociate the user Zhang San from the role of After-Sales Service Manager in the After-Sales Service Department.

For example, during dynamic company operations, hiring and firing of personnel often occurs continuously, but job numbers or station numbers rarely change (or even remain the same over a period of time).

Conventional authorization method: In the case of a large number of function points in the system, the authorization of conventional roles having a group or class nature involves a large and cumbersome workload, highly prone to errors, and errors are not easily detected in a short time, and may lead to to losses for the system user.

Authorization method according to this application: in this application, authorization is performed for

-

Claims (8)

a role having the nature of a position number or station number, and the user is associated with the role to determine (obtain) authority. Therefore, the user's permissions are governed only by the simple role-user association. Authorization management is simple, easy to use, understandable and unambiguous, which significantly improves the efficiency and reliability of authorization. The foregoing represents only preferred embodiments of the present invention. It should be understood that the invention is not limited to the embodiments disclosed herein and should not be construed to exclude other embodiments, but may be used in various other combinations, modifications and environments. It can also be modified through the above principles or technologies and knowledge in related fields. All changes and modifications made by those skilled in the art without departing from the spirit and scope of the present invention are intended to be within the scope of the appended claims. CLAIM 1. A method of managing an instant messaging account in a management system, comprising the following steps: creating roles in the system, each role representing an independent entity rather than a group/class, and during one period, one role can only be associated with a unique user, whereas the user is associated with one or more roles; and creating an association between the role-based instant messaging account and a role according to the scope of work of the role in the management system, wherein during one period, one role-based instant messaging account can be associated with only one role, and one role can be associated with only one instant messaging account; and creating an association between a user and a role, wherein for any user, the role-based instant messaging accounts associated with all roles associated with the user are used as the role-based instant messaging accounts of the user and/or employee corresponding to the user . 2. The method of claim 1, wherein once a role-based instant messaging account is associated with a role, the role-based instant messaging account associated with the role cannot be replaced; or Once a role-based instant messaging account is associated with a role and is in use, the role-based instant messaging account associated with the role cannot be replaced. 3. The method of claim 1, wherein when the role-based instant messaging account of a role needs to be replaced, the role is unlinked from the original role-based instant messaging account and the role is associated with the new role-based instant messaging account. . 4. The method of claim 1, further comprising selecting one or more roles as controlling roles and setting a controlled role for each controlling role respectively, so that a user associated with the controlling role or an employee corresponding to the user can manage accounts for the instant exchange of role-related messages associated with all controlled roles corresponding to the controlling role, wherein said operation includes viewing communication materials. 5. The method of claim 1, further comprising associating a personal instant messaging account with a user/employee, wherein one user/employee can be associated with only one personal instant messaging account during one period , while one personal instant messaging account can be associated with only one user/one employee. 6. The method of claim 5, wherein once the personal instant messaging account is associated with the user/employee, the personal instant messaging account associated with the user/employee cannot be replaced; or Once a personal instant messaging account is associated with a user/employee and is in use, the personal instant messaging account associated with the user/employee cannot be replaced. 7. The method of claim 5, wherein after associating the personal instant messaging account with the user, the personal instant messaging account associated with the user is used as the personal instant messaging account of the employee corresponding to the user . 8. The method of claim 5, wherein after linking the personal instant messaging account to the employee, the personal instant messaging account associated with the employee is used as the personal instant messaging account of the user corresponding to the employee . -