EA044529B1 - METHOD OF GRANTING RIGHTS TO PERFORM OPERATIONS WITH FORM FIELD VALUE - Google Patents

Description

Field of technology

The present invention relates to a method for granting rights to a form in administrative software systems such as ERP, and in particular it relates to a method for granting rights to perform operations on a form field value.

BACKGROUND OF THE INVENTION

In a traditional software system, the right to view a form can be separately granted based on the value of a form field. For example, the type of order form selected; The form fields that need to be managed are as follows: order number, customer name, customer address, phone number, contact, customer industry, product model, product quantity, unit price, etc. This allows system users to separately manage the right to view various order information on the order form. For example, a system user is allowed to view the customer's name, but is not allowed to view the phone number on the order form. However, the traditional software system has the following disadvantages.

(1) When granting an access right against a form field value, it is impossible to display the authorizing operator and the execution time of the last grant of rights operation; If an error is detected during entitlement of a form, there is no way to track or provide the current authorizing operator with a link to the entitlement time, making it difficult to use.

(2) It is not possible for multiple roles to grant group permissions to perform operations on a form field value, and the template permissions function is not supported. Each field must be configured separately for each entitlement, resulting in relatively low entitlement efficiency. A large-scale software system typically has an extremely large number of form fields, and the traditional way of granting rights is quite labor-intensive.

Role-based access control (RBAC) is one of the most studied and advanced database access control mechanisms in recent years. This mechanism is considered an ideal candidate to replace traditional mandatory access control (MAC) and selective access control (DAC) systems. The traditional selective access control system has high flexibility but low security. Traditional mandatory access control systems are highly secure but overly restrictive. A role-based access control system combines elements of both of the above systems: it is not only easy to manage, but at the same time reduces complexity, costs and the likelihood of errors. Therefore, role-based access control has developed rapidly in recent years. The basic idea of role-based access control (RBAC) is to separate different roles according to different functional positions in the organizational view of an enterprise, encapsulate access rights to database resources in roles, and allow users to indirectly access database resources by assigning different roles for users.

Large-scale application systems often have a large number of tables and views built into them, making database resource management and provisioning significantly more complex. It is extremely difficult for the user to directly control the granting of rights and database resources. This requires the user to have a deep understanding of the database structure and knowledge of the SQL language. As application system design or security requirements change, a large number of complex and extensive rights changes are required, which is very likely to result in information security vulnerabilities caused by unexpected errors in the provision of rights. Therefore, developing a simple and effective way to manage rights for large-scale application systems has become a common requirement for systems and system users.

The role-based access control mechanism allows you to easily and effectively manage system rights, which significantly reduces the burden and cost of system rights management, and also makes system rights management more compatible with the specific operational management of the application system.

However, traditional role-based user rights management and workflow management methods use a one-to-many role-to-user relationship mechanism, where the role represents a group/class. This means that one role can simultaneously correspond to or be associated with many users; the role is identical to the concepts of official position, position, work specialty, etc. In this communication mechanism, granting rights to users is mainly divided into three forms.

1. As shown in FIG. 1, direct provision of rights to users, the disadvantage of which is the high workload, as well as the frequency and volume of operations. When a change occurs in an employee (for example, transfer or termination), all employee-related processes must be adjusted accordingly. In particular, when replacing an employee in a management position within a business, many approval processes are involved. Because process adjustments are workload-intensive and extensive, errors or omissions may occur,

- 1 044529 affecting the normal activities of the enterprise and leading to unpredictable losses.

2. As shown in FIG. 2, when granting rights to a role with the properties of a class/group/position/job specialty (one role can be associated with several users), the user receives rights through his role, and the subject of the approval operation is the role with the properties of the group/class.

3. As shown in FIG. 3, the above two methods are combined.

In descriptions 2 and 3 above, it is necessary to grant rights to a role with class/group properties. The method of granting rights and managing the workflow through a role with the properties of a class/group/position/work specialty has the following disadvantages.

1. Difficulties in performing operations if user rights change. During actual use of the system, user rights are subject to frequent changes. For example, in the process of changing rights, when the rights of an employee associated with a role have changed, it is inappropriate to change the rights of the entire role because the rights of an individual employee have changed, since the role is also associated with other employees whose rights have remained unchanged. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the rights requirements. The above two processing methods not only take a long time, but also easily lead to errors in granting rights to a role in case the role has a large number of rights. The user has to do a lot of work, resulting in errors that result in losses for the system user.

When an employee/user's rights to perform form operations are changed, either the employee/user is removed from the role or a role is added to meet operational requirements. In the first case, the disadvantage is the same as that of the above method of direct user authorization. In the second case, adding a new role involves creating, associating, and granting rights to the role. In particular, if there are many roles and many users associated with the roles, it is difficult to remember which users are associated with the role.

2. It is difficult to remember the specific rights contained in a role for a long time. If a role has a large functionality of rights, over time it is difficult to remember the specific rights of the role, and even more difficult to remember the differences in rights of roles with identical rights. Rights of similar roles can also be easily confused with each other. If you need to associate a new user, it is impossible to determine exactly how to establish the association.

3. As user rights change, more roles are created (if no new roles are created, direct granting of rights to the user increases significantly) and it becomes more difficult to distinguish specific rights differences between roles.

4. When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and create roles for communication with other users. Such operations are not only complex and time-consuming, but also error-prone.

Brief description of the invention

Technical problem.

It is an object of the present invention to overcome the disadvantages of the prior art and to provide a method for granting rights to perform operations on a form field value, achieving separate granting of rights to perform operations on a form field value, and improving the quality of system management. At the same time, one role can be associated with only one user, as a result, in the process of applying the system, the efficiency of rights management is greatly improved, the dynamic granting of rights is simplified, it becomes more convenient, clearer and more understandable, and the efficiency and reliability of granting rights is improved .

Technical solutions.

The problem of the present invention is solved by the following technical solutions.

The method for granting rights to perform operations with the value of a form field includes the stage of granting rights to perform operations with the value of the form field and the stage of selecting an authorized person, while the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict ;

The stage of granting rights to perform operations with the value of a form field includes the following stages:

S1) selecting the form in respect of which it is necessary to grant access rights, and displaying the form fields in respect of which it is necessary to manage access rights to perform operations;

S2) separate granting of rights to perform operations with each field value;

a specified authorized entity represents one or more roles, a specified role represents a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more several roles.

These operation rights include either the view right, the edit right, or both the view and edit rights.

Modes for displaying a field value that does not have view rights include (1) displaying the field corresponding to the field value, but hiding the field value using a hide character;

(2) not displaying either the field value or the field corresponding to the field value.

One and only one authorization is selected and, when selecting a form for which access rights are to be granted, the authorizing operator and transaction time associated with the last authorization of that authorization for that form field value are displayed.

The specified role belongs to a specific department, the role is the only one within the department, and the granting of rights to the role is carried out on the basis of the job responsibilities of the role, and the user receives rights through the role associated with him.

The name of the specified role is unique within the department, and the role number is unique in the system.

When a user is transferred to another department, the user's association with a role in the previous department is removed and the user is associated with a role in the new department.

The method for granting rights to perform operations on a form field value further includes the step of granting rights with respect to a template for granting rights:

(1) selecting the authorized person and the form for which access rights are to be granted, with one or more roles being selected as the authorized person;

(2) granting rights to the authorized person, selecting an existing role or a created template as a template for granting rights, and granting the authorized person the rights to perform operations on the value of the form field in accordance with this authorization template;

(3) preservation of changed or not changed rights and acquisition by the authorized person of the rights to perform operations with the value of the form field.

The method for granting rights to perform operations with the value of a form field includes the stage of granting rights to perform operations with the value of the form field and the stage of selecting an authorized person, while the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict ;

The stage of granting rights to perform operations with the value of a form field includes the following stages:

S1) selection of the form in respect of which access rights must be granted;

S2) selection of rights to perform operations in respect of which access rights are granted;

S3) setting selected rights to perform operations on the form field; thus, in relation to the set field, there are selected rights to perform operations;

a specified authorized entity represents one or more roles, a specified role represents a single entity rather than a group/class, and one role can only be associated with one user while one user can be associated with one or more roles.

Positive effects.

The present invention has the following beneficial effects.

1) The present invention makes it possible to provide separate granting of rights to perform operations on the value of a form field, thereby improving the quality of system management. Operation rights include the view right and the edit right, which are especially relevant in situations where you need to separately grant access rights to the value of a form field. For example, on an order form, a specific system role is allowed to view the order number, customer name, customer address, customer industry, product model, product quantity, and unit price, but is not allowed to view the contents (i.e., field value) of sensitive fields such as like phone number and contact.

This method allows you to quickly make separate grants of rights. For example, a system role is allowed to view the contents of the unit price field, but is not allowed to change the contents of the unit price field, and this method also allows you to quickly set permissions.

2) Once one and only one authorizer and the form to which the access right is to be granted is selected, the authorizing operator and transaction time associated with the last authorization to perform operations on the value of the form field are displayed. Displaying the last authorization statement allows you to track if an error is detected in the granted rights regarding the value of a form field, and displaying the time of the last operation allows you to determine whether you need to re-grant it.

- 3 044529 access rights regarding the form field value.

For example, Li Si last granted rights to authorized person Zhang San to perform operations on a field value in the contract form on May 21, 2015 at 11:00. In the case where Zhang San is selected as the authorized person and the contract is selected as the form to be granted access rights, the current authorization operator is shown that Li Si completed the last grant of rights to Zhang San regarding the contract form on May 21, 2015 at 11: 00.

If Zhang San should not have the right to view the contents of the confidential field, but obtained the right to view the contents of the confidential field as a result of the last grant of rights, then in the subsequent tracking process, the responsible persons can be found by finding the last authorizing operator.

In addition, for example, the operator needs to grant rights to 100 authorized persons regarding the values of the fields of the contract form, but on that day the operator granted rights to only 70 authorized persons. When the operator continues to grant rights the next day, the operator can view the last time each authorizer was granted rights to determine whether the authorized person needs to be granted rights or not. All authorized persons who were granted rights during a specified period of time can also be found. Viewing the time when rights were last granted to an authorized person allows you to see how long the rights of the authorized person remained unchanged, which helps determine whether rights need to be re-granted to the authorized person.

3) This method allows you to simultaneously select several authorized roles to carry out group granting of rights, which increases the efficiency of granting rights; In addition, this method supports granting permissions on the template, i.e. select an existing role or a created template as the entitlement template and grant (update) the authorized person the rights to perform operations on the form field value in accordance with this entitlement template (whose access rights are retained after a minor change). The entitlement operation is simple and efficient. The two types of methods are combined, which significantly increases the efficiency of granting rights to perform operations with the value of a form field in the system.

4) In this invention, a role is associated with a user on a one-to-one basis. During the same period, one role can be associated with only one user, while one user can be associated with one or more roles. The advantage is that to obtain rights, you only need to associate a user with a role (ie, the user receives the rights of the associated role) and the changes to the role's rights are much smaller than changes to the user's rights in the traditional mechanism. Minor changes occur in the number of roles, each of which represents a separate entity (essentially a job number or workstation number). Despite the high turnover of personnel in the position number/workplace number, changes are insignificant (up to no changes in a certain period of time, i.e. the role does not change). This greatly simplifies the management of user rights and reduces system overhead.

5) Operations such as dynamic management, recruitment and transfer of personnel are simple, convenient, efficient and highly reliable. Applying for a job, leaving or transferring through the approval process is straightforward. When an employee or user changes, the approval process does not need to be reset (just unlink or associate the user with a role). For a user who is no longer responsible for a given role, the role association is unassigned, and the user who accepts the role becomes associated with the job number role. A user associated with a role automatically receives the tasks and operations rights associated with that role without re-granting the role's rights, greatly improving the efficiency, security, and reliability of process setup.

For example, because the user Zhang San moves or leaves his position, Zhang San no longer works as the buyer 3 role and Zhang San's association with the buyer 3 role is canceled. Meanwhile, Li Si takes over the work in the role of buyer 3, then Li Si is associated with this role, as a result of which Li Si automatically acquires the rights to perform operations on the form field value in the role of buyer 3.

6) The traditional rights management mechanism defines a role as a property of a group, work specialty, class, etc. The role to the user is in a one-to-many relationship. During actual use of the system, user rights are subject to frequent changes. For example, when processing changes to an employee's rights when the rights of an employee associated with a role have changed, it is not practical to change the rights of the entire role because the rights of an individual employee have changed because the role is also associated with other employees whose rights have remained the same. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the rights requirements. The above two processing methods not only take a lot of time, but also easily lead to errors in granting role rights if the role has a large number of

- 4 044529 by the number of rights. The user has to do a lot of work, resulting in errors that result in losses for the system user.

However, according to the method of this invention, since a role is a separate entity, the problem can be solved by changing the rights of the role. Although the method of the present invention is likely to increase the workload during system initialization through copying or the like, creating a role and granting rights to a role can be done more efficiently than with traditional roles with group properties. class. Since there is no need to consider the commonality of roles with group/class properties when providing association with users, the solutions provided in this invention make the setting of rights clear and understandable. Especially after the system has been used for a certain period of time (after dynamically changing user rights/roles), the solutions provided in this invention can significantly improve the efficiency of rights management for system users, making dynamic rights granting simpler, more convenient, more clear and understandable, and also improve the efficiency and reliability of setting rights.

7) The traditional way of granting rights based on a role with a group property is error prone. The method provided in this invention significantly reduces the likelihood of errors in granting rights, since in the method of this invention the role is considered only as a separate entity, without taking into account the commonality of several users associated with the role with the group property in the traditional way. Even if permission errors occur, only the user associated with the role is affected. However, with a traditional role with a group property, all users associated with the role are affected. Even if errors occur in the granting of rights, the correction method in this invention is simple and takes a short period of time, while in the case of a traditional role with a group property, the commonality of rights of all users associated with the role must be taken into account when correcting errors. If a role has a lot of functionality, the fix is lengthy, complex, and error-prone, and in many cases the problem cannot be resolved until a new role is created.

8) In the traditional way of granting rights based on a role with a group property, if the roles have a large functionality of rights, over time it is difficult to remember the specific rights of the roles, and it is even more difficult to remember the differences in rights between roles with identical rights. If you need to associate a new user, it is impossible to determine exactly how to establish the association. In the method of this invention, the role itself is a job number/workstation number property, which greatly simplifies selection.

9) When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and create roles for communication with other users. Such operations are not only complex and time-consuming, but also error-prone.

The method in this invention is as follows. The transferred user is associated with multiple roles. When you transfer a user, you first unassociate the user from roles in the previous department (unlinked roles can be reassigned to other users) and then associate the user with a role in the new department. The operation is simple and error-free.

Description of the attached graphic materials

In fig. 1 is a schematic representation of direct granting of rights to a user in a prior art system.

In fig. 2 is a schematic representation of granting rights to a role with a group/class property in the prior art.

In fig. 3 is a schematic representation of direct granting of rights to both a user and a role with a group/class property in a prior art system.

In fig. 4 is a schematic illustration of granting rights to a user in a system through a role with a separate entity property according to the present invention.

In fig. 5 is a schematic view showing a selection of one authorized person and form according to the present invention.

In fig. 6 is a schematic diagram showing a selection of multiple authorized persons and a form according to the present invention.

In fig. 7 is a schematic diagram of granting rights to an authorized person by a template for granting rights according to the present invention.

In fig. 8 is a schematic diagram of an order form according to an embodiment of the present invention.

Embodiments of the Invention

Below, the technical solutions according to the present invention are described in more detail with reference to the accompanying drawings, however, the scope of protection of the present invention is not limited to the following.

- 5 044529

Option 1.

According to this embodiment, the fields for which operation rights need to be managed are first set, and then the rights to perform corresponding operations are set.

The method for granting rights to perform operations with the value of a form field includes the stage of granting rights to perform operations with the value of the form field and the stage of selecting an authorized person, while the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict ;

The stage of granting rights to perform operations with the value of a form field includes the following stages:

S1) selecting the form in respect of which it is necessary to grant access rights, and displaying the form fields in respect of which it is necessary to manage the rights to perform operations;

S2) separate granting of rights to perform operations with each field value (granting access rights in relation to fields displayed in S1 for which it is necessary to manage rights to perform operations; values of fields that are not displayed in S1 and do not require rights management, by default have view and/or edit rights), where operation rights include either view or edit rights, or both view and edit rights.

After completing the settings, the rights of the authorized person to view or edit the contents (field values) of each field in the form can be determined.

The present invention allows you to separately grant rights to perform operations on the value of a form field, which improves the quality of system management. Perform rights include view rights and edit rights, which are especially relevant in situations where you need to grant appropriate rights to the value of a form field. For example, in the order form of the system role, Clerk 1 (Zhang San) is allowed to view the order number, customer name, customer address, customer industry, product model, product quantity, and unit price, but is not allowed to view the contents (i.e., field values) sensitive fields such as phone number and contact; This method allows you to quickly make separate grants of rights. In addition, for example, clerk 1 is allowed to view the contents of the unit price field, but is not allowed to change the contents of the unit price field; This method also allows you to quickly set rights. Visualization of the installations is shown in Fig. 5.

In this embodiment, as shown in FIG. 4, the authorized person represents one or more roles, the specified role represents a separate entity, not a group/class, and in the same period one role can be associated with only one user, while one user is associated with one or more roles. The role belongs to a specific department, the role is the only one within the department, and the granting of rights to the role is carried out on the basis of the job responsibilities of the role, and the user receives rights through the role associated with him. The name of the specified role is unique within the department and the role number is unique in the system. When a user is transferred to another department, the user's association with a role in the previous department is removed and the user is associated with a role in the new department.

The following is an analysis of the advantages of the method of granting the user rights to perform operations with a field value through a role with the property of a separate entity: the user defines (receives) rights through his association with the role. If it is necessary to change the user's rights, then the rights belonging to the role are adjusted in accordance with the purpose of changing the rights of the user associated with the role. Once a user is associated with a role, the user has all rights of that role to perform operations.

A role has a one-to-one relationship with a user: if a role is associated with one user, other users can no longer be associated with the role; if the role is not associated with a specific user, then the role can be selected to associate with another user; those. in the same period, one role can be associated with only one user. A user to a role is in a one-to-many relationship (one user can be associated with several roles at the same time).

Role definition. A role is characterized not by the properties of a group/class/category/position/official position/job specialty, etc., but only by the property of the absence of collectivity. A role is unique and is a separate entity. Applied in an enterprise or institution, a role corresponds to a position number (while a position number is not a position, one position can have several employees at the same time, but one position number can correspond to only one employee during the same period).

For example, the following roles can be created in the company's system: General Director, Deputy General Manager 1, Deputy General Manager 2, Beijing Sales Manager I, Beijing Sales Manager II, Beijing Sales Manager III, Shanghai Sales Engineer 1, Shanghai Engineer Sales 2, Shanghai Sales Engineer 3,

- 6 044529

Shanghai Sales Engineer 4, Shanghai Sales Engineer 5, etc. The relationship between users and roles is as follows: if Zhang San, an employee of a company, acts as deputy general manager 2 and at the same time acts as a manager

Beijing Sales Department I, then Zhang San should be associated with the role of Deputy General Manager 2 and the role of Beijing Sales Department I manager, i.e. Zhang San has the rights of two roles.

The concept of a traditional role presupposes the properties of a group/class/position/job position/job specialty, while one role can correspond to several users. In this invention, the concept of a role corresponds to a position number/job position number, and is also similar to a role in films and television series: one role in the same period (in childhood, adolescence, adulthood, etc.) can be performed by only one actor, and one actor may be able to play several roles.

Once a role is created, the role can be associated with the user during the user creation process, or can be associated with the user at any time after the user is created. Once a user is associated with a role, the user can be released from the role's association at any time, and an association between the user and another role can be created at any time.

A role consists of job title + job number. For example, production worker of workshop 1, production worker of workshop 2, production worker of workshop 3, etc. A role is an independent person and is the same as a job number or workstation number, but is different from a role in a traditional rights management system. A role in traditional rights management systems represents properties of a group/class (for example, position, official position, job specialty, etc.).

The following example shows the relationship between employee, user, and role after Zhang San, an employee, joins the company.

1. Recruiting. Once an employee is hired, he is directly associated with the role of the corresponding job number or workstation number of the user (employee). For example, when Zhang San joined the company (the user Zhang San is created in the company for Zhang San) and works in the sales department 1, responsible for the sales of refrigeration equipment in the Beijing area (the corresponding role of sales engineer 5 belongs to the sales department 1), then the user Zhang San directly selects and becomes associated with the role of Sales Engineer 5.

2. Adding a position. After Zhang San has worked for a certain period of time, the company appoints Zhang San to be in charge of TV sales in the Beijing area (the corresponding role of Sales Engineer 8 belongs to Sales Department 1), as well as the head of the after-sales department (the role corresponding to the head of After-sales department 1 ). Thus, two roles, namely Sales Engineer 8 in Sales Department 1 and After-Sales Service Manager 1 in After-Sales Service Department, are further associated with the user Zhang San. In this case, employee Zhang San is associated with three roles: Sales Engineer 5, Sales Engineer 8 in Sales Department 1, and After-Sales Service Manager 1 in After-Sales Service Department. Thus, the user Zhang San has the rights of three roles.

3. Job reduction. After some time, the company decided to appoint Zhang San as the manager of the after-sales service department (the corresponding role of the after-sales service manager in the after-sales service department) without combining with other positions. Thus, the user Zhang San becomes associated with the role of After-Sales Service Manager in the After-Sales Service Department and is freed from the association with the previous three roles (Sales Engineer 5, Sales Engineer 8 in Sales Department 1, and After-Sales Service Manager 1 in the After-Sales Service Department ). In this case, the user Zhang San only has the rights of the after-sales service manager role in the after-sales service department.

4. Setting up role rights (setting up the rights of the role itself). If a company decides to add rights to the After Sales Manager role, only the After Sales Manager role needs to have rights added. With the addition of the after-sales service manager role rights, Zhang San's user rights are also added.

5. Dismissal. A year later, Zhang San resigns. You only need to unlink the user Zhang San from the After Sales Service Manager role in the After Sales Service Department.

For example, in the dynamic process of a company, recruitment and dismissal of personnel often occurs continuously, but job numbers or workstation numbers rarely change (up to no change for a certain period of time).

Traditional way of granting rights: In case of a large number of system functions, traditional granting of rights to roles with group/class properties is combined with a large and voluminous workload, as well as a high degree of error proneness; In a short period of time, errors are not easy to detect, which usually leads to losses for the system user.

- 7 044529

Method for granting rights according to the invention. In this invention, rights are granted to a role, which is essentially a job number or workstation number, and the user is associated with the role to determine (obtain) the rights of the role. Thus, user rights are managed only through a simple user-role connection. Rights management is simple, easy to implement, clear and understandable, which greatly improves the efficiency and reliability of rights provision.

Embodiment 2.

In this embodiment, one or more authorized persons may be selected, but only one form may be selected for which the access right must be granted. When you select one and only one authorizer, and when you select a form for which you want to grant access, the authorizing operator and transaction time associated with the last grant of rights to that authorize for that form field value are displayed.

As shown in FIG. 5, in the case where one authorized person and one form for which access rights must be granted are selected, the authorizing operator who has granted the rights to perform operations on this form field value is displayed, and the operation time is also displayed. The current state of the rights of this authorized person to perform operations with the value of the form field is also displayed, after which the current state is changed and saved to obtain new rights to perform operations with the value of the field.

As shown in FIG. 6, if several authorized persons are selected and a form in respect of which it is necessary to grant access rights, then the last authorizing operator and the time of granting rights to perform operations with the value of the form field are displayed as empty, and it is also impossible to display the status of execution rights for all selected authorized persons operations with the value of a form field.

Displaying the last authorization statement allows you to find the person responsible if an error is detected in the rights granted for a form field value, and displaying the time of the last operation allows you to determine whether rights for a form field value need to be re-granted.

For example, Li Si last granted rights to authorized person Zhang San to perform operations on a field value in the contract form on May 21, 2015 at 11:00. In the case where Zhang San is selected as the authorized person and the contract is selected as the form to be granted access rights, the current authorization operator is shown that Li Si completed the last grant of rights to Zhang San regarding the contract form on May 21, 2015 at 11: 00.

If Zhang San should not have the right to view the contents of the confidential field, but obtained the right to view the contents of the confidential field as a result of the last grant of rights, then in the subsequent tracking process, the responsible persons can be found by finding the last authorizing operator.

In addition, for example, the operator needs to grant rights to 100 authorized persons regarding the values of the fields of the contract form, but on that day the operator granted rights to only 70 authorized persons. When the operator continues to grant rights the next day, the operator can view the last time each authorizer was granted rights to determine whether the authorized person needs to be granted rights or not. All authorized persons who were granted rights during a specified period of time can also be found. Viewing the time when rights were last granted to an authorized person allows you to see how long the rights of the authorized person remained unchanged, which helps determine whether rights need to be re-granted to the authorized person.

Embodiment 3.

According to this embodiment, modes for displaying a field value for which there is no view right include (1) displaying a field corresponding to the field value, but hiding the field value through a hide character; for example, as shown in FIG. 8, the phone number and contact fields are displayed, but the contents of the fields are hidden by the * symbol;

(2) not displaying either the field value or the field corresponding to the field value.

When displaying values, fields with and without change access must also be separated. For example, as shown in FIG. 8, the value of the field for which there is no right to change is displayed as a gray shade.

Specifically, one form includes basic and specification fields. Specification fields are the names of the columns in the specification list on the form. For example, on an order form, the main fields include order number, customer name, customer address, phone number, contact, customer industry, etc.; Specification fields include product model, product quantity, unit price, etc.

In a preferred embodiment, when the authorizing operator grants rights to perform operations on the value of a form field, the main fields and the specification fields are displayed differently, which helps the authorizing operator distinguish them at the time of granting rights. As shown in FIG. 5-7, the main fields (order number, customer name, customer address, telephone number, contact and customer industry) can be displayed in normal font, and the specification fields (product model, production quantity and unit price) can be displayed in italics.

Embodiment 4.

According to this embodiment, the method for granting rights to perform operations on a form field value further includes the step of granting rights with respect to a template for granting rights:

(1) selecting the authorized person and the form for which access rights are to be granted, and selecting one or more roles as the authorized person;

(2) grant rights to the authorized person, select an existing role or a created template as the grant template, and grant the authorized person the rights to perform operations on the form field value in accordance with this grant template;

(3) retain the modified or unmodified rights and the authorized person acquires the rights to perform operations with the value of the form field.

As shown in FIG. 7, first, in the template granting method, select the authorized person, clerk 1 (Zhang San), and the order form for which the access grant is to be granted; then the created template 1 is selected as the template for granting rights: the rights to perform operations with the value of the form field in the created template 1 are used as the rights to perform operations with the value of the form field of clerk 1 (Zhang San); and finally, they save the changed or not changed rights in the created template 1 and clerk 1 (Zhang San) acquires the rights to perform operations with the value of the form field.

This method allows you to simultaneously select multiple authorized roles to perform group granting of rights, which improves the efficiency of granting rights; In addition, this method supports granting permissions on the template, i.e. select an existing role or a created template as the entitlement template and grant (update) the authorized person the rights to perform operations on the form field value in accordance with this entitlement template (whose access rights are retained after a minor change). The entitlement operation is simple and efficient. The two types of methods are combined, which significantly increases the efficiency of granting rights to perform operations with the value of a form field in the system.

Embodiment 5.

According to this embodiment, first the operation rights are selected and then the field for which the operation rights are to be set is set.

The method for granting rights to perform operations with the value of a form field includes the stage of granting rights to perform operations with the value of the form field and the stage of selecting an authorized person, while the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict ;

The stage of granting rights to perform operations with the value of a form field includes the following stages:

S1) selection of the form in respect of which access rights must be granted;

S2) selection of rights to perform operations in respect of which access rights are granted;

S3) setting selected rights to perform operations on the form field; thus, in relation to the set field, there are selected rights to perform operations (that is, there are corresponding rights to perform operations on this field value);

a specified authorized entity represents one or more roles, a specified role represents a single entity rather than a group/class, and one role can only be associated with one user while one user can be associated with one or more roles.

The above are only preferred embodiments of the present invention, and it should be understood that the present invention is not at all limited to the embodiments disclosed herein, which should not be construed as exclusive of other embodiments, but can be applied to any other combinations, variations and environments, Therefore, without deviating from the discussed essence of the present invention, changes can be made to it based on the above ideas or technologies or knowledge from related fields.

Moreover, unless there is a departure from the spirit and scope of the present invention, changes and modifications suggested by those skilled in the art are intended to be within the scope of protection of the present invention as defined by the appended claims.

Claims (3)

1. A method for granting rights to perform operations with the value of a form field, characterized in that it includes the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person, with the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict; The stage of granting rights to perform operations with the value of a form field includes the following stages: S1) selecting the form in respect of which it is necessary to grant access rights, and displaying the form fields in respect of which it is necessary to manage access rights to perform operations; S2) separate granting of rights to perform operations with each field value; the specified authorized person represents one or more roles, the specified role represents a separate entity and not a group/class, and in the same period one role can be associated with only one user, while one user is associated with one or more roles; in this case, the specified rights to perform operations include either the right to view, or the right to change, or the rights to both view and change. 2. The method of granting rights to perform operations with the value of a form field according to claim 1, characterized in that the modes for displaying the value of a field for which there is no right to view include (1) displaying the field corresponding to the field value, but hiding the field value through the hide symbol; (2) does not display either the field value or the field corresponding to the field value. 3. The method of granting rights to perform operations with the value of a form field according to claim 1, characterized in that one and only one authorized person is selected and when selecting a form in respect of which it is necessary to grant access rights, the authorizing operator and the time of the operation associated with the last grant of rights to this authorized person with respect to this form field value. 4. A method for granting rights to perform operations with the value of a form field according to claim 1, characterized in that the specified role belongs to a specific department, the role is the only one within the department, while the rights of the role are granted based on the job responsibilities of the role, and the user receives rights through the associated role. 5. The method of granting rights to perform operations with the value of a form field according to claim 4, characterized in that the name of the specified role is the only one within the department, and the role number is the only one in the system. 6. The method of granting rights to perform operations with the value of a form field according to claim 4 or 5, characterized in that when the user is transferred to another department, the user’s connection with the role in the previous department is deleted and the user is associated with the role in the new department. 7. The method for granting rights to perform operations with the value of a form field according to claim 1, characterized in that it additionally includes the stage of granting rights in relation to the template for granting rights: (1) selecting the authorized person and the form for which access rights are to be granted, with one or more roles being selected as the authorized person; (2) granting rights to the authorized person, selecting an existing role or a created template as a template for granting rights, and granting the authorized person the rights to perform operations on the value of the form field in accordance with this authorization template; (3) preservation of changed or not changed rights and acquisition by the authorized person of the rights to perform operations with the value of the form field. 8. A method for granting rights to perform operations with the value of a form field, characterized in that it includes the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person, with the order of priority between the stage of granting rights to perform operations with the value of a form field and the stage of selecting an authorized person is not strict; The stage of granting rights to perform operations with the value of a form field includes the following stages: S1) selection of the form in respect of which access rights must be granted; S2) selection of rights to perform operations in respect of which access rights are granted; S3) setting selected rights to perform operations on the form field; thus, in relation to the set field, there are selected rights to perform operations; a specified authorized entity represents one or more roles, a specified role represents a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more - 10 044529 roles; in this case, the specified rights to perform operations include either the right to view, or the right to change, or the rights to both view and change.