EA044830B1 - METHOD OF GRANTING RIGHTS TO PERFORM OPERATIONS WITH A STATISTICAL TABLE - Google Patents

Description

Field of technology

The present invention relates to a method for granting rights to perform statistical table operations in administrative software systems such as ERP and CRM.

BACKGROUND OF THE INVENTION

The concept of a statistical table and the concept of a form are different: (1) granting access rights on a form is mainly characterized by granting rights to add/delete/modify/view operations of database data/form data, but in a statistical table the database data/form data does not change , but only request data in accordance with a specific need; (2) a form represents a specific activity object, such as an order, contract, client, etc., and each form corresponds to a single activity object; for example, client 001 on a client form represents one single client 001 (client 001 represents a single form object/data element); however, the statistical table is mainly used to output statistics of certain/multiple forms according to a certain need, and the row data in the statistical table does not represent an activity object, but a statistical result; For example, statistics of sales contracts are output by the contract signing department, and the statistics of each line represent the statistics of all sales contracts corresponding to one department, and these statistics may include statistics of the number of signed contracts, statistics of the amount of signed contracts, statistics of the amount payments received, statistics on the number of orders, etc.

Statistical tables are used to collect statistics and display certain content or certain data in the system. Traditional software systems have the function of displaying and browsing statistical tables, but as for authorized objects, they either can view the contents of all columns of the statistical table, or the entire table cannot be viewed, that is, detailed control cannot be carried out in traditional systems rights to perform operations with each column of the statistical table, as a result of which there are significant restrictions in the process of using the system. For example, in a statistical table, a statistical table of trading activity results, there are the following column names: employee number, full name, employee department, position, amount of signed contracts, amount of payments received, amount of deductions and status of payments. If the financial department employee Zhang San needs to check the data on the amount of payments received, Zhang San must be granted the right to view this statistical table, and after granting the rights, Zhang San will be able to view the contents of all columns of this statistical table, including the amount of signed contracts, the amount of deductions and other confidential/private data (but the company does not need Zhang San to view the amount of signed contracts, the amount of deductions and other confidential/private data).

In addition, traditional software systems also have the following disadvantages: (1) in the process of granting rights, the authorizing operator and transaction time associated with the last grant of rights cannot be displayed, and when errors in the granted rights are detected, the responsible person cannot be found, and It is also impossible to provide the current authorizing operator with a reference to the last time rights were granted, which complicates the use of the system. (2) the rights to perform statistical table operations cannot be granted to a group of authorized objects, and the template rights granting function is not supported, resulting in the efficiency of granting rights is relatively low; and large-scale software systems have a large number of statistical tables, and granting rights using traditional methods involves a large workload.

Role-based access control (RBAC) is one of the most studied and advanced database access control mechanisms in recent years. This mechanism is considered an ideal candidate to replace traditional mandatory access control (MAC) and selective access control (DAC) systems. The traditional selective access control system has high flexibility but low security. Traditional mandatory access control systems are highly secure but overly restrictive. A role-based access control system combines elements of both of the above systems: it is not only easy to manage, but at the same time reduces complexity, costs and the likelihood of errors. Therefore, role-based access control has developed rapidly in recent years. The basic idea of role-based access control (RBAC) is to separate jobs with different functions according to the organizational view of the enterprise, encapsulate access rights to database resources in roles, and provide users with indirect access to database resources by assigning different roles to users.

Large-scale application systems often contain a large number of forms and tables, which makes managing database resources and granting rights significantly more complex. It is extremely difficult for users to directly manage database resources and permissions, which requires users to have a deep understanding of the database structure and knowledge of the SQL language. As application system design or security requirements change, a large number of complex and confusing access rights changes are required, which is very likely to result in information security vulnerabilities caused by unexpected errors in the granted rights. Therefore, developing a simple and effective way to manage rights in large-scale application systems has become a common need for systems and system users.

The role-based access control mechanism allows you to manage system rights easily and efficiently, which greatly reduces the burden and cost of system rights management, and makes system rights management more compatible with application system operational management standards.

However, traditional role-based user rights management uses a one-to-many role-to-user relationship mechanism, with the role representing a group/class. This means that one role can simultaneously correspond to/be associated with many users, and the role corresponds to the concepts of official position/position/work specialty, etc. In this communication mechanism, granting rights to users is mainly divided into three forms:

1. As shown in FIG. 1, rights are directly granted to users; among the disadvantages of this method of granting rights, one can note the high workload, as well as the frequency and volume of operations; When changes occur to an employee (for example, transfer or dismissal), all employee-related processes must be adjusted accordingly. In particular, when there is a change in management in a company that deals with a large number of access rights, changing rights is complex and involves a large workload, resulting in possible errors or omissions that affect the normal operation of the enterprise and lead to unpredictable losses.

2. As shown in FIG. 2, rights are granted (one role can be associated with several users) to a role (with the properties of a class/group/position/job specialty) and the user receives rights through the role, while the subject of granting rights is the role with the properties of the group/class.

3. As shown in FIG. 3, the two methods discussed above are combined.

In the descriptions 2 and 3 discussed above, rights must be granted to roles with a class/group property. The method of granting rights and managing the work process through a role with a class/group/position/work specialty property has the following disadvantages:

1. Difficulties in performing operations if user rights change. During actual use of the system, user rights are subject to frequent changes. For example, in the process of changing rights, when the rights of an employee associated with a role have changed, it is inappropriate to change the rights of the entire role because the rights of an individual employee have changed, since the role is also associated with other employees whose rights have remained unchanged. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the need for rights. The above two processing methods not only take a long time, but also easily lead to errors in the rights granted to the role in case the role has a large number of rights. The user has to perform complex and confusing operations, resulting in errors that result in losses for the system user.

When changing the rights of an employee/user to perform operations with a form, to solve this problem either the employee/user is removed from the role or a new role is added. In the first case, the disadvantage is the same as that of the method discussed above - directly granting rights to the user. In the second case, adding a new role involves creating, associating, and granting rights; in particular, if there are many roles and many users associated with the roles, it is difficult to remember which users are associated with the role.

2. It is difficult to remember specific rights contained in roles over a long period of time. If a role has a large set of rights functions, it is difficult to remember the specific rights of the role over time, and even more difficult to remember the differences in rights of roles with identical rights; rights of identical roles are also easy to confuse with each other. If you need to associate a new user, it is impossible to determine exactly how to establish the association.

3. As changes occur in user rights, more and more roles are created (if new roles are not created, direct granting of rights to users increases significantly), and it becomes more difficult to discern specific differences in role rights.

4. When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and separately create roles for linking with other users. Such operations are not only complex and time-consuming, but also error-prone.

- 2 044830

Brief description of the invention Technical problem

The object of the present invention is to overcome the disadvantages of analogues known from the prior art, and to provide a method for granting rights to perform operations on a statistical table, providing a separate grant of rights to perform operations in relation to each column of the statistical table, expanding the scope of application of statistical tables, increasing quality of system management, as well as meeting the needs of application in the real process of operational management in enterprises and institutions.

Technical solutions

The problem of the present invention is solved by the following technical solutions: a method for granting rights to perform operations with a statistical table, including the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized object, with the order of priority between the stage of granting rights to perform operations with a statistical table and the stage the choice of the authorized object is not strict; The stage of granting rights to perform operations with a statistical table includes the following stages:

S1: select one statistical table for which you want to grant access rights, and display the names of the columns on which you want to manage permissions to perform operations;

S2: separate permission to perform operations on each column; This step of selecting an authorizable object consists of selecting one or more authorizable objects.

A method for granting rights to perform operations on a statistical table, further including the step of setting a time period in respect of which the access right is granted for a column with a time property, selecting one column with a time property, after which the authorizing operator to perform the corresponding setting of the time period is displayed six types of formats for setting the time period for which access rights are granted; these six types of formats for setting the time period in respect of which the access right is granted, in particular, include: a period of time from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; the time period in which the time column value is a null value; and a period of time from the time of implementation of the system to the current point in time, wherein said period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time column is a blank value.

The specified operation rights include the view/query right.

The display mode of a column for which you do not have view permission includes one or more of the following: (1) displaying the name of that column but hiding the corresponding content of the column using a hide character; (2) equally does not display either the name of this column or the corresponding content of the column.

When you select one specified authorizable object, as well as the statistical table in respect of which you want to grant access rights, display the status of the previously granted operation rights to the authorized object in relation to each column of the statistical table on which you want to manage the rights to perform operations.

Selecting two or more of the specified authorizable objects, as well as the statistical table on which you want to grant access rights, displays the columns in that statistical table on which you want to manage permissions to perform operations, but the status of previously granted rights on each column, with that need to manage permissions to perform operations are not displayed.

When you select one specified authorizable object, as well as the statistical table in respect of which you want to grant access, the authorizing operator and the transaction time associated with the last grant of rights to this authorizable object in relation to this statistical table are displayed.

A method for granting rights to perform operations on a statistical table, further including a stage of template granting of rights, which, in particular, includes: (1) selecting an authorized object and a statistical table in respect of which it is necessary to grant access rights, while selecting one or more authorized objects , and also select one statistical table for which access rights must be granted; (2) granting rights to an authorized object, selecting one authorized object or a created template as a template for granting rights, and in accordance with this template for granting rights, granting this authorized object the rights to perform operations with this statistical table; (3) making changes and saving, after which this authorized entity acquires the rights to perform operations on this statistical table.

A method for granting rights to perform operations with a statistical table, including the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized role, while the order of priority between the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized role is not strict; the specified stage of granting rights to perform operations on a statistical table includes the following steps: S1: selecting one statistical table for which you want to grant access rights, and displaying the names of the columns with which you want to manage rights to perform operations; S2: separate permission to perform operations on each column; the specified stage of selecting an authorized role consists of selecting one or more roles, while the specified authorized role is a role with the property of an individual entity, and not a group/class, and in the same period one role with the property of an individual entity can be associated with only one user, whereas a user is associated with one or more roles with a separate entity property.

If the user needs to be transferred to another position, an additional step is provided for managing the user's transfer, which, in particular, includes:

(1) unlinking the user from the previous role;

(2) associating the user with a new role corresponding to the new job responsibilities, as a result of which the user automatically acquires the rights of this role to perform operations with statistical tables.

A method for granting rights to perform operations with a statistical table, additionally including a stage of template granting rights, which, in particular, includes:

(1) selecting an authorized role and a statistical table in respect of which access rights must be granted, selecting one or more authorized roles, and also selecting one statistical table in respect of which access rights must be granted;

(2) granting rights to an authorized role, in which case one existing role or a created template is selected as a template for granting rights and, in accordance with this template, grants this authorized role the rights to perform operations with this statistical table;

(3) making changes and saving, after which this authorized role acquires the rights to perform operations on this statistical table.

Positive effects

The present invention has the following positive effects:

1. The present invention allows for separate granting of rights to perform operations in relation to each column of the statistical table, expands the scope of application of statistical tables, improves the quality of system management, and also meets the needs of application in the real process of operational management in enterprises and institutions.

For example, in a statistical table, a statistical table of trading activity results, there are the following column names: employee number, full name, employee department, position, amount of signed contracts, amount of payments received, amount of deductions and status of payments. If financial department employee Zhang San needs to check the data on the amount of payments received, Zhang San can be given the right to view the contents of the following columns in this statistical table: employee number, full name, employee department, position and amount of payments received; As a result, Zhang San can only view the contents of these few columns for which he has been granted access rights, and the amount of signed contracts, the amount of royalties and other confidential/private data cannot be viewed by Zhang San.

2. By selecting one authorizable entity, as well as the statistical table to which you want to grant access, the authorizing operator and transaction time associated with the last authorization to perform operations on that statistical table can be displayed. Displaying the last authorizing operator allows you to find the person responsible if errors are detected in the rights granted, and displaying the time of the last authorization operation helps determine the need to re-grant rights to perform operations with the statistical table.

For example, on May 21, 2015 at 11:00 am, Li Si was the last to grant the authorized entity Zhang San the rights to perform operations with the statistical table, the statistical table of trading results. When you select Zhang San as the authorized object, and select the statistical table Trading Results Statistical Table for which you want to grant access rights, the current authorizing operator is shown that on May 21, 2015 at 11:00 am, Li Si granted Zhang San the rights to performing operations with a statistical table; statistical table of trading activity results.

If Zhang San should not have the right to view the contents of a certain confidential/private column, but as a result of the last grant of rights he has received the right to view

- 4 044830 the contents of this confidential/private column, then the responsible person can subsequently be found by searching for the last authorizing operator.

Additionally, for example, a certain operator needs to grant 100 authorizable entities the rights to perform operations on a certain statistical table, but on that day the operator only granted rights to 70 authorizable entities. When the operator continues to grant rights the next day, the operator can view the last time each authorizable object was granted rights, thereby determining whether to grant rights to authorized objects. All authorized objects that have been granted rights within a specified time period can also be found. Viewing the last time rights were granted to an authorizable entity allows you to determine how long the authorizable entity's rights remained unchanged, which helps determine whether the authorizable entity needs to be granted rights again.

3. This method allows you to grant rights to a group of authorized persons, which increases the efficiency of granting rights; In addition, this method supports template granting of rights, that is, an existing object/existing role or a created template is selected as a template for granting rights, and in accordance with the template for granting rights, they directly grant (update) this authorized object the rights to perform operations with this statistical table (save after making small changes), so the operation of granting rights is simple and highly efficient. The combination of the two methods significantly increases the efficiency of granting rights to perform operations with a statistical table.

4. According to the present invention, the authorized object is an independent role with the property of a separate entity, and when an employee is fired or transferred to another position, the rights to perform operations with the statistical table can be updated by associating/unlinking the user with the role, which allows for sequential transfer rights to perform operations, ensure timely updating of user rights to perform operations with a statistical table, prevent delays and omissions in updating rights to perform operations, avoid the risk of leakage of confidential information, without having a negative impact on the normal activities of the enterprise.

Example of dismissal: the user corresponding to the employee Zhang San is associated with the role Production Worker 1; At the time of Zhang San's dismissal, the system administrator (or the corresponding manager) directly removes the association of Zhang San's corresponding user with the role of Production Worker 1, and Zhang San automatically loses the corresponding role of Production Worker 1's rights to perform operations on statistical tables, which avoids information leakage in the situation when, as a result of the delay in the transfer of rights to perform statistical table operations, Zhang San still has the right to view certain confidential information after dismissal; When employee Li Si takes over the position of Zhang San, the corresponding Li Si user is directly associated with the role of production worker 1, and Li Si automatically receives the rights of the role production worker 1 to perform operations with statistical tables, that is, there is no need to re-install employee Li You have the rights to perform operations on statistical tables, resulting in a simplified and faster entitlement operation and a significant reduction in workload.

Example of a transfer: Employee Zhang San is transferred from the production department to the after-sales department, the system administrator (or the corresponding manager) removes the association of Zhang San's corresponding user with the role Production worker 1 and associates him with the new role After-sales worker 3 in the after-sales department , as a result of which Zhang San automatically receives the corresponding role of after-sales service worker 3 rights to perform operations with statistical tables.

5. According to this document, a role is associated with a user one to one, and in the same period, one role can be associated with only one user, while one user is associated with one or more roles. The advantage is that all that is required to obtain rights is to associate a user with a role (that is, the user gains the rights of the associated role), and the changes to the role's rights are much smaller than the changes to the user's rights in the traditional mechanism. Changes in the number of independent roles with the property of a separate entity (with the property of position number/workstation number) are not significant; Despite the high turnover of personnel, changes in the position number/workplace number are not significant (up to the absence of changes in a certain period of time, that is, the role does not change). As a result, user rights management is greatly simplified and system overhead is reduced.

6. Operations such as dynamic management, recruitment and transfer of personnel are simple, convenient, efficient and highly reliable. During the hiring/firing/transfer process, rights management is simple. When changing an employee/user, there is no need to re-establish rights; it is enough to delete the connection or associate the user with a role: the connection with the user role is deleted;

- 5 044830 The incumbent of this role, and the user who assumes the responsibilities of that role, are associated with the role of that job number, causing the user associated with the role to automatically acquire the rights of that role to perform operations on statistical tables, without having to re-grant the rights to the role. This significantly improves the safety, reliability and efficiency of system setup.

For example, due to termination or reassignment, Zhang San no longer performs the work of the Buyer 3 role, and Zhang San's association with the Buyer 3 role is removed. In addition, Li Si accepts the work of the Buyer 3 role, and you only need to associate Li Si with this role, as a result of which Li Si automatically acquires the rights of the Buyer 3 role to perform operations on statistical tables.

7. According to the traditional rights management mechanism, a role is defined as a property of a group, job specialty, class, etc., and the role is associated with a user on a one-to-many basis. During operational management, user rights often have to be changed. For example, if the rights of a specific employee associated with a role have changed, it is not appropriate to change the rights of the entire role due to a change in the rights of an individual employee, since that role is also associated with other employees with the same rights. As a result, you must either create a new role corresponding to the employee with the changed rights, or, in accordance with the need for rights, directly remove the association of this employee with the role (exclude from the role). The two solutions discussed above not only take a long period of time, but also easily lead to errors in the rights granted to the role if the role has a large number of rights. Users have to perform complex and confusing operations, resulting in errors that result in losses for system users.

However, in the method presented in this document, selectively changing the role's permissions is sufficient to solve this problem, since the role is one separate entity. In the method presented in this document, although it seems that the amount of work will increase when initializing the system, nevertheless, due to copying, etc., its efficiency in creating roles and granting rights can be higher than in the case traditional roles with group/class properties; because there is no need to consider the commonality of roles with the group/class property when providing association with users; the solution presented in this document makes the installation of rights clear and understandable; In particular, after applying the system for a certain time (dynamically changing user rights/roles), the solution presented in this document can greatly improve the efficiency of rights management for system users when applying the system, which makes dynamic rights granting easier, more convenient, and also clearer and clear and increases the efficiency and reliability of setting rights.

8. In traditional role-based methods with a group/class property, it is easy to make mistakes in granting rights, while in the method presented in this document, the likelihood of making mistakes in granting rights is greatly reduced, since in the method presented in this document, only the role that represents a separate entity, and there is no need to consider what commonalities characterize multiple users who associate a role with a group property in traditional ways. That is, errors made in granting rights will also affect only the one user with whom this role is associated, whereas in the case of a traditional role with a group property, they will affect all users with whom this role is associated. Even if errors occur in granting rights, the correction method presented in this document is simple and takes little time, whereas in the case of a traditional role with a group property, when correcting errors, it is necessary to take into account the commonality of rights of all users with which this role is associated, and in the case With a large number of functions, making changes is time-consuming and complex, it is easy to make mistakes, and in many situations the solution can only be the possibility of creating a new role.

9. In traditional methods of granting rights based on roles with a group property, if there are relatively many role rights functions, then it is very difficult to remember specific rights for a long time, and it is even more difficult not to forget the difference in the rights of roles with similar rights, and if you need to associate them with a role new user, it is impossible to decide exactly how to choose the role to associate him with. The roles used in the method presented in this document themselves contain a property in the form of job number/workstation number, so how to select is immediately clear.

10. When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and create roles for communication with other users. Such operations are not only complex and time-consuming, but also error-prone.

The method presented in this document involves the following: the user being transferred is associated with multiple roles, and the transfer first removes the user's association with the role in the previous department (deleted roles can be reassociated with other users), and then associates the user with the role in the new department. Such operations are simple and error-free.

- 6 044830

Description of the attached graphic materials

In fig. 1 is a schematic illustration of direct granting of rights to a user in a system according to the prior art;

in fig. 2 is a schematic illustration of granting rights to a role with a group/class property according to the prior art;

in fig. 3 is a schematic illustration of a method combining direct granting of rights to a user and granting of rights to a role with a group/class property, according to the prior art;

in fig. 4 is a schematic illustration of granting rights to a user through a role with a separate entity property according to the present invention;

in fig. 5 is a schematic diagram of a statistical table selection when selecting a single authorizable object according to the present invention;

in fig. 6 is a schematic diagram of a statistical table display mode according to the present invention;

in fig. 7 is a schematic diagram of another statistical table display mode according to the present invention;

in fig. 8 is a schematic diagram of statistical table selection when selecting multiple authorizable objects according to the present invention;

in fig. 9 is a schematic diagram of an authorization operator display and operation time associated with the last grant of rights according to the present invention;

in fig. 10 is a schematic illustration of granting rights to an authorizable entity using a template for granting rights according to the present invention.

Embodiments of the Invention

Below, the technical solutions according to the present invention are described in more detail with reference to the accompanying drawings, however, the scope of protection of the present invention is not limited to the following.

Option 1.

The method for granting rights to perform operations with a statistical table includes the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized object; the authorized object can be an employee, user, role with a group/class property, etc.; The stage of granting rights to perform operations with a statistical table includes the following stages:

S1: select one statistical table for which you want to grant access rights, and display the names of the columns on which you want to manage permissions to perform operations;

S2: As shown in FIG. 5, separate permission to perform operations on each column; This step of selecting an authorizable object consists of selecting one or more authorizable objects.

According to this embodiment, said operation rights include a viewing right.

The display mode of a column for which there is no view right includes one or more of the following: (1) as shown in FIG. 6, displaying the name of this column, but hiding the corresponding content of the column with a hide character; (2) as shown in Fig. 7, equally does not display either the name of this column or the corresponding content of the column (equally, no display can also be formulated as nothing is displayed; as shown in Fig. 7, in the line with the symbol ...... nothing is displayed, that is, this line is not displayed or disappears).

The present invention allows for separate granting of rights to perform operations in relation to each column of the statistical table, expands the scope of application of statistical tables, improves the quality of system management, and also meets the needs of application in the actual process of operational management in enterprises and institutions.

For example, in a statistical table, a statistical table of trading activity results, there are the following column names: employee number, full name, employee department, position, amount of signed contracts, amount of payments received, amount of deductions and status of payments. If financial department employee Zhang San needs to check the data on the amount of payments received, Zhang San can be given the right to view the contents of the following columns in this statistical table: employee number, full name, employee department, position and amount of payments received; As a result, Zhang San can only view the contents of these few columns for which he has been granted access rights, and the amount of signed contracts, the amount of royalties and other confidential/private data cannot be viewed by Zhang San.

Embodiment 2.

Select one specified authorized object, as well as a statistical table, in relation to

- 7 044830 to which the access right must be granted, and display the status of the previously granted operation rights to the authorized object in relation to each column of the statistical table on which the operation rights need to be managed (as shown in Fig. 5).

Embodiment 3.

Select two or more specified authorizable objects, as well as the statistical table on which you want to grant access rights, and display the columns in that statistical table on which you want to control the rights to perform operations, but the status of the previously granted rights with respect to each column, with which need to perform operation rights management are not displayed (as shown in FIG. 8).

Embodiment 4.

As shown in FIG. 9, selects one specified authorizable entity as well as the statistical table over which the access right is to be granted, and displays the authorizing operator and transaction time associated with the last authorization entity being granted rights with respect to the statistical table.

Displaying the last authorizing operator allows you to find the person responsible if errors are detected in the rights granted, and displaying the time of the last authorization operation helps determine the need to re-grant rights to perform operations with the statistical table.

For example, on May 21, 2015 at 11:00 am, Li Si was the last to grant the authorized entity Zhang San the rights to perform operations with the statistical table, the statistical table of trading results. When you select Zhang San as the authorized object, and select the statistical table Trading Results Statistical Table for which you want to grant access rights, the current authorizing operator is shown that on May 21, 2015 at 11:00 am, Li Si granted Zhang San the rights to performing operations with a statistical table; statistical table of trading activity results.

If Zhang San should not have the right to view the contents of a certain confidential/private column, but as a result of the last grant of rights obtained the right to view the contents of that confidential/private column, then the responsible person can subsequently be found by searching for the last authorizing operator.

Additionally, for example, a certain operator needs to grant 100 authorizable entities the rights to perform operations on a certain statistical table, but on that day the operator only granted rights to 70 authorizable entities. When the operator continues to grant rights the next day, the operator can view the last time each authorizable object was granted rights, thereby determining whether to grant rights to authorized objects. All authorized objects that have been granted rights within a specified time period can also be found. Viewing the last time rights were granted to an authorizable entity allows you to determine how long the authorizable entity's rights remained unchanged, which helps determine whether the authorizable entity needs to be granted rights again.

Embodiment 5.

The method for granting rights to perform operations with a statistical table additionally includes the stage of template granting rights, which, in particular, includes:

(1) selecting an authorized object and a statistical table in respect of which it is necessary to grant access rights, while selecting one or more authorized objects, and also selecting one statistical table in respect of which it is necessary to grant access rights;

(2) granting rights to an authorized object, selecting one authorized object or a created template as a template for granting rights, and in accordance with this template for granting rights, granting this authorized object the rights to perform operations with this statistical table;

(3) making changes and saving, after which this authorized entity acquires the rights to perform operations on this statistical table.

For example, as shown in FIG. 10, Zhang San's rights to perform operations with the statistical table of trading results are selected as a template for granting rights, and in accordance with this template, rights are granted to Li Er.

This method allows you to grant rights to a group of authorized persons, which increases the efficiency of granting rights; In addition, this method supports template granting of rights, that is, an existing object/existing role or a created template is selected as a template for granting rights, and in accordance with this template for granting rights, they directly grant (update) this authorized object the rights to perform operations with this statistical table (save after making small changes), so the entitlement operation is simple and highly efficient. The combination of the two methods significantly increases the efficiency of granting rights to perform operations with a statistical table.

- 8 044830

Embodiment 6.

The method for granting rights to perform operations with a statistical table includes the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized role, and the order of priority between the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized role is not strict; The specified stage of granting rights to perform operations with a statistical table includes the following stages:

S1: select one statistical table for which you want to grant access rights, and display the names of the columns on which you want to manage permissions to perform operations;

S2: separate permission to perform operations on each column; in addition, the specified column includes such column names with a time property, such as the time of concluding a contract, the time of receipt of payment, the time of release of goods from the warehouse, etc., and after establishing the right to view a specific column with a time property, temporary ones can also be set statistics/query boundaries. Specifically, one column with a time property is selected, and then six kinds of formats for setting the time period for which the access right is granted are displayed to the authorizing operator to perform the corresponding setting of the time period; these six kinds of formats for setting the time period in respect of which the access right is granted, in particular, include: a time period from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time (the current point in time is changing); the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; the time period in which the time column value is a null value; and a period of time from the time of implementation of the system to the current point in time, wherein said period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time column is a blank value. The specified start time and end time are set by the authorizing operator; the period of time in which the value of the time column is a blank value and the period of time from the time of implementation of the system to the current point in time may be optional options, and they are selected by the authorizing operator.

This stage of selecting an authorized role consists of selecting one or more roles. As shown in FIG. 4, the specified authorized role is a role with the property of an individual entity, not a group/class, and in the same period, one role with the property of an individual entity can only be associated with one user, while a user is associated with one or more roles with the property separate entity (as shown in Fig. 4, the granting of rights to a role is carried out in accordance with the job responsibilities of the role, and the user receives the rights of the associated role).

Next, during the creation of a role or after its creation, a department is selected for the role, and the created role belongs to this department, then the roles are granted rights based on the corresponding job responsibilities, and the role name in this department is the only one, and the role number is the only one in the system; When the specified user is transferred to another position, the connection of the user with the previous role is canceled and the user is associated with the new role.

If the user needs to be transferred to another position, an additional step is provided for managing the user's transfer, which, in particular, includes:

(1) unlinking the user from the previous role;

(2) associating the user with a new role corresponding to the new job responsibilities, as a result of which the user automatically acquires the rights of this role to perform operations with statistical tables.

This embodiment further includes a template entitlement step, which specifically includes:

(1) selecting an authorized role and a statistical table in respect of which access rights must be granted, selecting one or more authorized roles, and also selecting one statistical table in respect of which access rights must be granted;

(2) granting rights to an authorized role, while one existing role or a created template is selected as a template for granting rights, and in accordance with this template, this authorized role is granted the rights to perform operations with this statistical table; (3) making changes and saving, after which this authorized role acquires the rights to perform operations on this statistical table.

In this embodiment, the authorized object is an independent role with a separate entity property, and when an employee leaves or is transferred to another position, the rights to perform statistical table operations can be updated by associating/unassociating the user with the role, allowing for sequential transfer of rights to perform operations, guarantee timely updating of user rights to perform operations with the statistical table, prevent delays and omissions in updating rights to perform operations, avoid the risk of leakage of confidential information, without having a negative impact on the normal activities of the enterprise.

Example of dismissal: the user corresponding to the employee Zhang San is associated with the role Production Worker 1; At the time of Zhang San's dismissal, the system administrator (or the corresponding manager) directly removes the association of Zhang San's corresponding user with the role of Production Worker 1, and Zhang San automatically loses the corresponding role of Production Worker 1's rights to perform operations on statistical tables, which avoids information leakage in the situation when, as a result of the delay in the transfer of rights to perform statistical table operations, Zhang San still has the right to view certain confidential information after dismissal; When employee Li Si takes over the position of Zhang San, the corresponding Li Si user is directly associated with the role of production worker 1, and Li Si automatically receives the rights of the role production worker 1 to perform operations with statistical tables, that is, there is no need to re-install employee Li You have the rights to perform operations on statistical tables, resulting in a simplified and faster entitlement operation and a significant reduction in workload.

Example of a transfer: Employee Zhang San is transferred from the production department to the after-sales department, the system administrator (or the corresponding manager) removes the association of Zhang San's corresponding user with the role Production worker 1 and associates him with the new role After-sales worker 3 in the after-sales department , as a result of which Zhang San automatically receives the corresponding role of after-sales service worker 3 rights to perform operations with statistical tables.

The following is an analysis of the advantages of the method of granting rights to a user through a role with the property of a separate entity: the user’s rights are determined (acquired) through his connection with the role; if it is necessary to change the user's rights, then the rights associated with the role are changed in accordance with the purpose of changing the rights of the user associated with the role. Once a user is associated with a role, they immediately acquire the rights of that role to perform operations on statistical tables.

[0 081] A role is associated with a user on a one-to-one basis (if a role is associated with one user, other users cannot be associated with that role; if a role is not associated with a user, the role can be chosen to associate with another user; that is a role can only be associated with one user at a time). A user is associated with a role on a one-to-many basis (one user can be associated with several roles at the same time).

Definition of a role: a role is characterized not by the properties of a group/class/category/position/official position/job specialty, etc., but only by the property of the absence of collectivity, the role is characterized by uniqueness, and the role is an independent separate entity that exists independently; when used in enterprises and institutions, it corresponds to the position number (in this document, the position number is not a position; one position can be occupied by several employees at the same time, but in the same period one position number can correspond to only one employee).

For example, the following roles can be created in the company's system: general director, deputy general director 1, deputy general director 2, sales department manager in Beijing 1, sales department manager in Beijing 2, sales department manager in Beijing 3, sales organization specialist in Beijing Shanghai 1, Shanghai Sales Specialist 2, Shanghai Sales Specialist 3, Shanghai Sales Specialist 4, Shanghai Sales Specialist 5, etc. User-role association relationship: If this company's employee Zhang San is assigned to the position of Deputy General Manager 2 and at the same time assigned to the position of Beijing Sales Manager 1, then the roles Zhang San needs to be associated with are Deputy General Manager 2 and Sales Manager in Beijing 1, and Zhang San will have the rights of these two roles.

The concept of a traditional role presupposes the properties of a group/class/position/job position/job specialty, while one role can correspond to several users. In this document, the concept of role corresponds to the position number/workstation number, and is also similar to the role in films and television series: one role at the same period (in childhood, adolescence, adulthood, etc.) can be performed by only one actor, and one actor may be able to play several roles.

Once a role is created, the role can be associated during the user creation process, and it can also be associated at any time after the user is created. After you associate a user with a role, you can delete the link relationship to the role at any time, and you can also create a link relationship with other roles at any time.

- 10 044830

The structure of the specified role: position title + position number. For example, production worker of workshop 1, production worker of workshop 2, production worker of workshop 3, etc. A role is a separate entity and corresponds to the concepts of job number and workstation number, but is different from a role in traditional rights management systems. The concept of a role in traditional systems represents a position/official position/job specialty and other properties of a group/class.

The following example shows the association relationship between employee, user and role after employee Zhang San joins the company: 1. Staff Recruitment: After hiring an employee, this user (employee) is directly associated with the role of the corresponding position number/workstation number. For example, if after hiring Zhang San (the company creates the user Zhang San for Zhang San), he works in sales department 1, responsible for the sale of refrigeration equipment in the Beijing area (the corresponding role of sales specialist 5 belongs to sales department 1), then for user Zhang San directly selects the role Sales Specialist 5 and associates him with this role.

2. Addition of position: After Zhang San has worked for a certain period of time, the company additionally appoints Zhang San to be in charge of the sales of television products in the Beijing area (the corresponding role of Sales Specialist 8 belongs to Sales Department 1), as well as the head of the after-sales service department ( Role corresponding to Head of After Sales Service 1). Thus, the user Zhang San is additionally associated with two roles, namely sales manager 8 in sales department 1 and after-sales service manager 1 in after-sales service department. Thus, employee Zhang San is associated with three roles: Sales Executive 5, Sales Executive 8 in Sales Department 1, and After-Sales Service Manager 1 in After-Sales Service, meaning user Zhang San has the rights of these three roles.

3. Position reduction: After a certain time, the company decided to appoint Zhang San as the director of the after-sales service department (the corresponding role is the director of the after-sales service department in the after-sales service department), without combining with other positions. Thus, the user Zhang San is associated with the role of After Sales Director in the After Sales Department and removes his association with the three previous roles (Sales Executive 5, Sales Executive 8 in Sales 1, and After Sales Manager 1 in After Sales). service). Therefore, the user Zhang San only has the rights of the role of Director of After-Sales Service in the After-Sales Department.

4. Setting up role rights (setting up all existing role rights): if the company decided to add rights to the director of the after-sales service department, it is enough to add the rights to the role of the director of the after-sales service department. When you add the rights of the After-Sales Service Director role, the rights of the user Zhang San associated with this role are also added.

5. Resignation: After one year, Zhang San resigns, and it is only necessary to delete the user Zhang San's association with the role of After-sales Service Director in the After-sales department.

For example, in the process of dynamic company activity, hiring and firing of personnel occurs frequently and continuously, while job numbers/workstation numbers change rarely (up to no change for a certain period of time).

In traditional entitlement methods, if the system has a large set of functions, entitlement through traditional roles with a group/class property is not only combined with a large workload, but is also complex and error-prone, and errors are difficult to detect within a short period of time. which ultimately leads to losses for system users.

According to the rights granting method herein, rights are granted to roles with a job number/workstation number property, and user rights are defined by associating a user with a role (the user acquires the rights of the associated role). In this way, user rights are managed through a simple user-role relationship, which is clear and understandable, simplifies rights management and operations, and greatly improves the efficiency and reliability of granting rights.

The above are only preferred embodiments of the present invention, and it should be understood that the present invention is not at all limited to the embodiments disclosed herein, which should not be construed as exclusive of other embodiments, but can be applied to any other combinations, variations and environments, Therefore, without deviating from the discussed essence of the present invention, changes can be made to it based on the above ideas or technologies or knowledge from related fields. Moreover, unless there are departures, changes or modifications from the spirit and scope of the present invention,

-

Claims (6)

proposed by those skilled in the art should be included within the scope of protection of the present invention as defined by the appended claims. CLAIM (1) display the name of that column, but hide the corresponding content of the column using a hide character; (1) selecting an authorized object and a statistical table in respect of which it is necessary to grant access rights, while selecting one or more authorized objects, and also selecting one statistical table in respect of which it is necessary to grant access rights; 1. A computer-implemented method for granting rights to perform operations with a statistical table, characterized in that it includes the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized object, with the order of priority between the stage of granting rights to perform operations with a statistical table and the stage of selecting an authorized object is not strict; The stage of granting rights to perform operations with a statistical table includes the following stages: S1: select one statistical table for which you want to grant access rights, and display the names of the columns on which you want to manage permissions to perform operations; S2: separate permission to perform operations on each column; said step of selecting an authorizable object consists of selecting one or more authorizable objects; wherein the method further includes a template granting of rights step, which includes: (2) equally does not display either the name of this column or the corresponding content of the column. 2. The method according to claim 1, characterized in that it further includes the step of setting the time period in respect of which the access right is granted for the column with the time property, selecting one column with the time property, after which the authorizing operator to perform the corresponding time setting period, six types of formats are displayed to set the time period for which access rights are granted; these six types of formats for setting the time period in respect of which the access right is granted, in particular, include a time period from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; the time period in which the time column value is a null value; and a period of time from the time of implementation of the system to the current point in time, wherein said period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time column is a blank value. (2) granting rights to an authorized object, selecting one authorized object or a created template as a template for granting rights, and in accordance with this template for granting rights, granting this authorized object the rights to perform operations with this statistical table; 3. The method according to claim 2, characterized in that the display mode of the column for which there is no viewing right includes one or more of the following types: (3) making changes and saving, after which this authorized entity acquires the rights to perform operations on this statistical table. 4. The method according to claim 1, characterized in that when selecting one specified authorized object, as well as a statistical table in respect of which it is necessary to grant access rights, they display the state of the rights previously granted to the authorized object to perform operations in relation to each column of the statistical table, with who need to manage permissions to perform operations. 5. The method according to claim 1, characterized in that when selecting two or more specified authorized objects, as well as a statistical table in respect of which it is necessary to grant access rights, the columns in this statistical table with which it is necessary to manage the rights to perform operations are displayed , but the status of previously granted rights for each column that needs to be operated on is not displayed. 6. The method according to claim 1, characterized in that when selecting one specified authorized object, as well as a statistical table in respect of which it is necessary to grant access rights, the -