EA045744B1 - METHOD OF GRANTING RIGHTS BASED ON DISPLAYING THE CURRENT STATE OF RIGHTS OF ALL SYSTEM USERS - Google Patents

Description

Field of technology

The invention relates to a method for granting rights in administrative software systems such as ERP, and in particular it relates to a method for granting rights based on displaying the current rights state of all users of the system.

BACKGROUND OF THE INVENTION

Role-based access control (RBAC) is one of the most studied and advanced database access control mechanisms in recent years. This mechanism is considered an ideal candidate to replace traditional mandatory access control (MAC) and selective access control (DAC) systems. The basic idea of role-based access control (RBAC) is to separate jobs with different functions according to the organizational view of the enterprise, encapsulate access rights to database resources in roles, and provide users with indirect access to database resources by assigning different roles to users.

Large-scale application systems often contain a large number of forms and tables, which makes managing database resources and granting rights significantly more complex. It is extremely difficult for users to directly manage database resources and permissions, which requires users to have a deep understanding of the database structure and knowledge of the SQL language. As application system design or security requirements change, a large number of complex and confusing access rights changes are required, which is very likely to result in information security vulnerabilities caused by unexpected errors in the granted rights. Therefore, developing a simple and effective way to manage rights in large-scale application systems has become a common need for systems and system users.

The role-based access control mechanism allows you to manage system rights easily and efficiently, which greatly reduces the burden and cost of system rights management, and makes system rights management more compatible with application system operational management standards.

However, traditional role-based user rights management uses a one-to-many role-to-user relationship mechanism, with the role representing a group/class. This means that one role can simultaneously correspond to/be associated with many users, and the role corresponds to the concepts of official position/position/work specialty, etc. In this communication mechanism, granting rights to users is mainly divided into three forms: 1. as shown in FIG. 1, rights are directly granted to users; among the disadvantages of this method of granting rights, one can note the high workload, as well as the frequency and volume of operations; 2. As shown in Fig. 2, rights are granted (one role can be associated with several users) to roles (with the property of a class/group/position/job specialty) and the user receives rights through the role; 3. As shown in Fig. 3, the two methods discussed above are combined.

In the descriptions 2 and 3 discussed above, rights must be granted to roles with a class/group property. The method of granting rights and managing the work process through a role with a class/group/position/work specialty property has the following disadvantages:

1. Difficulties in performing operations if user rights change. During the actual use of the system, during operational management, user rights often have to be adjusted. For example, in the process of changing rights, when the rights of an employee associated with a role have changed, it is inappropriate to change the rights of the entire role because the rights of an individual employee have changed, since the role is also associated with other employees whose rights have remained unchanged. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the need for rights. The above two processing methods not only take a long time, but also easily lead to errors in the rights granted to the role in case the role has a large number of rights. The user has to perform complex and confusing operations, resulting in errors that result in losses for the system user.

2. It is difficult to remember specific rights contained in roles over a long period of time. If a role has a large set of rights functions, it is difficult to remember the specific rights of the role over time, and even more difficult to remember the differences in rights of roles with identical rights; rights of identical roles are also easy to confuse with each other. If you need to associate a new user, it is impossible to determine exactly how to establish the association.

3. As changes occur in user rights, more and more roles are created (if new roles are not created, direct granting of rights to users increases significantly), and it becomes more difficult to discern specific differences in role rights.

4. When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and separately create roles for linking with other users. Such operations are not

- 1 045744 are only complex and time-consuming, but also error-prone.

As shown in FIG. 4, in the existing methods for granting rights with respect to a form and other objects, if a form is selected after two or more employees are selected, the rights status of the selected employees with respect to the selected form cannot be displayed; Likewise, if two or more employees are selected after selecting a form, then the rights status of the selected employees with respect to the selected form cannot be displayed either. This leads to errors when an authorization operator grants rights to multiple users at the same time.

During the implementation of the system, access rights are often changed according to management needs. For example, according to management needs, a company needs to set up rights to view/edit the customer phone field (field content) in the customers form (for example, individual users with view rights should configure rights so that they do not have view rights; for individual users without view rights, configure rights so that they have view rights; for individual users without edit rights, configure rights so that they have edit rights; for individual users with edit rights, configure rights so that they had no right to change; and the right of individual users to leave unchanged). Existing methods only allow you to sequentially select a user and a form, or sequentially select a form and a user, and then grant access rights to the client phone field; Providing rights one at a time to users results in a high workload and is prone to errors. If you select several or all users to grant rights, then all that remains is to carry out a general grant of rights in relation to this field, customer phone number; different granting of rights cannot be carried out, and as a result, after granting of rights, all selected users have the same rights. Most importantly, the state of each user's previously granted rights with respect to the customer phone field cannot be displayed, that is, the state of each user's previously granted rights with respect to that customer phone field cannot be used as a guide, resulting in the authorizing operator having no information about the status of rights previously granted to these users in relation to the specified customer phone field, and the authorizing operator can easily make a mistake in the process of granting rights.

Brief description of the invention

Technical problem

It is an object of the present invention to overcome the disadvantages of the prior art and to provide a method for granting rights based on displaying the current state of rights of all users of the system, allowing to display all users of the system and the current state of rights of each user of the system in relation to the selected option of the element, which allows the granting of rights to system users in relation to the selected element option, simplifies the authorization operator to make changes, increases the efficiency of granting rights, and also significantly reduces the occurrence of errors in the process of granting rights.

Technical solutions

The problem of the present invention is solved by the following technical solutions: a method for granting rights based on displaying the current state of the rights of all users of the system, including: selecting one form; selecting one form element option in the specified form; after selecting the specified element option, displaying all users of the system, as well as displaying the current state of the rights of each user of the system in relation to the selected element option; Granting rights to one or more specified system users with respect to a selected item option.

Preferably, the type of said form element includes one or more of form rights, a form field, a time property field, and a form field value, wherein said form field value is selectively or automatically determined.

Preferably, said system users include one or more of a role, user, employee, group, class, or template, wherein said role is a separate entity rather than a group/class, and one role can be associated at the same time with only one user, whereas a user is associated with one or more roles.

In the preferred embodiment, the department for the role is selected during the creation process or after the creation of this role, and this role belongs to this department, while the granting of rights to the role is carried out in accordance with the job responsibilities of the role, the name of the role in the department is unique, and the number of this role is unique in system; When the specified user is transferred to another position, the connection of the user with the previous role is canceled and the user is associated with the new role.

In the preferred embodiment, after selecting a form element option, the authorization statement and transaction time associated with the last grant of rights to each user of the system with respect to the selected element option are separately displayed.

- 2 045744

A method for granting rights based on displaying the current state of rights of all users of the system, including: selecting one statistical table; selecting one statistical table element option in the specified statistical table; after selecting the specified element option, displaying all users of the system, as well as displaying the current state of the rights of each user of the system in relation to the selected element option; Granting rights to one or more specified system users with respect to a selected item option.

In a preferred embodiment, the type of the specified statistical table element includes one or more of rights to perform operations on the statistical table, a statistical table column name, a time property column name, and a statistical table column name value, wherein the specified statistical table column name value is determined selectively or automatically .

Preferably, said system users include one or more of a role, user, employee, group, class, or template, wherein said role is a separate entity rather than a group/class, and one role can be associated at the same time with only one user, whereas a user is associated with one or more roles.

A method for granting rights based on displaying the current state of rights of all users of the system, including: menu selection; after selecting the specified menu, displaying all users of the system, as well as displaying the current state of the rights of each user of the system in relation to the selected menu; granting rights to one or more specified system users in relation to the selected menu.

Preferably, said system users include one or more of a role, user, employee, group, class, or template, wherein said role is a separate entity rather than a group/class, and one role can be associated at the same time with only one user, whereas a user is associated with one or more roles.

Positive effects

The present invention has the following positive effects:

(1) The present invention can display all users of the system and the current status of the rights of each user of the system with respect to the selected item option, which allows the granting of rights to system users with respect to the selected item option, makes it easier for the authorizing operator to make changes, improves the efficiency of granting rights, and also significantly reduces the occurrence of errors during the entitlement process.

(2) According to the present invention, in the process of granting rights, after selecting the specified item option, all users of the system are displayed, which prevents lapses in granting rights and other undesirable situations from occurring.

(3) After selecting a form element option, the authorizing operator and operation time associated with the last grant of rights to each user of the system in relation to the selected element option are separately displayed, which allows you to find the person responsible in case of errors in the rights of the system user, and also helps determine the need to grant rights users of the system.

(4) According to the traditional rights management mechanism, a role is defined as a property of a group, job specialty, class, etc., and the role is associated with a user on a one-to-many basis. During the actual use of the system, during operational management, user rights often have to be adjusted. For example, if the rights of a specific employee associated with a role have changed, it is not appropriate to change the rights of the entire role due to a change in the rights of an individual employee, since that role is also associated with other employees with the same rights. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the need for rights. The two solutions discussed above not only take a long period of time, but also easily lead to errors in the rights granted to the role if the role has a large number of rights. Users have to perform complex and confusing operations, resulting in errors that result in losses for system users.

However, according to the method presented in this document, to solve this problem, it is enough to selectively change the rights of the role, since the role is one separate entity. According to the method presented in this document, although it seems that the amount of work will increase when initializing the system, nevertheless, due to copying, etc., its efficiency in creating roles and granting rights can be higher than in the case of traditional roles with a group property, since there is no need to take into account the commonality of roles with a group property when providing association with users; the solution presented in this document makes the installation of rights clear and understandable; In particular, after applying the system for a certain time (dynamically changing user rights/roles), the solution presented in this document can greatly improve the efficiency of rights management for system users when applying the system, which makes dynamic rights granting easier, more convenient, and also clearer and understandable and

- 3 045744 increases the efficiency and reliability of setting rights.

(5) In traditional role-based methods with a group property, it is easy to make mistakes when granting rights, while in the method presented in this document, the likelihood of making mistakes in granting rights is greatly reduced, since in the method presented in this document, only the role that represents is a separate entity, and there is no need to consider what commonalities characterize several users who associate a role with a group property in traditional ways. That is, errors made in granting rights will also affect only the one user with whom this role is associated, whereas in the case of a traditional role with a group property, they will affect all users with whom this role is associated. Even if errors occur in granting rights, the correction method presented in this document is simple and takes little time, whereas in the case of a traditional role with a group property, when correcting errors, it is necessary to take into account the commonality of rights of all users with which this role is associated, and in the case With a large number of functions, making changes is time-consuming and complex, it is easy to make mistakes, and in many situations the solution can only be the possibility of creating a new role.

(6) In traditional methods of granting rights based on a role with a group property, if there are relatively many role rights functions, then it is very difficult to remember specific rights for a long time, and it is even more difficult not to forget the difference in the rights of roles with similar rights, and if you need to associate with role of a new user, it is impossible to decide exactly how to choose the role to associate him with. The role used in the method presented in this document itself contains a property in the form of job number/workstation number, so how to select is immediately clear.

(7) When transferring a user to another position and need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and create roles for communication with other users. Such operations are not only complex and time-consuming, but also error-prone.

The method presented in this document provides the following:

the user being transferred is associated with several roles, and during the transfer, the user's association with the previous role is first unlinked (if you need to change only one position number/workstation number, it is enough to cancel one role and re-associate the canceled role with another user), and then associate the user with the new one role. Such operations are simple and error-free.

(8) During the creation of a role or after its creation, a department is selected for the role, and the created role belongs to that department, and the department of the role cannot be changed. The reasons why the department to which a certain role belongs cannot be changed are as follows. Reason 1: Since the role in this requisition is essentially a workstation number/job number, different workstation numbers/job numbers have different job contents and rights. For example, the role of salesperson 1 in the sales department and the role of developer 1 in the technical department are two completely different workstation numbers/position numbers and they have different rights. Reason 2: If the department (sales department) to which the salesperson 1 role belongs is replaced by the technical department without changing the rights of the salesperson 1 role, then in the technical department there is a role with rights related to the sales department. This leads to management confusion and security vulnerabilities.

Description of the attached graphic materials

In fig. 1 is a schematic illustration of direct granting of rights to a user in a system according to the prior art.

In fig. 2 is a schematic illustration of granting rights to a role with a group/class property according to the prior art.

In fig. 3 is a schematic representation of a method combining direct granting of rights to a user and granting of rights to a role with a group/class property, according to the prior art.

In fig. 4 is a schematic view at the time of granting rights to multiple users according to the prior art.

In fig. 5 is a flow chart for granting rights to system users regarding a form according to the present invention.

In fig. 6 is a schematic representation of selecting one form element option in accordance with the present invention.

In fig. 7 is another schematic representation of selecting one form element option according to the present invention.

In fig. 8 is another schematic representation of selecting one form element option according to the present invention.

In fig. 9 is another schematic representation of selecting one form element option according to the present invention.

In fig. 10 is a schematic illustration of granting rights to a user through a role with a separate entity property according to the present invention.

In fig. 11 is a flow chart for granting rights to system users with respect to a statistical table according to the present invention.

In fig. 12 is a flow chart for granting menu rights to system users according to the present invention.

Embodiments of the Invention

Below, the technical solutions according to the present invention are described in more detail with reference to the accompanying drawings, however, the scope of protection of the present invention is not limited to the following.

Embodiment 1 As shown in FIG. 5, a method for granting rights based on displaying the current status of the rights of all users of the system, including:

S11. Selecting one form.

For example, in FIG. 6 the customer form is selected.

S12. Selects one form element option on the specified form.

The type of the specified form element includes one or more of form rights, form fields, fields with a time property, and form field values.

Options for the specified form operation right element include one or more of add, delete, view, edit, view related information, print, import, export, etc. Options for a specified form field element on a customer form include customer name, customer industry, customer address (that is, form fields), etc. The options of the specified form field value element represent the field values, with the field values being determined selectively or automatically; for example, the customer level in the customers form has selective options level 1, level 2, level 3, etc., the customer industry field has selective options software, chemical industry, building materials, etc., the department responsible for the customer field has selective options Sales Department 1, Sales Department 2, Sales Department 3, etc., the person responsible for customer field has selective options Zhang San, Li Si, Wang Wu, etc., the customer location field has selective options Beijing , Shanghai, Guangzhou, etc. (in the case of a form field value type, rights must be granted on the value of the form field, not on the field corresponding to that field value), with each field value including one empty value and all values (empty means the field value is empty, all means all field values). The options of the specified field element with a time property are fields with a time property, for example, the time of creation of the form, the time of the last change (in this case, the mentioned creation time and time of the last change refer to both the options of the field element with the time property and the options of the form field element ) etc. Including, viewing the relevant information is a function of the operation of viewing the relevant information of this form, for example, viewing the relevant information of the customer form is viewing related contracts, viewing related orders, history of received payments, history of shipments and other viewing operations.

If the type of a form element is a form field value, then when you perform a grant operation on an element of that type, you essentially grant rights on the form data corresponding to that element option (form data example: for example, in a customers form, a particular customer represents constitutes customer form data).

For example, as shown in FIG. 6, in the rights to perform operations with the form (form element), the view option (element option) is selected in the customers form.

The specified value of the form field is determined selectively (for example, the value of the client's industry field in the customer form is selected by the operator from options such as manufacturing, finance, aviation and other industries; the value of the field the person who entered into the agreement in the contracts form is selected by the operator from options such as Zhang San , Li Si, Wang Wu and other employees of the company; such field values are not filled in manually, but are determined in the selection mode; field values: contract level, client location, contract department, department responsible for the contract, person responsible for the execution of the contract, role , responsible for the contract and other fields are selected in the same way) or automatically (for example, the value of the creator field in the customer form has options such as Zhang San, Li Si, Wang Wu and other company employees; however, during the creation of a client, the value of the creator is determined automatically and represents the current operator; the values of the fields the form registrar, the role that created the form, the person who created the form and other values of such fields are determined automatically according to the corresponding rule).

Next, after selecting one option element of the time property field, authorizing the operator to perform the corresponding time period setting, all users of the system and six types of time period setting formats are displayed. These six kinds of time period setting formats specifically include: a time period from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time; the period of time from the start time to the current point in time; period of time from

- 5 045744 end time before the system implementation time; the period of time from the start time to the end time; the time period in which the time column value is a null value; and a period of time from the time of implementation of the system to the current point in time, wherein said period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time column is a blank value; the specified start time and end time are set by the authorizing operator.

The following are examples to describe these six types of time periods: a period of time from a point in time, determined by counting down a fixed period of time from the current point in time, to the current point in time. For example, on June 20, 2017, employee 1 was granted the right to view contract forms with the date of conclusion in the period of time from a point in time determined by counting down 6 days from June 20, 2017, to June 20, 2017 (that is, this is the current point in time, and not a point in time determined selectively); that is, from June 20, 2017, employee 1 can view contract forms (agreements) with a conclusion date starting from June 15, 2017 to June 20, 2017; from June 21, 2017, employee 1 can view contract forms (agreements) with a conclusion date starting from June 16, 2017 to June 21, 2017; from June 22, 2017, employee 1 can view contract forms (agreements) with a conclusion date starting from June 17, 2017 to June 22, 2017, and so on. That is, a certain period of time in this time period is fixed, but the start time and end time vary.

The time period from the start time to the current point in time (the current point in time is changing). For example, on May 1, 2015, employee 1 was granted the right to view forms of agreements (agreements) with a conclusion date in the period from February 1, 2015 to the current date (current point in time), and employee 1 can view all forms of agreements (agreements) with a conclusion date starting from February 1, 2015 to May 1, 2015; As of May 2, 2015, Employee 1 can view all contracts entered into from February 1, 2015 to May 2, 2015 (in addition, the start time can be defined as an excluded start time, and in the case of an excluded start time, Employee 1 cannot view contracts concluded on February 1, 2015, but can only view contracts concluded after February 1, 2015).

The period of time from the end time to the time of implementation of the system.

For example, employee 1 was given the right to view forms of agreements (contracts) with a conclusion date in the period from February 1, 2015 to the time of system implementation. In this case, employee 1 can view all contract forms/contracts starting from February 1, 2015 until the time of system implementation (that is, employee 1 can view all contracts in the system concluded on February 1, 2015 and before that time). (Alternatively, the end time can be defined as an excluded end time; in the case of an excluded end time, Employee 1 cannot view contracts entered into on February 1, 2015, but can only view contracts entered into before February 1, 2015. Additionally, there may be only the end time is set, and the system implementation time may not be set; in this case, employee 1 can view all contracts concluded at the end time and before the end time, or employee 1 can view all contracts concluded before the end time).

The period of time from the start time to the end time. For example, employee 1 was given the right to view forms of agreements (contracts) with a date of conclusion starting from February 1, 2015 to June 1, 2015. In this case, employee 1 can view all forms of agreements (agreements) with a conclusion date starting from February 1, 2015 to June 1, 2015.

The time period in which the time field value is a null value. For example, the delivery date in the contract is not required to be completed, and in some contract forms (contracts) the delivery date is not filled in. Employee 1 has been granted the right to view contract forms (agreements) in which the delivery date time field value is a blank value. In this case, employee 1 can view all contract forms (agreements) with an empty delivery date.

The period of time from the time of system implementation to the current point in time (the current point in time is changing). For example, from June 1, 2017, employee 1 was granted the right to view forms of agreements (contracts) with the date of conclusion starting from the time of implementation of the system to the current point in time. In this case, on June 1, 2017, employee 1 can view all forms of contracts (agreements) with a conclusion date starting from the time the system was implemented until June 1, 2017; On June 2, 2017, employee 1 can view all forms of agreements (agreements) with a conclusion date starting from the time the system was implemented until June 2, 2017, and so on. The specified time period from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value (in addition, specific time values for the time of implementation of the system and the current point in time may not be set, and if the period is set for employee 1 time from the time of system implementation to the current point in time, then employee 1 can view in the system all contracts concluded at any time, including those with an empty time value).

- 6 045744

The specified start time and end time are set by the authorizing operator.

S13. After selecting the specified element option, displaying all users of the system, as well as displaying the current status of the rights of each user of the system in relation to the selected element option

For example, as shown in FIG. 6, after selecting view (item option), the system users are displayed: user A, user B, user C, user D, user E, user F, etc., and user A, user D and user E have the right to this option.

Next, after selecting a form element option, the authorization statement and transaction time associated with the last grant of rights to each user of the system in relation to the selected element option are separately displayed, which helps determine the need to grant rights to these users of the system. For example, a certain authorization operator needs to perform a grant operation on 100 roles, but on that day the authorization operator only granted rights to 70 roles. When the authorizing operator continues granting rights the next day, the operator can, by filtering authorizing operators or the last time roles were granted rights, find the roles to which rights need to be granted. In addition, for example, viewing the last time a role was granted rights allows you to determine how long the role's rights remained unchanged, which helps determine whether the role needs to be granted rights again.

For example, as shown in FIG. 6, User B is the last authorizing operator to grant rights to User A, User B, User C, User D, User E, and User F with respect to the form item view option of the right to perform form operations in the customers form; May 1, 2016 is the time of last grant of rights to User A, User B and User C regarding the option view form element of the right to perform form operations in the customers form; and May 1, 2017 is the time of the last grant of rights to User D, User E, and User F with respect to the View form element option of the right to perform form operations on the Customers form.

As shown in FIG. 7, in the clients form, in the rights to perform operations with the form (form element), select delete (element option). After selecting the delete option (item options), the system users are displayed: user A, user B, user C, user D, user E, user F, etc.; where User A, User D, User E, and User F currently have the right to view the specified option. User B is the last authorizing operator to grant rights to User A, User B, User C, User D, User E and User F with respect to the option to delete a form element of the right to perform form operations in the customers form; May 1, 2016 is the time of last grant of rights to User A, User B and User C regarding the option to delete a form element of the right to perform form operations in the customers form; and May 1, 2017 is the last time rights were granted to User D, User E, and User F with respect to the option to delete a form element of the right to perform form operations on the customers form.

As shown in FIG. 8, in the customer form, in the form fields (form element), select the customer name (element option). After selecting the client name option (element options), system users are displayed: user A, user B, user C, user D, user E, user F, etc.; however, User A, User D and User E currently have rights to view and change the client name. User B is the last authorizing operator to grant rights to User A, User B, User C, User D, User E and User F to view and change the specified form field in the customers form; May 1, 2016 is the last time permission was granted to User A, User B, and User C to view and edit the specified form field on the Customers form; and May 1, 2017 is the last time rights were granted to User D, User E, and User F to view and edit the specified form field on the Customers form.

As shown in FIG. 9, in the customer form, in the fields with the time property (form element), select the creation time (element option). After selecting the creation time (form options), the system users are displayed: user A, user B, user C, user D, etc.; wherein the current time period of user B is defined as a period of time from a point in time determined by counting back 5 days from the current point in time to the current point in time; and the current time period of user C is defined as the time period from the time of system implementation to the current point in time. In particular, time period A, time period B, time period C and time period D are set based on the status of previously granted rights, and time period E and time period F are selected based on the status of previously granted rights.

As shown in FIG. 9, time period A reflects the period of time from a point in time determined by counting back a fixed period of time from the current point in time to the current point in time; time period B reflects the time period from the start time to the current point in time; time period C reflects the time period from the end time to the time of system implementation; time period D reflects the time period from the start time to the end time; the time period E reflects the time period in which the value of the time column is a blank value; and the time period F reflects the time period from the time the system was introduced to the current point in time.

Next, after selecting the specified element option, all users of the system are displayed, and the specified all users of the system represent all users of the system in respect of whom the selected operator can perform the grant of rights.

The specified system users include one or more of a role, user, employee, group, class, or template.

As shown in FIG. 10, the specified role is a separate entity, not a group/class, and in the same period, one role can be associated with only one user, while a user is associated with one or more roles; the user acquires the rights of the role associated with him. The department for a role is selected during the creation process or after the creation of this role, and this role belongs to this department, while the rights of the role are granted in accordance with the job responsibilities of the role, the name of the role in the department is the only one, and the number of this role is the only one in the system.

Definition of a role: a role is characterized not by the property of a group/class/category/position/official position/job specialty, etc., but only by the property of the absence of collectivity, the role is characterized by uniqueness, and the role is an independent separate entity that exists independently; when used in enterprises and institutions, it corresponds to the position number (in this document, the position number is not a position; one position can be occupied by several employees at the same time, but in the same period one position number can correspond to only one employee).

For example, the following roles can be created in the company's system: general director, deputy general director 1, deputy general director 2, sales department manager in Beijing 1, sales department manager in Beijing 2, sales department manager in Beijing 3, sales organization specialist in Beijing Shanghai 1, Shanghai Sales Specialist 2, Shanghai Sales Specialist 3, Shanghai Sales Specialist 4, Shanghai Sales Specialist 5, etc. User-Role Relationship: If the employee of this company is Zhang San is appointed to the position of Deputy General Manager 2 and at the same time appointed to the position of Sales Manager of Beijing 1, then the roles that Zhang San needs to be associated with are Deputy General Manager 2 and Sales Manager of Beijing 1, and Zhang San will have the rights of these two roles.

The concept of a traditional role presupposes the properties of a group/class/position/job position/job specialty, while one role can correspond to several users. In this application, the concept of role corresponds to the position number/workstation number, and is also similar to the role in films and television series: one role in the same period (in childhood, adolescence, adulthood, etc.) can be performed by only one actor, and one actor may be able to play several roles.

When the specified user is transferred to another position, the user's association with the previous role is canceled and the user is associated with the new role, as a result of which the user automatically loses the rights of the previous role and automatically acquires the rights of the new role.

When an employee begins the job duties of the corresponding employee, the user is associated with a new role, as a result of which this user automatically acquires the rights of the role associated with him; When an employee leaves, the connection of the user corresponding to the employee with the role associated with this user is canceled, as a result of which this user automatically loses the rights of the specified role.

Once a role is created, the role can be bound during the user creation process, and it can be bound at any time after the user is created. Once a user has been associated with a role, the role's association relationship can be deleted at any time, and association relationships with other roles can also be created at any time.

One employee corresponds to one user and one user corresponds to one employee, and the rights of the employee are determined (acquired) by associating the user corresponding to the employee with a role.

Moreover, the employee and the user are constantly attached to each other; Once a user is matched to an employee, that user is assigned to that employee, and the user cannot be re-associated with another employee. If that employee is fired, then the associated user cannot match with another employee; If an employee takes up his job duties again, the previous user is used for this employee.

- 8 045744

S14. Grants rights to one or more specified system users regarding a selected item option.

Embodiment 2 As shown in FIG. 11, a method for granting rights based on displaying the current state of rights of all users of the system includes:

S21. Selecting one statistical table.

S22. Selecting one statistical table item option in the specified statistical table;

The type of the specified statistical table element includes one or more of the rights to perform operations on the statistical table, the name of the column of the statistical table, the name of the column with the time property, and the value of the name of the statistical table column; the specified column name value represents the value of a specific column (for example, in a statistical table there is a column name customer level, and the statistics displayed in the table level 1, level 2, level 3, etc. represent the values of the customer level column; or, for example, there is a column name number of visits, and the statistics displayed in the table 12, 5, 8, etc. represent the values of the column number of visits).

If the statistical table element type is the value of the statistical table column name, then when you perform a grant operation on an element of that type, you essentially grant rights on the data corresponding to that element option.

The options for the specified statistical table operation right element include view/query, etc. Options for the specified statistic table column name element in the customer statistic table include customer level, customer industry, customer region (in the case of statistic table column name, rights are granted in relation to the statistical data corresponding to that column location/column), etc. The options of the specified element value of the column name of the statistical table represent the corresponding values of the column names, and the value of the column name is determined selectively or automatically; for example, the customer level column name in the customer statistical table has selective (corresponding) values of the column name level 1, level 2, level 3, etc., the customer industry column name has selective (corresponding) values of the column name software, chemical industry, building materials, etc., the column name of the department responsible for the customer has selective values of the column name Sales Department 1, Sales Department 2, Sales Department 3, etc., the column name of the person responsible for the customer has selective values of the column name Zhang San, Li Si, Wang Wu, etc., the customer location column name has selective column name values of Beijing, Shanghai, Guangzhou, etc. (in the case of a statistical table column name value type, rights must be granted in relation to the column name value, that is, in relation to the data corresponding to this column name value; and not in relation to the column name corresponding to this column name value), and this kind column name values include one empty value and one all/unlimited value (empty means the column name value is empty, all means all column name values); The options of the specified element name of a column with a time property are names of columns with a time property, for example, the names of columns creation time, time of last change (in this case, the mentioned time of creation and time of last change refer to both the options of the element name of a column with time property and to options of the element name of the column of the statistical table), etc. In addition, the statistics of the column corresponding to the name of the column with the time property necessarily represent the data/contents of the time property; in addition, after selecting one option of the element, the name of the column with the time property, setting/granting rights in relation to the selected element is carried out by analogy with the method of installing/granting rights after selecting one option of the element, the field with the time property in the form; this method is described in this document.

The specified value of the column name of the statistical table is determined selectively (for example, the value of the column name of the client's industry in the client statistical table can be selected from industries such as manufacturing, finance, aviation, etc.; such column name values are not filled in manually, but are determined in selection mode; the values of the column names: the client’s city, the responsible department, the person responsible for the client, the role responsible for the client and others are selected in the same way) or automatically (for example, the values of the column names: creator, form registrar, role that created the form, user who created form, the person who created the form and others are determined automatically according to the corresponding rule).

S23. After selecting the specified element option, displays all users of the system, as well as displays the current state of rights of each user of the system in relation to the selected element option.

Next, after selecting the specified element option, all users of the system are displayed, while the specified all users of the system represent all users of the system, with respect to

- 9 045744 which the selected operator can grant rights.

The specified system users include one or more of a role, user, employee, group, class, or template.

A specified role represents a single entity rather than a group/class, and one role can only be associated with one user at a time, while a user is associated with one or more roles. The department for a role is selected during the creation process or after the creation of this role, and this role belongs to this department, while the rights of the role are granted in accordance with the job responsibilities of the role, the name of the role in the department is the only one, and the number of this role is the only one in the system.

When the specified user is transferred to another position, the user's association with the previous role is canceled and the user is associated with the new role, as a result of which the user automatically loses the rights of the previous role and automatically acquires the rights of the new role.

When an employee begins the job duties of the corresponding employee, the user is associated with a new role, as a result of which this user automatically acquires the rights of the role associated with him; When an employee leaves, the connection of the user corresponding to the employee with the role associated with this user is canceled, as a result of which this user automatically loses the rights of the specified role.

Once a role is created, the role can be associated during the user creation process, and it can also be associated at any time after the user is created. Once a user is associated with a role, the role's association relationship can be deleted at any time, and association relationships with other roles can be created at any time.

One employee corresponds to one user and one user corresponds to one employee, and the rights of the employee are determined (acquired) by associating the user corresponding to the employee with a role.

Moreover, the employee and the user are constantly attached to each other; Once a user is matched to an employee, that user is assigned to that employee, and the user cannot be re-associated with another employee. If that employee is fired, then the associated user cannot match with another employee; If an employee takes up his job duties again, the previous user is used for this employee.

Next, after selecting one statistical table element option, the authorization statement and transaction time associated with the last grant of rights to each user of the system in relation to the selected element option are displayed separately.

S24. Grants rights to one or more specified system users regarding a selected item option.

Embodiment 3 As shown in FIG. 12, a method for granting rights based on displaying the current state of rights of all users of the system includes:

S31. Menu selection.

S32. After selecting the specified menu, displays all users of the system, as well as displays the current status of the rights of each user of the system in relation to the selected menu.

Further, after selecting the specified menu, all users of the system are displayed, while the specified all users of the system represent all users of the system in respect of whom the selected operator can grant rights.

The specified system users include one or more of a role, user, employee, group, class, or template.

A specified role represents a single entity rather than a group/class, and one role can only be associated with one user at a time, while a user is associated with one or more roles. A role is selected during the creation process or after the creation of this role, and this role belongs to this department, while the granting of rights to the role is carried out in accordance with the job responsibilities of the role, the name of the role in the department is unique, and the number of this role is unique in the system.

When the specified user is transferred to another position, the user's association with the previous role is canceled and the user is associated with the new role, as a result of which the user automatically loses the rights of the previous role and automatically acquires the rights of the new role; that is, the user acquires the rights of the role associated with him.

When an employee begins his job duties, the user corresponding to the employee is associated with a new role, as a result of which this user automatically acquires the rights of the role associated with him; When an employee leaves, the connection of the user corresponding to the employee with the role associated with this user is canceled, as a result of which this user automatically loses the rights of the specified role.

Once a role is created, the role can be associated during the user creation process, and it can also be associated at any time after the user is created. Once a user has been associated with a role, the role link relationship can be deleted at any time, and a link relationship can also be created at any time.

- 10 045744 with other roles.

One employee corresponds to one user and one user corresponds to one employee, and the rights of the employee are determined (acquired) by associating the user corresponding to the employee with a role.

Moreover, the employee and the user are constantly attached to each other; Once a user is matched to an employee, that user is assigned to that employee, and the user cannot be re-associated with another employee. If that employee is fired, then the associated user cannot match with another employee; If an employee takes up his job duties again, the previous user is used for this employee.

Further, after selecting a menu, the authorizing operator and the time of operation associated with the last grant of rights to each user of the system in relation to the selected menu are separately displayed.

S33. Granting rights to one or more specified system users regarding the selected menu.

The above are only preferred embodiments of the present invention, and it should be understood that the present invention is not at all limited to the embodiments disclosed herein, which should not be construed as exclusive of other embodiments, but can be applied to any other combinations, variations and environments, Therefore, without deviating from the discussed essence of the present invention, changes can be made to it based on the above ideas or technologies or knowledge from related fields. Moreover, unless there is a departure from the spirit and scope of the present invention, changes and modifications suggested by those skilled in the art are intended to be within the scope of protection of the present invention as defined by the appended claims.

Claims (7)

1. A computer-implemented method for granting rights based on displaying the current state of the rights of all users of the system, characterized in that it includes: choosing one form; selecting one form element option in the specified form; after selecting the specified element option, displays all users of the system, as well as displays the current state of the rights of each user of the system in relation to the selected element option; granting rights to one or more specified system users in relation to the selected element option; wherein the form element type includes one or more of rights to perform form operations, a form field, a time property field, and a form field value, wherein said system users include one or more of a role, user, employee, group, class, or template , while the specified role represents a separate entity, and not a group/class, and in the same period one role can be associated with only one user, while a user is associated with one or more roles. 2. The method according to claim 1, characterized in that the specified value of the form field is determined selectively or automatically. 3. The method according to claim 1, characterized in that the department for the role is selected during the creation process or after the creation of this role, and this role belongs to this department, while the rights of the role are granted in accordance with the job responsibilities of the role, the name of the role in the department is unique, and the number of this role is unique in the system; When the specified user is transferred to another position, the connection of the user with the previous role is canceled and the user is associated with the new role. 4. The method according to claim 1, characterized in that after selecting a form element option, the authorizing operator and the operation time associated with the last grant of rights to each user of the system in relation to the selected element option are separately displayed. 5. A computer-implemented method for granting rights based on displaying the current state of the rights of all users of the system, characterized in that it includes: selecting one statistical table; selecting one statistical table element option in the specified statistical table; after selecting the specified element option, displaying all users of the system, as well as displaying the current state of the rights of each user of the system in relation to the selected element option; granting rights to one or more specified system users with respect to a selected item option; in this case, the type of the specified element of the statistical table includes one or more of the rights to - 11 045744 performing operations on a statistical table, a statistical table column name, a column name with a time property, and a statistical table column name value, wherein the specified system users include one or more of a role, user, employee, group, class, or template, wherein a specified role represents a single entity rather than a group/class, and one role can only be associated with one user at a time, while a user is associated with one or more roles. 6. The method according to claim 5, characterized in that the specified value of the name of the column of the statistical table is determined selectively or automatically. 7. A computer-implemented method for granting rights based on displaying the current state of the rights of all users of the system, characterized in that it includes: menu selection; after selecting the specified menu, displaying all users of the system, as well as displaying the current state of the rights of each user of the system in relation to the selected menu; granting rights to one or more specified system users in relation to the selected menu; wherein said system users include one or more of a role, user, employee, group, class, or template, wherein said role is a separate entity rather than a group/class, and in the same period one role can only be associated with a single user, whereas a user is associated with one or more roles.