EA045932B1 - METHOD OF GRANTING RIGHTS WITH RESPECT TO FORM FIELDS VALUES THROUGH THIRD PARTY FIELDS - Google Patents

Description

Technical field

The present invention relates to a method for granting rights over a form in administrative software systems such as ERP, and in particular it relates to a method for granting rights over form field values via third party fields.

BACKGROUND OF THE INVENTION

A traditional management software system, such as an ERP system, provides separate permissions to view and edit a form based on the values of the form fields. For example, for an agreement form, the fields in the form include the time the agreement was signed, the person who signed the agreement, the name of the client, the client's industry, etc. Rights can be separately granted in relation to the content of the fields viewed by the user, which allows user 1 to view the time of signing the contract and the person who signed the contract in the form, and does not allow user 1 to view the name of the client and the client's industry, thus ensuring the information security of the company and preventing the leakage of confidential information. information. However, management software such as ERP system can only grant individual rights to each user, but cannot grant rights to a group of users, resulting in the granting operation being inefficient and causing heavy workloads in a system with a large number of users. users. In addition, existing software does not allow further restriction of fields on the form. As a result, once a user has the right to view the value of a specific field, they can view a large amount of data, which leads to information leakage in companies with careful separation of job responsibilities. For example, user 3 has the right in the contract form to view the time of signing the contract, the person who signed the contract and the name of the client, but in fact the job responsibilities of user 3 are only to maintain statistics on contractual information in the financial industry. However, the existing method of setting rights allows user 3, in addition to the financial industry, to view information about contracts in other industries, which negatively affects the information security of the company.

Traditional granting of rights over form field values does not allow you to control the values of authorized fields in a form based on third party fields. For example, when granting access rights on an order form, it is necessary only by granting rights on fields to ensure that Zhang San can only view the price of the unit price field in the software industry form, but cannot change the price of the unit price field, or that Zhang San could only view the price of the unit price field in the software industry and chemical industry orders, and could only edit the price of the unit price field in the chemical industry orders. Traditional software does not allow for precise, individual granting of field value rights, nor does it meet the high management requirements.

Role-based access control (RBAC) is one of the most studied and advanced database access control mechanisms in recent years. This mechanism is considered an ideal candidate to replace traditional mandatory access control (MAC) and selective access control (DAC) systems. The basic idea of role-based access control (RBAC) is to separate different roles according to different functional positions in the organizational view of an enterprise, encapsulate access rights to database resources in roles, and allow users to indirectly access database resources by assigning different roles for users.

Large-scale application systems often have a large number of tables and views built into them, making database resource management and provisioning significantly more complex. It is extremely difficult for the user to directly control the granting of rights and database resources. This requires the user to have a deep understanding of the database structure and knowledge of the SQL language. As application system design or security requirements change, a large number of complex and extensive rights changes are required, which is very likely to result in information security vulnerabilities caused by unexpected errors in the rights granted. Therefore, developing a simple and effective way to manage rights for large-scale application systems has become a common requirement for systems and system users.

The role-based access control mechanism allows you to easily and effectively manage system rights, which significantly reduces the burden and cost of system rights management, and also makes system rights management more compatible with the specific operational management of the application system.

However, traditional role-based user rights management and workflow management methods use a one-to-many role-to-user relationship mechanism, with the role representing properties of a group/class. This means that one role can simultaneously correspond to or be associated with many users; the role corresponds to official position, position, work specialty, etc. In this communication mechanism, providing

- 1 045932 user rights are mainly divided into three forms: 1) as shown in FIG. 1, direct granting of rights to users, the disadvantage of which is the high workload, as well as the frequency and volume of operations) 2) as shown in FIG. 2, rights are granted to roles with the properties of a class/group/position/job specialty (one role can be associated with many users) and the user receives rights through his association with the role; 3) as shown in Fig. 3, the above two methods are combined.

In the above descriptions 2 and 3 rights need to be granted to roles with class/group properties. The method of granting rights and managing the workflow through a role with the properties of a class/group/position/work specialty has the following disadvantages.

1. Difficulties in performing operations if user rights change. During actual use of the system, user rights are subject to frequent changes. For example, in the process of changing rights, when the rights of an employee associated with a role have changed, it is inappropriate to change the rights of the entire role because the rights of an individual employee have changed, since the role is also associated with other employees whose rights have remained unchanged. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the rights requirements. The above two processing methods not only take a long time, but also easily lead to errors in the rights granted to the role in case the role has a large number of rights. The user has to do a lot of work, resulting in errors that result in losses for the system user.

2. It is difficult to remember the specific rights contained in a role for a long time. If a role has a large functionality of rights, over time it is difficult to remember the specific rights of the role, and even more difficult to remember the differences in rights of roles with identical rights. Rights of similar roles can also be easily confused with each other. If you need to associate a new user, it is impossible to determine exactly how to establish the association.

3. As user rights change, more roles are created (if new roles are not created, the direct granting of rights to users is greatly increased) and it becomes more difficult to distinguish specific differences in the rights of different roles.

4. When transferring a user to another position and the need to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user and create roles for communication with other users. Such operations are not only complex and time-consuming, but also error-prone.

Brief description of the invention

Technical problem

It is an object of the present invention to overcome the disadvantages of the prior art and to provide a method for granting rights over the values of form fields through third party fields to control the values of authorized fields in a form through third party fields, thereby achieving precise separate provision rights regarding field values. Technical solutions

The problem of the present invention is solved by the following technical solutions: a method for granting rights in relation to the values of form fields through third party fields, including:

(1) selection of one or more authorized objects;

(2) selecting the form for which access rights must be granted and displaying the authorized fields, the granting of rights to view the values of which must be controlled through third party fields;

(3) separately selecting one or more third party fields for each authorized field, wherein said third party field is a field on the selected form and said third party field includes one or more options;

(4) separately granting rights to view the values of authorized form data fields in accordance with each option of each third party field;

wherein said authorizable entity is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles.

Steps (2), (3) and (4) can be performed sequentially, step (1) can be performed before step (2) or between step (2) and step (3), or can be performed between step (3) and stage (4), or after stage (4).

In the preferred embodiment, the specified role corresponds to a specific department and is the only one within the department, while the granting of rights to the role is carried out in accordance with the job responsibilities of the role, and the user acquires rights through the associated role.

In a preferred embodiment, when a user is transferred to another department, the user's association with the role in the previous department is removed and the user is associated with the role in the new department.

- 2 045932

In a preferred embodiment, said third party field includes a time attribute field and a non-temporal property field, and the options of said time attribute field are determined by the authorizing operator; the values of the specified timeless property field are determined selectively or automatically, and all possible selectively determined or automatically determined options are used as options of the timeless property field.

In the preferred embodiment, the options of the specified time attribute field include one or more of the following six types: a period of time from a point in time, determined by counting down a fixed period of time from the current point in time, to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; a period of time in which the value of the time field is an empty value; a period of time from the time of implementation of the system to the current point in time, wherein the specified period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value.

Preferably, if there is one authorizable object, the right to view the value of the authorizable field is displayed as the view right saved as a result of the last grant of rights to the authorizable object regarding the value of the authorizable field of the form; If there are two or more authorized objects, the right to view the value of an authorized field in the form of the specified authorized object is not displayed.

Preferably, modes for displaying a field value that is not viewable include: (1) displaying the field corresponding to the field value, but hiding the field value using a hide character; (2) not displaying either the field value or the field corresponding to the field value.

A method of granting rights in relation to the values of form fields through third party fields, including: selecting one or more authorized objects; selecting the form for which access rights must be granted and displaying authorized fields, the granting of rights to view the values of which must be controlled through third party fields; selecting a template, selecting an existing authorized entity or a created template as a template for granting rights, and updating the rights of the authorized entity to view the values of authorized fields in the form so that the specified rights are rights to view the values of corresponding fields in the template for granting rights; determination of the need to continue making changes after selecting a template: if changes are required, then for each authorized field (each field with which the change is required), the third party fields are separately determined and the rights are granted/changed, and the specified third party field is a field in the selected form and the specified third party field includes one or more options, and after changes are made, the rights to view the values of the authorized form data fields corresponding to each option (each option with which the change is required to be made) of each third party field are retained; if no changes are required, then viewing rights are retained; wherein said authorizable entity is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles.

The step for each authorizable field of separately defining a third party field, wherein said third party field is a field on the selected form and said third party field includes one or more options may be performed prior to the template selection step.

A method of granting rights over form field values via third party fields, comprising:

(1) selection of one or more authorized objects;

(2) selecting the form for which access rights must be granted and displaying authorized fields, the granting of rights to change the values of which must be controlled through third party fields;

(3) separately selecting one or more third party fields for each authorized field, wherein said third party field is a field on the selected form and said third party field includes one or more options;

(4) separately granting the right to change the values of authorized form data fields in accordance with each option of each third party field;

wherein said authorizable entity is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles.

Steps (2), (3) and (4) can be performed sequentially, step (1) can be performed before step (2) or between step (2) and step (3), or can be performed between step (3) and stage (4), or after stage (4).

- 3 045932

Positive effects

The present invention has the following beneficial effects.

(1) According to the present invention, the authorized fields in the form for which it is necessary to grant the rights to view/change the field values are limited by setting the third party fields, thus the rights of the authorized objects to view/change are set in accordance with their job responsibilities, which prevents authorized entities from viewing/changing information in the form (field content information in the form) that is not relevant to their work, and reduces the likelihood of leaking company information.

(2) If there is one authorizable object, the rights to view the values of the authorizable fields are reflected as the view rights saved as a result of the last grant of rights to the authorizable object for the values of the authorizable fields in the form. The authorizing operator can therefore make changes on this basis, thereby increasing the efficiency of granting rights in relation to the forms. Rights can be granted to two or more authorizable entities at the same time, making it more efficient to grant rights to a group of authorizable entities with exactly the same or largely identical rights.

(3) The rights of the authorized entity to view the values of the authorized fields in the form are updated as the rights to view the values of the corresponding fields in the template for granting rights, which helps to improve the efficiency of granting rights with respect to forms, especially granting rights with respect to a group of forms with absolutely identical or similar mostly identical rights.

(4) In traditional rights management mechanisms, a role is defined as a property of a group, job specialty, class, etc. The role to the user is in a one-to-many relationship. During actual use of the system, user rights are subject to frequent changes. For example, in the process of changing rights, when the rights of an employee associated with a role have changed, it is inappropriate to change the rights of the entire role because the rights of an individual employee have changed, since the role is also associated with other employees whose rights have remained unchanged. As a result, you must either create a new role corresponding to the employee whose rights have been changed, or directly grant rights to the employee (removed from the role) based on the rights requirements. The above two processing methods not only take a long time, but also easily lead to errors in the rights granted to the role in case the role has a large number of rights. The user has to do a lot of work, resulting in errors that result in losses for the system user.

However, according to the method in this application, since a role is a separate entity, the purpose can be achieved by changing the rights of that role. Although the method in this application is likely to increase the workload during system initialization through copying or the like, nevertheless, creating and granting rights to a role can be performed more efficiently than in the case of traditional roles with a group property. Since there is no need to consider the commonality of roles with the group property when associating users, the solutions provided in this application make the setting of rights clear and understandable. Especially after the system has been used for a certain period of time (after dynamically changing user rights/roles), the solutions provided in this application can significantly improve the efficiency of system user rights management, make dynamic rights granting simpler, more convenient, more clear and understandable, and also improve the efficiency and reliability of setting rights.

(5) The traditional way of granting rights based on roles with a group property is error-prone. The method provided in this application significantly reduces the likelihood of errors in granting rights, since according to the method in this application, the role is considered only as a separate entity, without taking into account the commonality of several users associated with the role with the group property in the traditional method. If errors are found in the granted rights, only the user associated with the role is affected, but in the case of a traditional role with a group property, all users associated with the role are affected. Even if errors are found in the granted rights, the correction method according to this application is simple and takes a short period of time, while in the case of traditional roles with a group property, the commonality of rights of all users associated with the role must be taken into account when correcting errors. If a role has large functionality, the fix is large, complex, and error-prone, and in many cases the problem cannot be resolved until a new role is created.

(6) In the traditional way of granting rights to roles with a group property, if the role has a large functionality of rights, over time it is difficult to remember the specific rights of the role, and it is even more difficult to remember the differences in rights of roles with identical rights. If you need to associate a new user, it is impossible to determine exactly how to establish the association. According to the method in this application, the role itself is the job number/workstation number, which greatly simplifies the selection.

(7) When transferring a user to another position and it is necessary to assign a large number of rights of the transferred user to other users, it is necessary to separate the rights of the transferred user

- 4 045932 users and create roles to communicate with other users. Such operations are not only complex and time-consuming, but also error-prone.

The method in this application is as follows: the transferred user is associated with multiple roles. When you transfer a user, you first unassociate the user from roles in the previous department (unlinked roles can be reassigned to other users), and then associate the user with a role in the new department. The operation is simple and error-free.

(8) The role belongs to a specific department and the department of the role cannot be changed. The reasons why the department to which a certain role belongs cannot be changed are as follows. Reason 1: Since the role in this requisition is essentially a workstation number/job number, different workstation numbers/job numbers have different job contents and rights. For example, the role of salesperson 1 in the sales department and the role of developer 1 in the technical department are two completely different workstation numbers/position numbers and they have different rights. Reason 2: If the department (sales department) to which the salesperson 1 role belongs is replaced by the technical department without changing the rights of the salesperson 1 role, then in the technical department there is a role with rights related to the sales department. This leads to management chaos and security vulnerabilities.

Description of the attached graphic materials

In fig. 1 is a schematic illustration of direct granting of rights to a user in a system according to the prior art.

In fig. 2 is a schematic representation of granting rights to a role with group/class properties according to the prior art.

In fig. 3 is a schematic representation of direct granting of rights to both a user and a role with group/class properties in a prior art system.

In fig. 4 is a flow chart of one embodiment of the present invention.

In fig. 5 is a schematic illustration of granting rights to a user in a system through a role with a separate entity property according to the present invention.

In fig. 6 is a schematic diagram of a mold according to the present invention.

In fig. 7 is a schematic view after selecting the time for signing the contract in FIG. 6.

In fig. 8 is a schematic view after selecting the client's industry in FIG. 6.

In fig. Figure 9 shows a schematic representation of the form of the contract.

In fig. 10 is a flowchart according to another embodiment of the present invention.

In fig. 11 shows a schematic representation of the form after selecting a template for granting rights.

In fig. 12 is a flowchart according to another embodiment of the present invention.

Embodiments of the Invention

Below, the technical solutions according to the present invention are described in more detail with reference to the accompanying drawings, however, the scope of protection of the present invention is not limited to the following.

Option 1.

As shown in FIG. 4, a method for granting rights over form field values through third party fields includes: selecting one or more authorizable objects. The specified authorizable object is one or more of a person, a user, a group, a class, and a role; a role is a separate entity rather than a group/class, and one role can only be associated with one user at a time, while a user can be associated with one or more roles.

As shown in FIG. 5, the specified role belongs to a specific department, the role name is unique within the department and the role number is unique in the system. A specified user defines (acquires) rights through its association with a role, one employee corresponds to one user and one user corresponds to one employee.

Definition of a role: a role is characterized not by the properties of a group/class/category/position/official position/job specialty, etc., but only by the property of the absence of collectivity, the role is characterized by uniqueness, and the role is a separate entity. Applied in an enterprise or institution, the role corresponds to the position number (in this case, the position number is not a position; one position can simultaneously have several employees, but in the same period one position number can correspond to only one employee).

For example, the following roles can be created in the company's system: General Director, Deputy General Director 1, Deputy General Director 2, Manager of the Beijing Sales Department 1, Manager of the Beijing Sales Department 2, Manager of the Beijing Sales Department 3, Shanghai

- 5 045932 Sales Engineer 1, Shanghai Sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5, etc. The relationship between users and roles is as follows: if a company employee Zhang San acts as Deputy General Manager 2 and at the same time acts as the manager of Beijing Sales Department 1, then Zhang San should be associated with the role of Deputy General Manager 2 and the role Manager of Beijing Sales Department 1, that is, Zhang San has the rights of two roles.

The concept of a traditional role implies the properties of a group/class/position/position/job specialty, and one role can correspond to several users. However, according to this application, the concept of a role corresponds to a position number/workplace number, and is also similar to a role in films and television series: one role (in childhood, adolescence, adulthood, etc.) can only be performed by one actor at a time, but one actor can play several roles.

When a user is transferred to another department, the user's association with the role in the previous department is canceled and the user is associated with the role in the new department. Once a role is created, the user can be associated with the role during the user creation process, or can be associated with the role at any time after the user is created. Once a user is associated with a role, the user can be unassociated from the role at any time, and an association between the user and another role can be created at any time.

Select the form for which you want to grant access rights, and display the authorized fields in the form, the grant of rights to view the values of which should be controlled through third party fields. As shown in FIG. 6, the contract form includes the customer's name, product quantity and unit price.

If there is one authorizable object, the rights of the authorized object to view the values of authorized fields in the form are displayed as the viewing rights saved as a result of the last grant of rights to the authorized object with respect to the values of authorized fields in the form; If there are two or more authorized objects, the rights of authorized objects to view the values of authorized fields in the form are not displayed.

If there is one authorized object, after selecting the authorized object and the form, the authorizing operator and the time of the operation associated with the last granting of rights to the authorized object to view the value of the authorized field in the form are displayed, which allows you to find the person responsible if an error is detected in the rights of the authorized object, and also allows you to determine the need to grant the authorized object rights regarding the value of the authorized field in the form. As shown in FIG. 6, the authorizing operator who last granted clerk 1 the right to view the value of the authorized field in the contract form is Zhang Er, and the time of granting rights is May 6, 2017, 15:00. For example, an authorizing operator needs to grant rights to 100 roles, but that day the operator only completed granting rights to 70 roles. When the operator continues to grant rights to roles the next day, the roles to which rights need to be granted can be found by filtering authorizing operators or the last time rights were granted to view the value of an authorized field on the form. Or, for example, viewing the last time a role was granted rights to view the value of an authorized field on a form allows you to find out how long the right to view the value of an authorized field on a form remained unchanged, which helps determine whether the rights to view the value of an authorized field on a form should be re-granted.

For each authorized field, one or more third party fields are selected. The third party field is a field on the selected form and the third party field includes one or more options. As shown in FIG. 6, in the viewing rights for the authorized field client name, the third party field time of signing the contract is selected, and for the authorized field unit price the third party field client’s industry affiliation is selected.

Said third party field includes a time attribute field and a non-temporal property field, and options of said time attribute field are determined by the authorizing operator; the values of the specified timeless property field are determined selectively (for example, the value of the industry field on the customer form includes options such as manufacturing industry, financial industry, aviation industry, etc., and such fields include customer level, department, etc., which are not manually filled in) or automatically (for example, the values of the fields of the form creator, the form registrar, the role that created the form, the person who created the form, etc. are automatically determined according to the corresponding rule immediately after setting/saving the form fields; for example, all persons in the system are creator (field) alternative options, but the creator is the current person, automatically determined by the rule when the form is created), and all alternative options (all field value alternative options), either selectively defined or automatically defined, are used as timeless property field options ( this is a field of timeless property).

Options for the specified time attribute field include one or more of the following six types: a period of time from a point in time determined by counting down a fixed interval

- 6 045932 time from the current point in time to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; a period of time in which the value of the time field is an empty value; a period of time from the time of implementation of the system to the current time, wherein said period of time from the time of implementation of the system to the current time includes a period of time in which the value of the time field is an empty value. The time period from a point in time determined by counting back a fixed period of time from the current point in time to the current point in time, the time period from the start time to the current time, the time period from the end time to the time of implementation of the system, and the time period from the start time to the end time are filled in and determined by the authorizing operator. The time period in which the time field value is an empty value and the time period from the time of system implementation to the current time are selected and determined by the authorizing operator. As shown in FIG. 7, the third party field is selected in the four contract signing time options displayed after the contract signing time, and the time period from the start time to the current time is filled in by the authorizing operator, in this case from January 1, 2016 to the current time; The period of time in which the value of the time field is a null value is selected by the authorizing operator.

These six types of time periods are described below with examples given: A period of time from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time. For example, on June 20, 2017, employee 1 was granted the right to view the names of clients in contract forms (contracts) with the date of conclusion (the time of signing the contract) for a period of time from a point in time determined by counting back 6 days from June 20, 2017, to June 20 2017; that is, from June 20, 2017, employee 1 can view the names of clients (the name of clients refers to the content in the client name fields, then by analogy) in contract forms (agreements) with a conclusion date (time of signing the contract) starting from June 15, 2017 to 20 June 2017; from June 21, 2017, employee 1 can view the names of clients in contract forms (agreements) with a conclusion date (time of signing the contract) starting from June 16, 2017 to June 21, 2017; from June 22, 2017, employee 1 can view the names of clients in contract forms (agreements) with a conclusion date (time of signing the contract) starting from June 17, 2017 to June 22, 2017, etc. That is, a certain period of time in this time period is fixed, but the start time and end time vary.

The time period from the start time to the current time (the current time is changing). For example, on May 1, 2015, employee 1 was granted the right to view the names of clients in contract forms (agreements) with a conclusion date (the time of signing the contract) in the period from February 1, 2015 to the current date (current moment), and employee 1 can view the names of clients in the forms of agreements (agreements) with a conclusion date (time of signing the agreement) starting from February 1, 2015 to May 1, 2015; On May 2, 2015, Employee 1 can view customer names in all contract forms (agreements) with a conclusion date (contract signing time) starting from February 1, 2015 to May 2, 2015 (in addition, the start time can be defined as an excluded start time, and in the case of an excluded start time, Employee 1 cannot view customer names in contracts entered into on February 1, 2015, but can only view customer names in contracts entered into after February 1, 2015).

The period of time from the end time to the time of implementation of the system. For example, employee 1 was given the right to view the names of clients in contract forms (agreements) with a conclusion date (the time of signing the contract) in the period from February 1, 2015 until the time of system implementation. In this case, employee 1 can view the names of clients in contract forms (contracts) with a conclusion date (time of signing the contract) starting from February 1, 2015 until the time of system implementation (that is, employee 1 can view all contracts in the system concluded on February 1, 2015 until this time). (Alternatively, the end time can be defined as an excluded end time; in the case of an excluded end time, Employee 1 cannot view customer names on contract forms entered into on February 1, 2015, but can only view customer names on contracts entered into before February 1, 2015 In addition, only the end time may be set, and the implementation time of the system may not be set, in which case employee 1 can view the names of clients in all contracts concluded at the end time and before the end time, or employee 1 can view the name clients in all contracts concluded before the end time).

The period of time from the start time to the end time. For example, employee 1 was granted the right to view the names of clients in contract forms (contracts) with a conclusion date (time of signing the contract) in the period from February 1, 2015 to June 1, 2015. In this case, employee 1 can view the names of clients in all forms of agreements (agreements) with a conclusion date (time of signing the agreement) starting from February 1, 2015 to June 1, 2015.

- 7 045932

The time period in which the time field value is a null value. For example, the delivery date in the contract is not a required field, and in some contract forms (contracts) the delivery date is not filled in. Employee 1 has been granted the right to view customer names on contract forms where the delivery time field value is blank. In this case, employee 1 can view customer names in all contract forms (contracts) with an empty delivery date.

The period of time from the time of system implementation to the current point in time (the current point in time is changing). For example, from June 1, 2017, employee 1 was granted the right to view the names of clients in contract forms with the date of conclusion (the time of signing the contract) in the period from the time the system was introduced to the current point in time. In this case, on June 1, 2017, employee 1 can view the names of clients in all forms of agreements (agreements) with the date of conclusion starting from the time of system implementation until June 1, 2017; On June 2, 2017, employee 1 can view the names of clients in contract forms (contracts) with the date of conclusion (time of signing the contract) starting from the time of system implementation until June 2, 2017, etc. The specified time period from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value (in addition, specific time values for the time of implementation of the system and the current point in time may not be set, and if the period is set for employee 1 time from the time the system was introduced to the current point in time, then employee 1 can view in the system the names of clients in all contracts concluded at any time, including those with an empty time value).

Rights to view the values of authorized form data fields corresponding to each option of each third party field are granted separately.

As shown in FIG. 8, the third party field is selected as follows: a blank value and electrical equipment is selected as data corresponding to the customer's industry displayed after the customer's industry, where the blank in this case means that the industry is a blank. That is, Clerk 1 can view the unit price of contracts for the electrical industry (the customer is in the electrical industry) and the blank industry (the industry the customer is in is a blank value, or the customer's industry field has no field value/content). Suppose if in Fig. 8 is selected without restrictions, then Clerk 1 can view the unit price of contracts in all industries, such as electrical equipment, machinery (including subsequently added industries), and contracts in which the customer's industry field values are blank.

Modes for displaying a field value that does not have view rights include: (1) displaying the field corresponding to the field value, but hiding the field value using a hide character; (2) not displaying either the field value or the field corresponding to the field value. As shown in FIG. 9, when the user views the contract form, if the user does not have the rights to view the contact information of the client and the contact person, then when the user views the contract form, the contact information of the client and the contact person is displayed as a * symbol.

Embodiment 2.

As shown in FIG. 10, a method for granting rights over form field values via third party fields includes: selecting one or more authorizable objects. The specified authorizable object is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles. The specified role belongs to a specific department and the role is the only one within the department, while the rights of the role are granted in accordance with the job responsibilities of the role, and the user acquires the rights through the associated role. When a user is transferred to another department, the user's association with the role in the previous department is canceled and the user is associated with the role in the new department.

Selecting the form for which access rights must be granted and displaying the authorized fields, the granting of rights to view the values of which must be controlled through third party fields;

If there is one authorizable object, the rights to view the values of the authorizable fields are displayed as the view rights saved as a result of the last grant of rights to the authorizable object regarding the values of the authorizable fields in the form; If there are two or more authorized objects, the rights of the specified authorized objects to view the values of authorized fields in the form are not displayed.

If there is one authorized object, after selecting the authorized object and the form, they display the authorizing operator and the time of the operation associated with the last grant to the authorized object of the right to view the value of the authorized field in the form, which allows you to find the person responsible if an error is detected in the rights of the authorized object, as well as allows you to determine

- 8 045932 the need to provide the authorized object with rights regarding the value of the authorized field in the form.

Selecting a template, selecting an existing authorized entity or a created template as a template for granting rights, and updating the rights of the specified authorized entity to view the values of authorized fields of the form so that the specified rights are rights to view the values of the corresponding fields in the template for granting rights. As shown in FIG. 11, the created template 1 is selected as the template for granting rights.

After selecting a template, the need to continue making changes is determined: if changes are required, then for each authorized field, the third party fields are separately determined (the definition in this case means adding, deleting, or neither adding nor deleting) and granting rights, while the specified third party field person represents a field in the selected form and the specified third party field includes one or more options, and after changes are made, the rights to view the values of the authorized form data fields corresponding to each option of each third party field are retained; If no changes are required, then viewing rights are retained.

Said third party field includes a time attribute field and a non-temporal property field, and options of said time attribute field are determined by the authorizing operator; the values of the specified timeless property field are determined selectively (for example, the value of the industry field on the customer form includes options such as manufacturing industry, financial industry, aviation industry, etc., and such fields include customer level, department, etc., which are not manually filled in) or automatically (for example, the values of the fields of the form creator, the form registrar, the role that created the form, the person who created the form, etc. are automatically determined according to the corresponding rule immediately after setting/saving the form fields; for example, all persons in the system are creator (field) alternative options, but the creator is the current person, automatically determined by the rule when the form is created), and all alternative options (all field value alternative options), either selectively defined or automatically defined, are used as timeless property field options ( This is a field of timeless properties).

Options for the specified time attribute field include one or more of the following six types: a period of time from a point in time, determined by counting down a fixed period of time from the current point in time, to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; a period of time in which the value of the time field is an empty value; a period of time from the time of implementation of the system to the current point in time, wherein the specified period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value.

Modes for displaying a field value that does not have view rights include: (1) displaying the field corresponding to the field value, but hiding the field value using a hide character; (2) not displaying either the field value or the field corresponding to the field value.

Embodiment 3.

As shown in FIG. 12, a method for granting rights over form field values via third party fields includes: selecting one or more authorizable objects. The specified authorizable object is one or more of a person, a user, a group, a class, and a role; a role is a separate entity rather than a group/class, and one role can only be associated with one user at a time, while a user can be associated with one or more roles. The specified role belongs to a specific department, the role is unique within the department, the rights of the role are granted in accordance with the job responsibilities of the role, and the user acquires rights through the associated role. When a user is transferred to another department, the user's association with the role in the previous department is canceled and the user is associated with the role in the new department.

Select the form for which you want to grant access rights, and display the authorized fields, the grant of rights to change the values of which should be controlled through third party fields.

If there is one authorizable entity, the rights to view the values of the authorized fields are displayed as the change rights saved as a result of the last grant of rights to the authorized entity regarding the values of the authorized fields in the form; If there are two or more authorized objects, the rights of the specified authorized objects to change the values of authorized fields in the form are not displayed.

If there is one authorized object, after selecting the authorized object and the form, they display the authorizing operator and the time of the operation associated with the last grant to the authorized object of the right to change the value of the authorized field in the form, which allows you to find the person responsible if an error is detected in the rights of the authorized object, as well as allows you to define

-

Claims (2)

It is necessary to provide the authorized object with rights regarding the value of the authorized field in the form. For each authorizable field, one or more third party fields are selected, wherein the third party field is a field on the selected form and the third party field includes one or more options. As shown in FIG. 6, in the rights to change for the authorized field customer name, the third party fields the time of signing the contract, the person who signed the contract are selected, and for the authorized field quantity of products the third party field contract level is selected. Said third party field includes a time attribute field and a non-temporal property field, and options of said time attribute field are determined by the authorizing operator; the values of the specified timeless property field are determined selectively (for example, the value of the industry field on the customer form includes options such as manufacturing industry, financial industry, aviation industry, etc., and such fields include customer level, department, etc., which are not manually filled in) or automatically (for example, the values of the fields of the form creator, the form registrar, the role that created the form, the person who created the form, etc. are automatically determined according to the corresponding rule immediately after setting/saving the form fields; for example, all persons in the system are creator (field) alternative options, but the creator is the current person, automatically determined by the rule when the form is created), and all alternative options (all field value alternative options), either selectively defined or automatically defined, are used as timeless property field options ( this is a field of timeless property). Options for the specified time attribute field include one or more of the following six types: a period of time from a point in time, determined by counting down a fixed period of time from the current point in time, to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; a period of time in which the value of the time field is an empty value; a period of time from the time of implementation of the system to the current point in time, wherein the specified period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value. Rights to change the values of authorized form data fields corresponding to each option of each third party field are granted separately. Field values for which you do not have edit rights are displayed differently than fields and field values for which you have edit rights. For example, fields and field values that have edit rights are displayed in black, and fields and field values that do not have edit rights are displayed in gray. The above are only preferred embodiments of the present invention, and it should be understood that the present invention is not at all limited to the embodiments disclosed herein, which should not be construed as exclusive of other embodiments, but can be applied to any other combinations, variations and environments, Therefore, without deviating from the discussed essence of the present invention, changes can be made to it based on the above ideas or technologies or knowledge from related fields. Moreover, unless there is a departure from the spirit and scope of the present invention, changes and modifications suggested by those skilled in the art are intended to be within the scope of protection of the present invention as defined by the appended claims. CLAIM 1. A method of granting rights in relation to the values of form fields through third party fields, characterized in that it includes the selection of one or more authorized objects; selecting the form for which access rights must be granted and displaying authorized fields, the granting of rights to view the values of which must be controlled through third party fields; separately selecting one or more third party fields for each authorized field, wherein said third party field is a field on the selected form and said third party field includes one or more options; separate granting of rights to view the values of authorized form data fields in accordance with each option of each third party field; wherein said authorizable entity is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles. - 10 045932 2. The method according to claim 1, characterized in that the specified role corresponds to a specific department and is the only one within the department, while the granting of rights to the role is carried out in accordance with the job responsibilities of the role, and the user acquires rights through the role associated with him. 3. The method according to claim 2, characterized in that when the user is transferred to another department, the user’s association with the role in the previous department is removed and the user is associated with the role in the new department. 4. The method of claim 1, wherein said third party field includes a time attribute field and a non-temporal property field, and options of said time attribute field are determined by the authorizing operator; the values of the specified timeless property field are determined selectively or automatically, and all possible selectively determined or automatically determined options are used as options of the timeless property field. 5. The method of claim 4, wherein the options of said time attribute field include one or more of the following six types: a time period from a point in time determined by counting down a fixed period of time from the current point in time to the current point in time; the period of time from the start time to the current point in time; the period of time from the time of completion to the time of implementation of the system; the period of time from the start time to the end time; a period of time in which the value of the time field is an empty value; a period of time from the time of implementation of the system to the current point in time, wherein the specified period of time from the time of implementation of the system to the current point in time includes a period of time in which the value of the time field is an empty value. 6. The method according to claim 1, characterized in that if there is one authorized object, the rights to view the values of the authorized fields are displayed as viewing rights saved as a result of the last grant of rights to the authorized object in relation to the values of the authorized form fields; If there are two or more authorized objects, the rights of the specified authorized objects to view the values of authorized fields in the form are not displayed. 7. The method according to claim 1, characterized in that the modes for displaying the value of a field for which you do not have the right to view include: (1) displaying the field corresponding to the field's value, but hiding the field's value using a hide character; (2) not displaying either the field value or the field corresponding to the field value. 8. A method of granting rights in relation to the values of form fields through third party fields, characterized in that it includes the selection of one or more authorized objects; selecting the form for which access rights must be granted and displaying authorized fields, the granting of rights to view the values of which must be controlled through third party fields; selecting a template, selecting an existing authorized entity or a created template as a template for granting rights, and updating the rights of the specified authorized entity to view the values of authorized fields in the form so that the specified rights are rights to view the values of the corresponding fields in the template for granting rights ; determining the need to continue making changes after selecting a template: if changes are required, then for each authorized field the third party fields are separately determined and rights are granted, wherein the specified third party field is a field in the selected form and the specified third party field includes one or more options, and after making changes, the rights to view the values of authorized form data fields corresponding to each option of each third party field are retained; if no changes are required, then viewing rights are retained; wherein said authorizable entity is one or more of a person, a user, a group, a class, and a role; a role is a single entity rather than a group/class, and one role can only be associated with one user at a time, while one user can be associated with one or more roles. 9. A method of granting rights in relation to the values of form fields through third party fields, characterized in that it includes the selection of one or more authorized objects; selecting the form for which access rights must be granted and displaying authorized fields, the granting of rights to change the values of which must be controlled through third party fields; separately selecting one or more third party fields for each authorized field, wherein said third party field is a field on the selected form and said third party field includes one or more options; separate provision of the right to change the values of authorized form data fields in accordance with each option of each third party field; -