KR100870391B1 - System and method for management authority by grouping - Google Patents

Abstract

The present invention relates to a method and system for efficiently setting and managing rights in various systems granted to a user.

According to the present invention, a system for newly creating, modifying, and managing various rights for a user to use a system in a system, the system comprising: an authority master DB having a plurality of rights defined in the system; A work group DB defining a plurality of work groups such that the rights defined in the authority master DB are set separately by group; A user DB mapped with a plurality of users and a plurality of workgroups defined in the workgroup DB; And mapping a user to the work group according to the administrator's instructions, registering the user in the user DB, canceling the work group mapped to the user of the user DB, and changing and mapping the work group mapped to the user of the user DB. Disclosed is a group rights management system including a rights management module for performing change processing.

Authority management, authorization, work group, authority master

Description

System and method for management authority by grouping}

The following drawings attached to this specification are illustrative of preferred embodiments of the present invention, and together with the detailed description of the invention to serve to further understand the technical spirit of the present invention, the present invention is a matter described in such drawings It should not be construed as limited to

1 is a view showing a method for setting rights to users in a conventional system.

2 is a diagram showing the configuration of a group authority management system according to an embodiment of the present invention.

3 to 5 are diagrams illustrating respective database configurations included in a group authority management system according to an embodiment of the present invention.

6 is a diagram illustrating a procedure for providing a group authority management service according to an embodiment of the present invention in order.

7 is an exemplary diagram illustrating an example of setting user rights using a workgroup in a group rights management system according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

200: group rights management device 210: rights management module

220: work group creation module 230: authority creation module

250: user DB 260: workgroup DB

270: authority master DB 300: authority manager terminal

The present invention relates to a method for managing and processing a user's right to use the system in a system, and more particularly, to a method and system for efficiently setting and managing rights in various systems granted to a user.

The system used by general websites or companies is connected to various users to use the website or to perform work in the system. In recent years, the number of users of such websites and systems has increased and diversified. Thus, users who have access to such a system have been given user rights such as restricting or benefiting from use. In addition, recent systems have complex system structures, such as various additional functions and business processes, which result in various rights in the system.

As such, in the past, users accessing a website or a system managed users by setting rights existing in the system. That is, when a user newly registers on a website or a system, various rights existing in the system are set or granted according to the user accordingly. In addition, to change the authority of an existing user, the authority was changed by newly setting the authority granted to the user.

1 illustrates a method of setting rights for users in such a conventional system. As shown in FIG. 1, a number of users in a system are each given various rights existing in the system. That is, user 1, user 2, user 3, and user 4 are granted product selling authority A, button authority B, and menu authority C, respectively. However, this method has a problem that each time a user is newly added, the user has to newly set the right permissions for the user, and when the system's authority is newly added, all users have to reset the authority. In addition, as the system is enormous and complicated, the authority to be set increases, and as the number of users using the system increases, a lot of time and system load are generated to process and manage the authority setting of the users.

In other words, as the existing system handles and manages user authority, the burden on management process such as more diverse and complicated system and increasing user authority setting, change, etc. is increased. Problems such as an error such as a drop in granting occur.

Accordingly, the present invention has been made to solve the above-mentioned problems of the prior art, and has been developed an improved rights management system and method for efficiently creating, modifying and managing various rights for the user to use the system within the system. The purpose is to provide.

In addition, there is another purpose to structurally perform the user authority setting process even in an increased user or a complicated system to reduce the load, improve the processing speed, and prevent the error of authorization.

Other objects and advantages of the invention will be described below and will be appreciated by the embodiments of the invention. Furthermore, the objects and advantages of the present invention can be realized by means and combinations indicated in the appended claims.

In order to achieve the above object, the group authority management system according to the present invention is a system for newly creating, modifying, and managing various rights for a user to use the system in the system, and a plurality of rights in the system are defined. Authorized master DB; A workgroup DB defining a plurality of workgroups such that the rights defined above are set for each group; A user DB mapped with a plurality of users and a plurality of workgroups defined in the workgroup DB; And an authority management module for registering, canceling, and changing a user to the workgroup according to an administrator's instruction.

According to another aspect of the present invention, an apparatus for providing a service that allows a user to newly create, change, and manage various privileges for using a system in a system, the authority master DB having a plurality of privileges defined in the system ; A workgroup DB defining a plurality of workgroups such that the rights defined above are set for each group; A user DB mapped with a plurality of users and a plurality of workgroups defined in the workgroup DB; And an authority manager terminal for allowing an administrator to register, terminate, and change processing in the workgroup of users in the user DB.

According to another aspect of the present invention, a method for newly creating, modifying, and managing various rights for a user to use a system in a system, comprising: (a) an authority master DB in which a plurality of rights in the system are stored; Defining a workgroup DB in which a plurality of workgroups configured by dividing the authority into groups are stored; (b) defining a user DB which maps and stores a plurality of users using the system and a plurality of workgroups defined in the workgroup DB according to an administrator's instructions; And (c) managing user rights mapped to the work group in the user DB according to a user rights management request of an administrator.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principle that can be defined, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention. Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

2 is a diagram showing the configuration of a group authority management system according to an embodiment of the present invention.

Referring to FIG. 2, the group rights management system 100 according to the present invention includes a group rights management apparatus 200 for managing user rights in a system for each group and a rights manager terminal 300 for managing user rights in the system. do.

The group authority management apparatus 200 sets and manages authority divided by various functions and work areas in the system to users who use any system. The group rights management apparatus 200 includes a rights management module 210, a work group generation module 220, a rights generation module 230, a user database 250, a work group database 260, and a rights master database 270. It includes.

The authority manager terminal 300 performs a role of performing an authority management request and an instruction to the group authority management apparatus 200. In other words, if you need to add new permissions to the system, request and add permission, if you need to add a new workgroup, add and request workgroup, and set, change, and manage user permissions for users in the system. It is a terminal. The administrator of each system processes the authority management task of the corresponding system through the authority manager terminal 300.

Hereinafter, the group rights management apparatus 200 which performs the user rights management of the system according to the instructions and requests of the system administrator will be described in detail with reference to FIG. 2.

The group rights management apparatus 200 includes a user database 250, a work group database 260, a rights master database 270, and the like, which are used for user rights management processing.

The authority master database 270 is a database in which various rights in the system are defined and stored. Examples of the rights may include a product sales authority, a button authority, a menu authority, a number authority, etc. in the customer management system of the mobile communication company.

The workgroup database 260 is a database that defines and stores a plurality of workgroups and sets user rights defined in the authority master database 270 for each workgroup. Rights are set in the workgroup database 260 according to various workgroup characteristics.

The user database 250 is registered with a corresponding system and a plurality of users using the system are registered, and the registered plurality of users are defined and stored to be mapped to a work group of the work group database 260, respectively. .

3 to 5 are diagrams illustrating respective database configurations included in a group authority management system according to an embodiment of the present invention. 3 is a diagram illustrating an example of the configuration of the authority master database 270, FIG. 4 is a diagram illustrating an example of the configuration of the workgroup database 260, and FIG. 5 is a diagram of the user database 250. It is a figure which shows the example of a structure.

Referring to FIG. 3, a configuration example of the authority master database 270 is described. A table indicating whether the authority master database 270 grants or restricts authority for each authority item existing in the system is defined. That is, each item is divided into A, B, C, D, and the like, and the items are divided and represented by granting authority (A) or limiting (a). In addition, the contents of the system usage rights corresponding to each item are described. That is, A is a merchandise selling authority, B is a button authority, C is a menu authority, D is a number authority, and the like is stored in a table. Thus, for example, if the user authority is set to restrict the merchandise selling authority and to grant the button authority, the user authority setting can be set to a, B, and the like.

Referring to FIG. 4, an example of the configuration of the work group database 260 is described. The work group database 260 classifies work groups to be used in the system, lists them as group names, and sets group rights corresponding to each group name. It is defined in this table. That is, as shown in the drawing, (a) Group has user rights set to A, B, C, D, E, etc., and (B) Group sets user rights to A, b, c, d, e, etc. It is. Herein, when (a) the group is described as an example, since the user authority is set to A, B, C, D, E, etc., it can be said that the group is given all of the product authority, button authority, menu authority, number authority, and the like. On the contrary, when looking at the (c) group, user rights are set to a, b, c, d, e, etc., so that the above rights are all restricted groups.

An example of the configuration of the user database 250 will be described with reference to FIG. 5. In the user database 250, an identifier of a user subscribed to a system or a user who uses the system is listed, and the task corresponds to each identifier. The workgroup of the group database 260 is defined in the mapped table. That is, as shown in the figure, each user is identified by an identifier, and each identifier is mapped with one work group. Thus, for example, user # 001 has (a) a workgroup mapped to user # 001, and user # 001 has been collectively set up with user rights set for (a) workgroup in the workgroup database 260. Here, although one work group is mapped to one identifier in the drawing, the present invention is not limited thereto, and one or more work groups may be mapped to one identifier. 3 to 4 illustrate examples of constituting a database, the present invention is not limited thereto, and the present invention is not limited thereto, and authority definitions, work group-specific authority settings, user registration information, and workgroups exist in the system. Of course, the mapping structure can be configured in various ways.

Next, the configuration of the group right management apparatus 200 will be described with reference to FIG. 2 again.

The rights management module 210 performs user rights management processing such as registering, canceling, changing, and adding a user to a workgroup in the user database 250 according to an instruction and request of the rights manager terminal 300. . The rights management module 210 includes a rights register 212, a rights revocation unit 214, a rights change unit 216, a rights adder 218, and the like.

The authority registration unit 212 registers a newly registered new user in the user database 250 to use the system, and sets authority by mapping a corresponding user and a work group of the work group database 260. . The workgroup to be mapped to the user follows the request and the instruction of the authority manager terminal 300.

The authority canceling unit 214 cancels the user's mapped workgroup according to the request and the instruction of the authority manager terminal 300 in the user database 250.

The authority changing unit 216 terminates the mapped work group of the user according to the request and the instruction of the authority manager terminal 300 and performs a role of mapping to another work group of the work group database 260.

The authority adding unit 218 performs a role of mapping another workgroup of the workgroup database 260 in addition to the mapped workgroup of the user according to a request and an instruction of the authority manager terminal 300. The authority adder 218 allows one user to be mapped to one or more workgroups.

The workgroup creation module 220 serves to create a new workgroup in addition to the workgroup database 260. That is, a new workgroup is defined in the workgroup database 260 by defining a new workgroup by combining settings of a plurality of user rights defined in the rights master database 270 according to a request and an instruction of the rights manager terminal 300. To add.

The authority generation module 230 defines a new user authority to be used in the system and updates the authority master database 270. That is, according to the request and instructions of the authority manager terminal 300, a new authority used for system use is generated and added as a new user authority to the authority master database 270. Preferably, when a new user right is added to the authority master database 270, the new user right is reflected in the workgroup database 260. In this case, the default value may be collectively added to the work group and reflected, or may be reflected according to the instructions of the authority manager terminal 300.

Next, a method of providing a group rights management service according to an embodiment of the present invention will be described with reference to FIG. 6.

6 is a diagram illustrating a procedure for providing a group authority management service according to an embodiment of the present invention in order.

Referring to FIG. 6, first, a process of defining a rights master database for defining user rights to be used in the system and storing a plurality of rights existing in the system along with the authority contents for each item is performed (S 10).

In addition, a work group is defined by dividing the user rights stored in the authority master database into different setting combinations, and defines a work group database by creating a table of work group names and corresponding group authority setting values. (S 20)

Next, a procedure of defining and storing a user database in which the users who use the system are classified and stored as identifiers and mapping a plurality of users who use the system and a plurality of work groups defined in the work group database and storing them as a table is performed. S 30)

After the above procedure, the procedure for determining whether a new user registration request is received from the authority manager terminal is performed.

If a new user registration request is received, a new user registration is performed in the user database, and a procedure of mapping a corresponding user to a workgroup is performed according to the instructions of the authority manager (S 45).

Next, a process of determining whether a user right cancellation request is received from the rights manager is performed.

If a user right cancellation request is received, a workgroup termination process is performed for a user corresponding to the user database. At this time, the cancellation process is performed by canceling the work group to which the corresponding user is mapped in the user database.

In addition, it is determined whether a user authority change request is received from the authority manager, and when a user authority change request is received, a workgroup change process is performed for a user corresponding to the user database. At this time, the change processing is performed by canceling the workgroup to which the user is mapped in the user database and mapping another workgroup in the workgroup database to the user according to the authority manager's instruction (S 60, 65).

Next, it is determined whether a request for generating a new user right to be used for the system is received from the right manager (S70).

When a request for creating a new user right is received, a process of instructing the authority manager to generate a new right requested by the authority manager is performed to the workgroup database (S 75).

In addition, it is determined whether a new workgroup creation request is received from the authority manager, and when a new workgroup creation request is received, combining the settings of the rights of the authority master database in the workgroup database based on a request of the authority manager. Proceeding to define a new workgroup (S 80, 85).

7 is an exemplary diagram illustrating an example of setting user rights using a workgroup in a group rights management system according to an embodiment of the present invention.

As shown in FIG. 7, unlike the system for setting rights for each of the existing users, users are mapped to work groups, and user rights are set in the work group. That is, in the work group (a), the merchandise sales authority A, the button authority B, the menu authority C, etc. are set, and the users 1, 2, 3, and 4 are mapped to the work group (a). The rights A, B, and C are collectively granted. As a result, it is possible to reduce the load on the system and improve the processing speed by enabling the batch authority setting processing for each workgroup, compared to the administrators who previously set the authority for each user. In addition, the user authority set in the work group is collectively applied to the mapped users to prevent an error of authorization grant that may occur when the user authority is set for each user.

Furthermore, even when it is necessary to change a user's user permission setting, it is possible to change the permission setting in a batch by changing only the mapped workgroup and mapping it to another workgroup, compared to the method of setting permission again. Can be. In addition, if the user knows only the mapped work group, the user can grasp the permission setting of the user, and the administrator can easily recognize the permission setting.

The terms or words used in this specification and claims are not to be construed as limiting in their usual or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best explain their invention in the best way possible. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

According to the present invention, when setting and managing user rights in a predetermined system, the rights can be divided and processed by a workgroup, so that the rights can be collectively set and changed according to the change of the workgroup. It provides the effect of reducing the load and improving the processing speed.

In addition, by organizing work groups according to work characteristics, administrators can easily recognize the authority setting management and provide an effect of preventing errors in missing detailed rights when granting user rights.

Claims (13)

A system that creates, modifies, and manages new privileges for users to use the system within the system. An authorization master DB in which multiple authorizations are defined in the system; A work group DB defining a plurality of work groups such that the rights defined in the authority master DB are set in combination by group; A user DB mapped with a plurality of users and a plurality of workgroups defined in the workgroup DB; And Mapping a user to the workgroup according to the administrator's instructions, registering the user with the user DB, canceling the workgroup mapped with the user of the user DB, and changing and mapping the workgroup mapped with the user of the user DB. Group rights management system comprising; a rights management module for performing processing. The method of claim 1, The rights management module, An authority registration unit for registering a new user in the user DB and mapping the work user of the workgroup DB requested by an administrator; An authority revocation unit for terminating the mapped workgroup of the user requested by the administrator in the user DB; And And a permission change unit for canceling the mapped workgroup of the corresponding user according to a request of an administrator and mapping the workgroup to another workgroup of the workgroup DB. The method of claim 2, The rights management module, And an authority adding unit for mapping another workgroup of the workgroup DB in addition to the mapped workgroup of the user according to a request of an administrator. The method according to claim 1 or 2, Group work management system, characterized in that one or more work groups per user can be mapped to the user DB. The method according to claim 1 or 2, Group authority management system further comprises a rights generation module for defining a new authority in the authority master DB. The method according to claim 1 or 2, And a workgroup generation module for defining a new workgroup by combining settings of the rights of the rights master DB in the workgroup DB. The method according to claim 1 or 2, And a rights manager terminal for accessing the rights management module to allow an administrator to perform rights management requests and instructions. A device that provides a service that allows a user to create, change, and manage a variety of rights to use a system within a system. An authorization master DB in which multiple authorizations are defined in the system; A work group DB defining a plurality of work groups such that the rights defined in the authority master DB are set separately by group; A user DB mapped with a plurality of users and a plurality of workgroups defined in the workgroup DB; And The administrator maps a user to the work group, registers it in the user DB, revokes the work group mapped to the user of the user DB, and changes and maps the work group mapped to the user of the user DB. Device for providing group rights management services, including; rights management terminal to perform. The method of claim 8, The authority manager terminal, the group authority management service providing apparatus, characterized in that for defining a new authority in the authority master DB when a new authority needs to be added to the system. The method of claim 8, When the authority manager terminal needs to add a new workgroup, the device authority management service providing apparatus for defining a new workgroup by combining the settings of the rights of the authority master DB in the workgroup DB. As a way to create, change, and manage new privileges for users to use the system within the system, (a) defining a rights master DB in which a plurality of rights in the system are stored, and a work group DB in which a plurality of work groups in which the rights are divided into groups are set; (b) defining a user DB which maps and stores a plurality of users using the system and a plurality of workgroups defined in the workgroup DB according to an administrator's instructions; And (c) mapping a user to the workgroup and registering the workgroup in the user DB according to a user authority management request of an administrator, canceling the workgroup mapped to the user of the user DB, and the work mapped to the user of the user DB. And managing the user rights by changing and mapping the group by changing the group. The method of claim 11, wherein step (c) comprises: At the request of an administrator for user rights, (1) registering a user with the user DB when a user registration request is requested, and setting the authority by mapping the authority setting of the user to one of the workgroups of the workgroup DB; (2) canceling the mapped workgroup of the user in the user DB when a user authority cancellation request is made; And (3) canceling the mapped work group of the corresponding user in the user DB and requesting a user right change request and setting the authority by mapping a new work group to be changed to another work group of the work group DB. To provide Group Rights Management services. The method according to claim 11 or 12, (4) defining a new authority in the defined authority master DB when a new authority is granted in the system; And And (5) defining a new workgroup by combining the settings of the rights of the rights master DB with the workgroup DB when creating a new workgroup.

Images