TWI818798B - Method for permission management - Google Patents

Abstract

A method for permission management includes following steps of: generating a plurality of job roles with different permissions according to an organization permission table by a management system; generating a first permission structure directed graph according to the plurality of job roles; selecting one of the plurality of job roles in the first permission structure directed graph as a target job role by the management system; generating a minimum directed spanning graph in the first permission structure directed graph according to the target job role by the management system; determining whether a permission and a job of each of the plurality of job roles in the first permission structure directed graph match by the management system; and adjusting the permission and the job of each of the plurality of job roles so as to generate a second permission structure directed graph if the permission and the job of each of the plurality of job roles in the first permission structure directed graph are determined to be in consistent by the management system.

Description

Rights management methods

This case involves a management approach. In detail, this case involves a rights management method.

Existing permission management systems have hundreds of reports, and information departments usually set up report management permissions based on the needs of company personnel. However, the information department cannot determine whether the supervisor role has greater permissions than all of his subordinate roles. The supervisor does not know which reports he cannot see but which subordinates can see. Therefore, the information gap between supervisors and subordinates may delay the supervisor's decision-making time.

Therefore, the above-mentioned technology still has many shortcomings, and practitioners in the field need to develop other suitable rights management methods.

One aspect of this case involves a rights management approach. The permission management method includes the following steps: using the management system to generate a plurality of job roles with different permissions based on the group job permission table; using the management system to generate a first permission structure directed graph based on the plurality of job roles; using the management system to select the first permission structure directed graph. At least one of the plurality of job roles in a permission structure directed graph is used as the target job role; the management system generates a minimum directed generated graph in the first permission structure directed graph according to the target job role; by The management system determines whether the authority and position of each of the plurality of job roles in the first authority structure directed graph are consistent; and if the authority of each of the plurality of job roles in the first authority structure directed graph If the positions are judged to be incompatible, the management system adjusts the permissions and positions of multiple job roles to generate a second permission structure directed graph.

The following will clearly illustrate the spirit of this application with drawings and detailed descriptions. Anyone with ordinary knowledge in the technical field, after understanding the embodiments of this application, can make changes and modifications based on the techniques taught in this application without departing from the spirit of this application. Spirit and scope.

The terms used herein are only used to describe specific embodiments and are not intended to be limiting. Singular forms such as "a", "this", "this", "this" and "the", as used herein, also include the plural forms.

The words "includes", "includes", "has", "contains", etc. used in this article are all open terms, which mean including but not limited to.

Regarding the terms used in this article, unless otherwise noted, they generally have the ordinary meanings of each term used in this field, the content of this case, and the special content. Certain terms used to describe the present invention are discussed below or elsewhere in this specification to provide those skilled in the art with additional guidance in describing the present invention.

Figure 1 is a schematic circuit block diagram of the management system 100 according to some embodiments of the present invention. In some embodiments, please refer to FIG. 1 , the management system 100 includes a server 110 and a database 120 . Server 110 is coupled to database 120 .

In some embodiments, the database 120 of the management system 100 is used to store the group authority list. The server 110 of the management system 100 is used to generate a plurality of job roles with different permissions according to the group role permission table. The server 110 of the management system 100 is used to generate a first authority structure directed graph according to a plurality of job roles.

Next, please refer to Figure 1. The server 110 of the management system 100 is used to select at least one of a plurality of job roles in the first authority structure directed graph as the target job role. The server 110 of the management system 100 is used to generate a minimum directed generation graph in the first authority structure directed graph according to the target job role.

Furthermore, the server 110 of the management system 100 determines whether the authority and position of each of the plurality of job roles in the first authority structure directed graph are consistent. If the authority and position of each of the plurality of job roles in the first authority structure directed graph are determined to be inconsistent, the server 110 of the management system 100 is used to adjust the authority and position of each of the plurality of job roles. Authority and position, thereby generating a second authority structure directed graph.

Figure 2 is a schematic flowchart of the steps of the rights management method 200 according to some embodiments of this case. In some embodiments, in order to make the rights management method 200 in this case easy to understand, please refer to Figures 1 to 8 together. The above Figures 3 to 8 are examples of the rights management method 200 according to some embodiments of this case. Schematic diagram of a directed graph of permission structure. In some embodiments, the rights management method 200 can be executed by the management system 100 in Figure 1, and the relevant operation methods can be seen in Figures 3 to 8, as detailed below.

In step 210, a plurality of job roles with different permissions are generated according to the group role permission table.

For example, please refer to Figures 1 to 3. The server 110 of the management system 100 generates a plurality of job roles with different permissions (for example: job role A to job role G) according to the job authority table of the database 120. ).

In step 220, a first authority structure directed graph is generated according to a plurality of job roles.

For example, please refer to Figures 1 to 3. The server 110 of the management system 100 generates the first authority structure directed graph DG1 according to a plurality of job roles (for example: job role A to job role G).

In some embodiments, the plurality of job roles includes a first job role (eg, job role B) and a second job role (eg, job role I). The first job role (for example: job role B) contains multiple first permissions. The second job role (for example: job role I) contains multiple second permissions.

Then, if the first number of the plurality of first permissions of the first job role (for example: job role B) is the same as the second number of the plurality of second permissions of the second job role (for example: job role I), by The server 110 of the management system 100 determines whether the types of each of the plurality of first permissions and the types of each of the plurality of second permissions are the same.

Furthermore, if the types of each of the plurality of first authorities and the types of each of the plurality of second authorities are the same, the first job role and the second job role are selected by the server 110 of the management system 100 At least one of them (for example: select job role B), and generate the first authority structure directed graph DG1 based on at least one of the first job role and the second job role.

For example, please refer to Figure 3. Job role B has 4 permissions, and job role I also has 4 permissions. At this time, the server 110 of the management system 100 determines whether the four permissions of job role B and the four permissions of job role I are the same. If the four permissions of job role B and the four permissions of job role I are determined to be the same, then job role B is selected as the representative to generate the first permission structure directed graph DG1.

It should be noted that the purpose of this step of determining whether the permissions of job roles are the same is to simplify job roles with the same permissions, so that the first permission structure directed graph DG1 is a simple schema. It is further explained that when organizational positions expand and are subdivided into many subsidiary units or the number of job roles increases, this step of determining whether the permissions of job roles are the same helps to simplify permission management data.

In some embodiments, please refer to Figures 1 to 3, if the first number of the plurality of first permissions of the first job role (for example: job role C) and the second job role (for example: job role B) The second numbers of the plurality of second permissions are the same, and the server 110 of the management system 100 determines whether the first type of each of the plurality of first permissions and the second type of each of the plurality of second permissions are All are the same.

Then, if the first type of each of the plurality of first permissions and the second type of each of the plurality of second permissions are different, the server 110 of the management system 100 determines the first job role (for example, : Job role C) and the second job role (eg: Job role B) are different, so that the first authority is generated based on the first job role (eg: Job role C) and the second job role (eg: Job role B) Structural directed graph DG1.

For example, please refer to Figure 3. Job role B has 4 permissions, and job role C also has 4 permissions. At this time, the server 110 of the management system 100 determines whether the four permissions of job role B and the four permissions of job role C are the same. If at least one of the four permissions of job role B and at least one of the four permissions of job role C are determined to be different, the server 110 of the management system 100 will use the server 110 of the management system 100 to obtain the permissions based on the job role B and the job role C. The first authority structure directed graph DG1 is generated as shown in Figure 3.

In some embodiments, please refer to Figures 1 to 3, the plurality of job roles further include a third job role (for example: job role A). The third job role (for example: job role A) contains multiple third permissions. If the third number of the plurality of third permissions is less than the first number of the plurality of first permissions and the plurality of first permissions include the third permission, the server 110 of the management system 100 uses a third job role (for example: job role) The permission vector v1 is generated based on A), so that the permission vector v1 is connected from the third job role (for example: job role A) to the first job role (for example: job role C). The generation method of permission vector v2 to permission vector v6 is the same as the generation method of permission vector v1, which will not be described again.

It should be noted that the plurality of first permissions including third permissions means that the plurality of first permissions of the first position and role cover the plurality of third permissions owned by the third position and role. For example, job role C has 4 types of permissions, which are the first production line report, the second production line report, the first product experiment report and the second product experiment report. Job role A has 3 types of permissions, which are the first production line report, the first product experiment report and the second product actual report. Verification report.

To further explain, a graph with directional edges is called a directed graph (directed graph or digraph). The directed graph of the permission structure in this case must point from job roles with less permissions to job roles with more permissions.

In some embodiments, please refer to Figures 1 to 3, the server 110 of the management system 100 calculates the authorization vector according to the first number of the plurality of first authorizations and the third number of the plurality of third authorizations. weight value. The formula for calculating the weight value of the permission vector is as follows:

In Formula 1, W is the weight value of the authority vector. M1 is the number of permissions for a position with more permissions. M2 is the number of permissions for job roles with fewer permissions. α is a preset value, α is greater than or equal to 1.

，權重值w1之簡化數值為

。 For example, please refer to Figure 3. Assume that α=2 in Formula 1, job role C has 4 kinds of permissions and job role A has 3 kinds of permissions. Calculate the weight value w1 of the permission vector v1 according to the above formula 1, then the weight value w1 should be

, the simplified value of the weight value w1 is

.

In some embodiments, the formula for calculating the weight value of the permission vector in this case is not limited to the above formula 1. It should be noted that any formula that can calculate the weight value of the permission vector can be used. The calculation method of the weight value of the permission vector v2 to the permission vector v6 is the same as the calculation method of the weight value of the permission vector v1, and will not be described again.

In some embodiments, please refer to Figure 3. The permission management method 200 of this case can calculate the permission vector v2 and the permission vector v3 of job role A, job role B and job role D based on the permissions. It should be noted that the authority management method 200 in this case can also calculate the authority vectors from job role A to job role D based on the authority (not shown in the figure).

At this time, the weight value is used to modify the weight value of the authority vector (not shown in the figure) of job role A to job role D, so that the weight value of the authority vector (not shown in the figure) of job role A to job role D is greater than the authority vector. The weight value of v2 is added to the weight value of permission vector v3 to hide the permission vectors of job role A to job role D (not shown in the figure) to display permission vector v2 and permission vector v3. Finally, the permission management method 200 in this case will present the first permission structure directed graph DG1 as shown in Figure 3.

In step 230, at least one of the plurality of job roles in the first authority structure directed graph is selected as the target job role.

For example, please refer to Figures 1, 2 and 4. The server 110 of the management system 100 selects at least one of a plurality of job roles in the first authority structure directed graph DG1 (for example: Select Job Role D or Select Job Role F) as the target job role. It should be noted that the job role D can be the director of a department within a group. Job role F is the director of a different department from job role D.

In step 240, a minimum directed generation graph is generated in the first authority structure directed graph according to the target position role.

Following the above step 230, please refer to Figure 1, Figure 2, Figure 4 and Figure 5, select the target job role (for example: select job role D) through the server 110 of the management system 100, and then, through the management The server 110 of the system 100 generates the minimum directed generation graph MDG in the first authority structure directed graph DG1 according to the target job role (for example, selecting job role D).

In some embodiments, the plurality of job roles include a plurality of first group roles (for example: job role A, job role B, job role C, job role D, and job role H) and a plurality of second group roles (eg, job role A, job role B, job role C, job role D, and job role H). For example: job role E, job role F and job role G).

In some embodiments, the server 110 of the management system 100 selects at least one of a plurality of first group roles (for example, selects job role D) as the target job role. Through the server 110 of the management system 100, the server 110 determines the position according to the plurality of first group roles (for example: job role A, job role B, job role C, job role D and job role H) and the target job role (e.g.: job role D). ) to generate the minimum directed generation graph MDG as shown in Figure 5.

In addition, the server 110 of the management system 100 selects a plurality of second group roles (eg, job role E, job role F, and job role G) as a plurality of isolated roles IR.

It should be noted that assuming that the position role H is the chairman or general manager of the company, the meaning of the position role G in the diagram is that the position role G has special authority that the chairman or general manager of the company does not have.

Following the above step 230, please refer to Figure 1, Figure 2, Figure 4 and Figure 6, select the target job role (for example: select job role F) through the server 110 of the management system 100, and then, through the management The server 110 of the system 100 generates the minimum directed generation graph MDG in the first authority structure directed graph DG1 according to the target job role (for example: selecting job role F).

In some embodiments, the plurality of job roles include a plurality of first group roles (eg, job role E and job role F) and a plurality of second group roles (eg, job role A, job role B, job role C. Job role D, job role H and job role G).

In some embodiments, the server 110 of the management system 100 selects at least one of a plurality of first group roles (for example, selects job role F) as the target job role. The server 110 of the management system 100 generates the minimum valid information as shown in Figure 6 based on the plurality of first group roles (for example: job role E and job role F) and the target job role (for example: job role F). To generate graph MDG.

In addition, the server 110 of the management system 100 selects a plurality of second group roles (for example: job role A, job role B, job role C, job role D, job role H and job role G) as a plurality of Isolated role IR.

In step 250, it is determined whether the authority and position of each of the plurality of job roles in the first authority structure directed graph match.

For example, following the above step 240, please refer to Figure 1, Figure 2 and Figure 5, the server 110 of the management system 100 determines a plurality of second group roles as a plurality of isolated role IRs (for example: Whether the permissions and positions of job role E, job role F and job role G) match. If the permissions and positions of the plurality of second group roles as the plurality of isolated role IRs are determined to be inconsistent, step 260 is executed by the server 110 of the management system 100 .

Then, if the permissions and positions of the plurality of second group roles as the plurality of isolated roles IR are determined to be consistent, the server 110 of the management system 100 determines the minimum directed generation of the first permission structure directed graph DG1 Whether the permissions and positions of each of the plurality of job roles in Figure MDG (for example: job role A, job role B, job role C, job role D, and job role H) match. If each of the plurality of job roles in the minimum directed generated graph MDG of the first authority structure directed graph DG1 does not match, step 260 is executed by the server 110 of the management system 100 .

In addition, if each of the plurality of job roles in the minimum directed generated graph MDG of the first authority structure directed graph DG1 matches, step 270 is executed by the server 110 of the management system 100 .

It should be noted that the judgment method of the embodiment in Figure 6 is the same as the judgment method of the embodiment in Figure 5 and will not be described again here.

In step 260, the permissions and positions of multiple job roles are adjusted.

For example, following the above step 250, please refer to Figure 1, Figure 2, Figure 5 and Figure 7, if a plurality of second group roles (for example: position role E, position The permissions and positions of role F and position role G) are determined to be consistent and each of the plurality of job roles in the minimum directed generated graph MDG of the first permission structure directed graph DG1 (for example: position role A, If job role B, job role C, job role D and job role H) do not match, then the server 110 of the management system 100 adjusts the permissions of multiple job roles (for example: job role A' and job role D'). and positions, thereby re-executing step 220 to generate the second authority structure directed graph DG2 as shown in Figure 7.

Next, for example, please refer to Figures 1, 2, 5 and 7. The server 110 of the management system 100 determines that the job role A is a department manager, which has three types of permissions. The server 110 of the management system 100 determines that the job role D is a department member and has 5 types of permissions. The server 110 of the management system 100 determines that the positions and permissions of job role A and job role D are not consistent, and the server 110 of the management system 100 adjusts job role A and job role D in Figure 5 to be the first. Figure 7 shows job role A' and job role D'.

It should be noted that the above steps 220 to 260 can be executed repeatedly.

In step 270, a target authority structure directed graph is generated based on the adjusted plurality of job roles.

For example, following the above step 260, please refer to Figure 1, Figure 2, Figure 7 and Figure 8. The second permission structure directed graph DG2 in Figure 7 will be repeatedly executed by the server 110 of the managed system 100. Step 220 to step 260. If the permissions and positions of each of the plurality of job roles in the second authority structure directed graph DG2 in Figure 7 are determined to be consistent, then the server 110 of the management system 100 will generate a plurality of job roles based on the adjustment. The target authority structure directed graph TDG is shown in Figure 8.

In some embodiments, please refer to Figure 8. The position role H in the target authority structure directed graph TDG can be the chairman and general manager of the company. In some embodiments, please refer to Figure 8. The position role H in the target authority structure directed graph TDG can be the manager of the department in the company. In other words, this The case authority management method 200 can be applied to a group position or a department within a group position.

In practice, the rights management data is not limited to the form shown in the embodiments of Figures 3 to 8, and the embodiments of Figures 3 to 8 are only used to assist explanation. In some embodiments, the rights management data may be in the form of a software spreadsheet, a diagram, or a file.

Based on the aforementioned embodiments, this case provides a permission management method to generate a permission structure directed graph and a minimum directed generator graph, thereby first simplifying the huge permission data and checking the permission structure directed graph and minimum directed generator graph one by one. The permissions and positions of the job roles in the function can be used to fine-tune the job roles whose permissions and positions do not match. In addition, the authority management method in this case is subdivided into many subsidiary units or group positions in response to the expansion of organizational positions. When the number of positions and roles increases, the managers of the Information Technology department can find positions and roles that do not match the authority and positions, so as to adjust the authority. and job roles that the position does not meet.

Although this case is disclosed above with detailed embodiments, this case does not exclude other feasible implementation forms. Therefore, the scope of protection in this case shall be determined by the scope of the appended patent application and shall not be limited by the foregoing embodiments.

For those skilled in the art, various modifications and modifications can be made to the present application without departing from the spirit and scope of the present application. Based on the foregoing embodiments, all changes and modifications made to this case are also covered by the protection scope of this case.

100:Management system

110:Server

120:Database

200:Method

210~270: steps

A~I, A’, D’: job role

v1~v6: permission vector

DG1: The first authority structure directed graph

DG2: Second authority structure directed graph

TDG: Target permission structure directed graph

MDG: Minimum directed generator graph

IR: isolated role

The contents of this case can be better understood with reference to the implementation methods in the following paragraphs and the following diagrams: Figure 1 is a circuit block diagram of a management system according to some embodiments of this case; Figure 2 is a schematic flow chart of the steps of the rights management method according to some embodiments of this case; Figure 3 is a schematic diagram of a directed graph of the permission structure of the permission management method according to some embodiments of this case; Figure 4 is a schematic diagram of a directed graph of the permissions structure of the permissions management method according to some embodiments of this case; Figure 5 is a schematic diagram of a directed graph of the permission structure of the permission management method according to some embodiments of this case; Figure 6 is a schematic diagram of a directed graph of the permissions structure of the permissions management method according to some embodiments of this case; Figure 7 is a schematic diagram of a directed graph of the permissions structure of the permissions management method according to some embodiments of this case; and Figure 8 is a schematic diagram of a directed graph of the permission structure of the permission management method according to some embodiments of this case.

Domestic storage information (please note in order of storage institution, date and number) without Overseas storage information (please note in order of storage country, institution, date, and number) without

200:Method

210~270: steps

Claims (10)

A permission management method, including: using a management system to generate a plurality of job roles with different permissions based on a set of job permission tables; using the management system to generate a first permission structure directed graph based on the job roles; using The management system selects at least one of the job roles in the first authority structure directed graph as a target job role; the management system generates a minimum directed generated graph based on the target job role in the in the first authority structure directed graph; using the management system to determine whether the number and type of authority of each of the job roles in the first authority structure directed graph are consistent with a position; and If the number and type of permissions of each of the job roles in the first permission structure directed graph are determined to be inconsistent with the position, the management system will adjust the number of permissions in the job roles through the management system. The authority and the position of each, thereby generating a second authority structure directed graph. The permission management method as described in claim 1, wherein the job roles include a first job role and a second job role, wherein the first job role includes a plurality of first permissions, and the second job role includes a plurality of first permissions. a second authority, wherein the step of generating the first authority structure directed graph according to the job roles by the management system includes: if the first number of one of the first authority and the first number of one of the second authority If the two quantities are the same, the management system determines whether the first type of each of the first permissions and the second type of each of the second permissions are the same; and if the first permissions The first type of each of the second permissions and the second type of each of the second permissions are the same, then at least one of the first job role and the second job role is selected through the management system , and generate the first authority structure directed graph based on at least one of the first job role and the second job role. The authority management method as described in claim 2, wherein the step of generating the first authority structure directed graph according to the job roles by the management system further includes: if the third authority of each of the first authority If a type and the second type of each of the second permissions are different, then the management system determines that the first job role and the second job role are not the same, so as to determine based on the first job role and the second job role. The second position role generates the first authority structure directed graph. The permission management method as described in claim 2, wherein the job roles further include a third job role, wherein the third job role includes a plurality of third permissions, and the management system generates The steps of the first permission structure directed graph further include: if a third quantity of one of the third permissions is less than the first quantity of the first permissions and the first permissions include the third permissions, by The management The system generates a permission vector based on the third job role, so that the permission vector is linked from the third job role to the first job role. The permission management method as described in claim 4, wherein the step of generating the first permission structure directed graph according to the job roles by the management system further includes: using the management system according to the first permissions The first number and the third number of the third permissions are used to calculate a weight value of the permission vector. The permission management method as described in claim 5, wherein the job roles include a plurality of first group roles and a plurality of second group roles, wherein the management system selects one of the first permission structure directed graphs The step of using at least one of the job roles as the target job role includes: selecting at least one of the first group roles as the target job role through the management system; and through the management The system selects these second group characters as a plurality of isolated characters. The permission management method of claim 6, wherein the first group roles include the first job role and the third job role linked by the permission vector. The rights management method as described in claim 6, wherein by The steps for the management system to generate the minimum directed generation graph in the first authority structure directed graph based on the target job role include: generating the management system based on the target job role and the first group roles. Minimal directed generating graph. The permission management method as described in claim 8, wherein the management system determines whether the number and type of permissions for each of the job roles in the first permission structure directed graph are consistent with the position. The matching steps include: using the management system to determine whether the permissions and positions of the second group roles as the isolated roles are consistent; and if the second group roles as the isolated roles are If the authority and the position are determined to be inconsistent, the management system adjusts the authority and the position of the second group roles as the isolated roles, thereby generating the second authority structure directed graph. The permission management method as described in claim 1 further includes: if the number and type of permissions for each of the job roles in the second permission structure directed graph are determined to be consistent with the position. , then the management system generates a target authority structure directed graph according to the adjusted job roles.

Images