WO2018196876A1 - 基于角色对用户一对一的工作流控制方法和系统 - Google Patents
基于角色对用户一对一的工作流控制方法和系统 Download PDFInfo
- Publication number
- WO2018196876A1 WO2018196876A1 PCT/CN2018/085162 CN2018085162W WO2018196876A1 WO 2018196876 A1 WO2018196876 A1 WO 2018196876A1 CN 2018085162 W CN2018085162 W CN 2018085162W WO 2018196876 A1 WO2018196876 A1 WO 2018196876A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- role
- approval
- user
- workflow
- node
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
- G06Q10/06311—Scheduling, planning or task assignment for a person or group
- G06Q10/063112—Skill-based matching of a person or a group to a task
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
- G06Q10/06311—Scheduling, planning or task assignment for a person or group
- G06Q10/063114—Status monitoring or status determination for a person or group
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
- G06Q10/06316—Sequencing of tasks or work
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/103—Workflow collaboration or project management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2145—Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
Definitions
- the invention relates to a workflow control method for a management software system such as an ERP, in particular to a workflow control method and system based on a role-to-user one-to-one operation.
- Role-based access control is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive. Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years.
- the basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.
- the role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.
- the traditional role-based user rights management and workflow control methods adopt the "role-to-user one-to-many" association mechanism, and the "role” is group/class nature, that is, one role can simultaneously correspond to/associate multiple users.
- the role is similar to the concept of position/position/work type.
- the authorization of user rights under this association mechanism is basically divided into the following three forms:
- the role (class/group/post/work type nature) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the approval operation subject is a group/class nature role;
- the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
- the workflow approval node directly selects the employee/user as the approval subject, or the new role is added to meet the requirements of the approval process.
- employee changes such as transfer, resignation, etc.
- all the processes involved in the employee must be adjusted accordingly, especially for company management personnel, which involves more approval processes and process adjustments. Large amount, complicated, easy to make mistakes or omissions, affecting the normal operation of the company, and even causing unpredictable losses.
- the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.
- the object of the present invention is to overcome the deficiencies of the prior art and provide a workflow control method and system for one-to-one based on roles.
- a role can only be associated with a unique user in the same period, and the rights management in the system is greatly improved.
- Efficiency makes dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of permission settings;
- the main body of the approval operation in the workflow is the role, when the employee/user changes, just re-associate the user to Role, or adjust the role permissions to adjust the role, no need to reset the process, easy to set up.
- a workflow-to-user one-to-one workflow control method including the following steps:
- S1 A three-tier structure model for building user-role-permissions, where:
- Role layer The operation subject of process approval in workflow is role. Each role is an independent individual, not a group/class. One role can only associate with a unique user in the same period, and one user is associated with one or more roles.
- Privilege layer consists of the privilege required to be used in the execution of the workflow, and the privilege is directly delegated to the role;
- User layer The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role;
- S2 The workflow is controlled by a three-layer structure model, and an approval process includes a start node, at least one approval node, and an end node:
- Start node initiate/apply/submit workflow
- Approval node Select the approval role and authorize the approval role
- End node After the process flow goes to this node, it indicates that the approval process approval is over;
- S3 The user determines the approval task to be processed according to the associated role, and performs an approval operation according to the rights of the associated role.
- the role initiation/application/submission workflow is initiated, and the role with the workflow initiation permission can initiate/apply/submit the workflow as the initiation role.
- the system determines the approval process based on the form submitted by the originating role.
- one or more approval processes are designed for a form that requires a workflow, but a role can only select one of the approval processes under the form.
- a role is Chengdu sales manager 3, in the contract approval workflow, it exists in the Chengdu sales contract approval and Shanghai sales contract approval two approval nodes; for the Chengdu sales contract approval node, the role can be viewed at the time of approval
- the customer name, contact person, contact information, product quantity, product unit price, contract amount and other fields of the contract, and the unit price and contract amount of the product can be modified; but the approval node of the sales contract in Shanghai cannot view the customer name and contact person.
- the sensitive field content, such as contact information can not be modified (but can also be set to have viewing rights, no modification rights).
- the step S1 described includes the following sub-steps:
- S103 Associate a user to a role, wherein one role can only associate a unique user in the same time period, and one user associates one or more roles;
- Step S101 is preceded, but step S102 and step S103 have no sequential relationship.
- the role belongs to a department, and the role is unique under the department, and the role is authorized according to the work content of the role.
- a one-to-one workflow control method based on roles and users, and a user inter-department management process which includes:
- a one-to-one workflow control system based on role-to-user including model building unit, workflow control unit, and approval operation unit:
- the model building unit is used to build a three-tier structure model of user-role-permission, where:
- Role layer The operation subject of process approval in workflow is role. Each role is an independent individual, not a group/class. One role can only associate with a unique user in the same period, and one user is associated with one or more roles.
- Privilege layer consists of the privilege required to be used in the execution of the workflow, and the privilege is directly delegated to the role;
- User layer The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role;
- the workflow control unit controls the workflow by using a three-tier structure model.
- One approval process includes a start node, at least one approval node, and an end node:
- Start node initiate/apply/submit workflow
- Approval node Select the approval role and authorize the approval role
- End node After the process flow goes to this node, it indicates that the approval process approval is over;
- the user in the approval operation unit determines the approval task to be processed according to the role associated with it, and performs the approval operation according to the authority of the associated role.
- the model building unit includes a role establishing submodule, a role authorization submodule, and a user-role association submodule;
- the role establishment sub-module is configured to perform role layout according to the post, and establish system roles, each role being an independent individual, not a group/class;
- the role authorization sub-module is configured to assign a role to the role according to the working content of the role;
- the user-role association sub-module is used to associate a user to a role, ensuring that one role can only associate with a unique user during the same period, and one user associates one or more roles.
- the system role is composed of: a post name + a post number.
- the main body of the approval operation in the workflow is the role, and this role is an independent individual rather than a traditional group/class role, even if employee/user changes occur (such as transfer, resignation, etc.), or employee approval authority If there is a change, simply re-associate the employee to the new role, or adjust the role approval authority accordingly. There is no need to reset/adjust the process. It is easy to set up, no mistakes or omissions, and will not affect the normal operation of the enterprise. Greatly improved the reliability of the workflow.
- the role of the nature of the post number is the approval authority of the approval link node. The user determines which approval tasks are available through the role. The user can approve the operation by associating the role permissions; the understanding is clear and simple, and the nature of each post number/station number
- the role is the smallest unit of the work subject, and this application can be well satisfied for each role's different requirements for approval.
- the role of the application is a one-to-one relationship to the user.
- a role can only be associated with a unique user at the same time. The advantage of this is that the user is no longer required to assign permissions every time the user is created, as long as The user is associated with the role, and the role's permission changes are much less than the user permissions in the traditional mechanism.
- the number of roles of the nature of the independent body (the nature of the post number/station number) is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.
- the operation of dynamic management, on-the-job adjustment, etc. is simple and convenient, high in efficiency and high in reliability: the application of the entry/departure/admission in the approval process is simple, and the operation subject of the approval of the workflow is the role, when the employee/user There is no need to reset the approval process when the change occurs (the user only needs to cancel or associate the role: the user who is no longer in the role of the job number/station number cancels the role association and takes over the role of the job number/station number. If the user is associated with the role of the job number, the user associated with the role automatically obtains the related tasks and permissions of the role in the approval workflow, without resetting the approval workflow or reauthorizing the roles in the workflow. , greatly improving the efficiency, security and reliability of process settings.
- Zhang San is no longer working as a “buyer 3”, Zhang San cancels the association with the role; Li Si took over as “Purchaser 3”
- Li Si is associated with the role, and Li Si automatically obtains the approval task and approval authority for the role of “Purchase 3” in the approval process.
- the traditional authority management mechanism defines the role as a group, a job type, a class, etc.
- the role is a one-to-many relationship with the user. In the actual system use process, it is often necessary to perform the user's authority in the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements.
- the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
- the role since the role is an independent individual, the role permission can be changed to achieve the goal.
- the method of the present application seems to increase the workload when the system is initialized, it can be made by copying and the like to make the role or authorization more efficient than the traditional group-based role, because the role of the group is not considered.
- the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user.
- the efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.
- the traditional group-based role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization errors, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.
- the method of the present application is as follows: the transferred user associates several roles.
- the user When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.
- the role belongs to a certain department, the department cannot be replaced, and the role cannot be changed:
- a role can exist in different approval nodes in the same approval process. Each approval role of each approval node can be set with independent permissions. The approval role of this approval role can be viewed and modified in different approval nodes. Permissions can vary.
- a role is Chengdu sales manager 3, in the contract approval workflow, it exists in the Chengdu sales contract approval and Shanghai sales contract approval two approval nodes; for the Chengdu sales contract approval node, the role can be viewed at the time of approval
- the customer name, contact person, contact information, product quantity, product unit price, contract amount and other fields of the contract, and the unit price and contract amount of the product can be modified; but the approval node of the sales contract in Shanghai cannot view the customer name and contact person. , sensitive information such as contact information, and can not be modified. In this way, you can customize the permissions of the role in the approval process.
- FIG. 1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art
- FIG. 2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art
- FIG. 3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art
- FIG. 5 is a schematic diagram of a manner in which a system authorizes a user through an independent individual role
- FIG. 6 is a schematic diagram of a workflow approval process according to the present invention.
- FIG. 7 is a flowchart of a user-role authorization method according to the present invention.
- a workflow-to-user one-to-one workflow control method includes the following steps:
- S1 A three-tier structure model for building user-role-permissions, where:
- Role layer The operation subject of process approval in workflow is role. Each role is an independent individual, not a group/class. One role can only associate with a unique user in the same period, and one user is associated with one or more roles.
- Privilege layer consists of the privilege required to be used in the execution of the workflow, and the privilege is directly delegated to the role;
- User layer The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role;
- an approval process includes a start node, at least one approval node, and an end node:
- Start node initiate/apply/submit workflow
- Approval node Select the approval role and authorize the approval role
- End node After the process flow goes to this node, it indicates that the approval process approval is over;
- S3 The user determines the approval task to be processed according to the associated role, and performs an approval operation according to the rights of the associated role.
- the role initiation/application/submission workflow is initiated, and the role with the workflow initiation permission can initiate/apply/submit the workflow as the initiation role.
- the system determines the approval process based on the form submitted by the originating role.
- the procurement contract form has two processes, namely the P1 process and the P2 process. If the role A is selected in the start node of the P1 process, the role A cannot be selected at the beginning node of the P2 process. At this time, the role A is new. Add an approval for the purchase contract and automatically enter the P1 process when submitting the approval.
- a role is Chengdu sales manager 3, in the contract approval workflow, it exists in the Chengdu sales contract approval and Shanghai sales contract approval two approval nodes; for the Chengdu sales contract approval node, the role can be viewed at the time of approval
- the customer name, contact person, contact information, product quantity, product unit price, contract amount and other fields of the contract, and the unit price and contract amount of the product can be modified; but the approval node of the sales contract in Shanghai cannot view the customer name and contact person.
- the sensitive field content, such as contact information can not be modified (but can also be set to have viewing rights, no modification rights).
- step S1 described includes the following substeps:
- S103 Associate a user to a role, wherein one role can only associate a unique user in the same time period, and one user associates one or more roles;
- Step S101 is preceded, but step S102 and step S103 have no sequential relationship.
- the user determines the privilege through its association with the role. If the privilege of the user is to be modified, the privilege possessed by the role is adjusted to achieve the purpose of changing the privilege of the user associated with the role. Once a user associates a role, that user has all the operational privileges for that role.
- the role of the role to the user is one-to-one (when the role is associated with a user, other users can no longer associate the role; if the role is not associated with the user, it can be associated with other users).
- a user's relationship to a role is one-to-many (one user can associate multiple roles at the same time).
- Role definition The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).
- a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
- Zhang San the company's employee, serves as the deputy general manager of the company, and serves as a manager of Beijing sales
- Zhang San needs to be associated with the deputy general manager 2 and a sales manager in Beijing, Zhang San Have the rights to both roles.
- the system's authorization for a role includes, but is not limited to, authorization of a form, authorization of a menu, or authorization of a function.
- Authorization for the operation of the form includes but is not limited to additions and deletions.
- roles are group/class/post/position/work type, and one role can correspond to multiple users.
- the concept of "role" in this application is equivalent to the post number/station number, and is similar to the role in the film and television drama: a character can only be played by one actor at the same time (childhood, juvenile, middle-aged). And an actor may be decorated with multiple angles.
- Authorization for a role includes, but is not limited to, authorization of a form, authorization of a menu, or authorization of a function.
- the role belongs to a department, and the role is unique under the department, and the role is authorized according to the work content of the role.
- the specific operation process includes:
- the role After the role is created, you can associate the role in the process of creating the user, or you can associate it at any time after the user is created. After the user associates the role, the relationship with the role can be released at any time, and the relationship with other roles can be established at any time.
- step S1 described includes the following sequence of substeps:
- S102 Associate a user to a role, wherein one role can only associate a unique user in the same period, and one user associates one or more roles;
- the role belongs to a department, and the role is unique under the department, and the role is authorized according to the work content of the role.
- the workflow control method further includes a user cross-department management step, which specifically includes:
- the model building unit is used to build a three-tier structure model of user-role-permission, where:
- Role layer The operation subject of process approval in workflow is role. Each role is an independent individual, not a group/class. One role can only associate with a unique user in the same period, and one user is associated with one or more roles.
- Privilege layer consists of the privilege required to be used in the execution of the workflow, and the privilege is directly delegated to the role;
- User layer The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role;
- the workflow control unit controls the workflow by using a three-tier structure model.
- One approval process includes a start node, at least one approval node, and an end node:
- Start node initiate/apply/submit workflow
- Approval node Select the approval role and authorize the approval role
- End node After the process flow goes to this node, it indicates that the approval process approval is over;
- the user in the approval operation unit determines the approval task to be processed according to the role associated with it, and performs the approval operation according to the authority of the associated role.
- the model building unit includes a role establishing submodule, a role authorization submodule, and a user-role association submodule;
- the role establishment sub-module is configured to perform role layout according to the post, and establish system roles, each role being an independent individual, not a group/class;
- the role authorization sub-module is configured to assign a role to the role according to the working content of the role;
- the user-role association sub-module is used to associate a user to a role, ensuring that one role can only associate with a unique user during the same period, and one user associates one or more roles.
- the system role is composed of: a post name + a post number.
- workshop production workers 1, workshop production workers 2, workshop production workers 3... roles are independent individuals, equivalent to the concept of job number and station number, different from the role in the traditional authority management system, the concept of role in the traditional system It is the group/class nature of the position/position/work type.
- New entry The employee is newly hired and directly associates the role of the user (employee) with the corresponding job number/station number. For example: Zhang San joined the company (the company assigned a three-user to Zhang San) The work content is in the sales department, responsible for the sales of refrigerator products in the Beijing area (the corresponding role is to sell the role of "Sales Engineer 5" under one part), then Zhang San users directly select the role of "Sales Engineer 5" .
- Zhang also arranged for Zhang San to be responsible for the sales of regional TV products in Beijing (the corresponding role is to sell the role of “Sales Engineer 8” under the Ministry of Sales) and concurrently as the head of the after-sales department (corresponding to the after-sales department)
- the three users added the roles of “sales engineer 8” under the sales department and “sales department supervisor 1” under the after-sales department.
- Zhang San employees associated three roles, respectively.
- Zhang San users have the authority of these three roles.
- Zhang San serves as the post-sales manager (corresponding to the role of “after-sales manager” in the after-sales department) and no longer take up other jobs. Then Zhang San user is associated with the role of “after-sales manager” in the after-sales department, and cancels the three roles previously associated (Sales Engineer 5 under Sales, Sales Engineer 8 and “After Sales Manager 1” under the after-sales department) At this time, Zhang San users only have the authority of the role of “after-sales manager” under the after-sales department.
- This application authorizes the role of the nature of the post number/station number, and the user associates the role to determine the authority, then the control of the user right is achieved through a simple user-role relationship, allowing the authority Control is simple, easy to operate, clear and clear, and greatly enhances the efficiency of authorization and the reliability of authorization.
- the role (class/group/post/work type nature) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the approval operation subject is a group/class nature role;
- the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
- the workflow approval node directly selects the employee/user as the approval subject, or the new role is added to meet the requirements of the approval process.
- employee changes such as transfer, resignation, etc.
- all the processes involved in the employee must be adjusted accordingly, especially for company management personnel, which involves more approval processes and process adjustments. Large amount, complicated, easy to make mistakes or omissions, affecting the normal operation of the company, and even causing unpredictable losses.
- the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Economics (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Tourism & Hospitality (AREA)
- Educational Administration (AREA)
- Game Theory and Decision Science (AREA)
- Development Economics (AREA)
- Data Mining & Analysis (AREA)
- Software Systems (AREA)
- General Health & Medical Sciences (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Automation & Control Theory (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
Claims (12)
- 基于角色对用户一对一的工作流控制方法,其特征在于,包括以下步骤:S1:构建用户-角色-权限的三层结构模型,其中:角色层:工作流中流程审批的操作主体为角色,每个角色是独立的个体,而非组/类,同一时段一个角色只能关联唯一的用户,而一个用户关联一个或多个角色;权限层:由工作流执行中所需要使用的权限构成,权限直接授权给角色;用户层:用户通过关联的角色确定工作流中的审批任务,并以关联角色的权限进行审批操作;S2:利用三层结构模型对工作流进行控制,一个审批流程中包括一个开始节点、至少一个审批节点、一个结束节点:开始节点:发起/申请/提交工作流;审批节点:选择审批角色,并对审批角色进行授权;结束节点:流程流转到此节点后,表示该审批流程审批结束;S3:用户根据其关联的角色确定所需处理的审批任务,并根据关联的角色的权限进行审批操作。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:开始节点发起/申请/提交工作流时,发起角色发起/申请/提交工作流,有工作流发起权限的角色才能作为发起角色发起/申请/提交工作流。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:开始节点发起/申请/提交工作流时,系统根据发起角色所提交的表单确定审批流程。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于,开始节点发起/申请/提交工作流时,针对需要有工作流的表单设计一个或多个审批流程,但一个角色只能选择该表单下的某一个审批流程。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:在审批节点选择一个或多个审批角色,一个角色在同一个审批流程中能够存在于不同审批节点,不同审批节点中该审批角色对表单字段的查看、修改权限可不同。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:在审批节点选择一个或多个审批角色,在审批节点设置审批角色的权限,针对每个审批节点的每个审批角色能够进行独立的权限设置。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:所述的步骤S1包括以下子步骤:S101:创建角色,每个角色是独立的个体,而非组/类;S102:对S101所创建的角色分别进行授权;S103:将用户关联到角色,其中,同一时段一个角色只能关联唯一的用户,而一个用户关联一个或多个角色;步骤S101在先,但步骤S102与步骤S103无先后顺序关系。
- 根据权利要求1所述的基于角色对用户一对一的工作流控制方法,其特征在于:所述的角色归属于某一个部门,且该角色在该部门下唯一,根据角色的工作内容对角色进行授权。
- 根据权利要求8所述的基于角色对用户一对一的工作流控制方法,其特征在于:还包括一个用户跨部门调岗管理步骤,具体包括:(1)取消用户与原部门内的角色的关联;(2)将用户与新部门内的角色进行关联。
- 基于角色对用户一对一的工作流控制系统,其特征在于:包括模型构建单元、工作流控制单元和审批操作单元:模型构建单元用于构建用户-角色-权限的三层结构模型,其中:角色层:工作流中流程审批的操作主体为角色,每个角色是独立的个体,而非组/类,同一时段一个角色只能关联唯一的用户,而一个用户关联一个或多个角色;权限层:由工作流执行中所需要使用的权限构成,权限直接授权给角色;用户层:用户通过关联的角色确定工作流中的审批任务,并以关联角色的权限进行审批操作;工作流控制单元利用三层结构模型对工作流进行控制,一个审批流程中包括一个开始节点、至少一个审批节点、一个结束节点:开始节点:发起/申请/提交工作流;审批节点:选择审批角色,并对审批角色进行授权;结束节点:流程流转到此节点后,表示该审批流程审批结束;审批操作单元中用户根据其关联的角色确定所需处理的审批任务,并根据关联的角色的权限进行审批操作。
- 根据权利要求10所述的基于角色对用户一对一的工作流控制系统,其特征在于:所述的模型构建单元包括角色建立子模块、角色授权子模块和用户-角色关联子模块;所述的角色建立子模块用于根据岗位进行角色布局,建立系统角色,每个角色是独立个体,而非组/类;所述的角色授权子模块用于根据角色的工作内容对角色赋予权限;所述的用户-角色关联子模块用于将用户关联到角色,确保同一时段一个角色只能关联唯一的用户,一个用户关联一个或多个角色。
- 根据权利要求11所述的基于角色对用户一对一的工作流控制系统,其特征在于:所述系统角色的构成为:岗位名+岗内编号。
Priority Applications (8)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP18791757.0A EP3617962A4 (en) | 2017-04-29 | 2018-04-28 | SYSTEM AND PROCESS FOR CONTROLLING WORKFLOWS BASED ON BIUNIVOCAL CORRESPONDENCE BETWEEN ROLES AND USERS |
AU2018258773A AU2018258773A1 (en) | 2017-04-29 | 2018-04-28 | Workflow control method and system based on one-to-one correspondence between roles and users |
US16/609,444 US11363026B2 (en) | 2017-04-29 | 2018-04-28 | Workflow control method and system based on one-to-one correspondence between roles and users |
CA3066854A CA3066854A1 (en) | 2017-04-29 | 2018-04-28 | Workflow control method and system based on one-to-one correspondence between roles and users |
KR1020197032195A KR20190130639A (ko) | 2017-04-29 | 2018-04-28 | 사용자에 대한 역할의 일대일 매칭을 기반으로 하는 작업 흐름 제어 방법과 시스템 |
EA201992530A EA201992530A1 (ru) | 2017-04-29 | 2018-04-28 | Способ и система управления потоком работ на основе соответствия одной роли одному пользователю |
ZA2019/07066A ZA201907066B (en) | 2017-04-29 | 2019-10-25 | Workflow control method and system based on one-to-one correspondence between roles and users |
PH12019502672A PH12019502672A1 (en) | 2017-04-29 | 2019-11-26 | Workflow control method and system based on one-to-one correspondence between roles and users |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201710297689.2A CN107180334A (zh) | 2017-04-29 | 2017-04-29 | 基于角色对用户一对一的工作流控制方法和系统 |
CN201710297689.2 | 2017-04-29 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2018196876A1 true WO2018196876A1 (zh) | 2018-11-01 |
Family
ID=59832019
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2018/085162 WO2018196876A1 (zh) | 2017-04-29 | 2018-04-28 | 基于角色对用户一对一的工作流控制方法和系统 |
Country Status (10)
Country | Link |
---|---|
US (1) | US11363026B2 (zh) |
EP (1) | EP3617962A4 (zh) |
KR (1) | KR20190130639A (zh) |
CN (2) | CN107180334A (zh) |
AU (1) | AU2018258773A1 (zh) |
CA (1) | CA3066854A1 (zh) |
EA (1) | EA201992530A1 (zh) |
PH (1) | PH12019502672A1 (zh) |
WO (1) | WO2018196876A1 (zh) |
ZA (1) | ZA201907066B (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111711529A (zh) * | 2020-06-12 | 2020-09-25 | 腾讯科技(深圳)有限公司 | 群操作处理方法、装置、系统、设备及存储介质 |
Families Citing this family (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107180334A (zh) * | 2017-04-29 | 2017-09-19 | 成都牵牛草信息技术有限公司 | 基于角色对用户一对一的工作流控制方法和系统 |
CN107169365A (zh) * | 2017-05-16 | 2017-09-15 | 成都牵牛草信息技术有限公司 | 工作流及其审批节点的表单字段操作权限的设定方法 |
CN107045675A (zh) * | 2017-05-23 | 2017-08-15 | 成都牵牛草信息技术有限公司 | 工作流审批节点按角色设置审批角色的方法 |
CN107203870A (zh) * | 2017-05-23 | 2017-09-26 | 成都牵牛草信息技术有限公司 | 工作流审批节点按部门设置审批角色的方法 |
CN107358093A (zh) * | 2017-07-11 | 2017-11-17 | 成都牵牛草信息技术有限公司 | 通过第三方字段对表单字段的字段值进行授权的方法 |
CN107392499A (zh) | 2017-08-10 | 2017-11-24 | 成都牵牛草信息技术有限公司 | 对使用者进行审批流程及其审批节点授权的方法 |
CN107493304B (zh) * | 2017-09-30 | 2020-06-30 | 新奥(中国)燃气投资有限公司 | 一种授权管理平台及方法 |
CN108038669A (zh) * | 2017-12-25 | 2018-05-15 | 泰康保险集团股份有限公司 | 权限管理机制的配置方法、装置、设备和存储介质 |
EP3550791B1 (en) | 2018-04-03 | 2023-12-06 | Palantir Technologies Inc. | Controlling access to computer resources |
CN108776759A (zh) * | 2018-04-16 | 2018-11-09 | 江苏大学 | 一种基于授权的自动排队表单编号管理系统及方法 |
CN109146400A (zh) * | 2018-07-06 | 2019-01-04 | 北京地厚云图科技有限公司 | 小组管理方法和存储介质 |
CN109064005A (zh) * | 2018-07-27 | 2018-12-21 | 北京中关村科金技术有限公司 | 一种基于任务优先级的贷款审批任务公平自动派单系统 |
CN109039792A (zh) * | 2018-10-30 | 2018-12-18 | 深信服科技股份有限公司 | 网络管理设备的管理方法、装置、设备及存储介质 |
CN110163577B (zh) * | 2019-05-23 | 2023-07-18 | 广东启动子信息科技有限公司 | 一种基于权限管理的表单动态管理方法及系统 |
CN110334490A (zh) * | 2019-07-16 | 2019-10-15 | 山东浪潮通软信息科技有限公司 | 一种基于React的前端权限控制方法 |
US11704441B2 (en) | 2019-09-03 | 2023-07-18 | Palantir Technologies Inc. | Charter-based access controls for managing computer resources |
CN110990856A (zh) * | 2019-12-06 | 2020-04-10 | 广东联晟通信科技有限公司 | 一种权限审核方法及系统 |
CN111090871B (zh) * | 2019-12-18 | 2022-04-12 | 京东科技控股股份有限公司 | 一种权限开通处理方法及装置 |
CN111414591B (zh) * | 2020-03-02 | 2024-02-20 | 中国建设银行股份有限公司 | 工作流管理的方法和装置 |
CN111340454A (zh) * | 2020-03-04 | 2020-06-26 | 山信软件股份有限公司 | 企业作业证安全管理方法 |
US11599717B2 (en) | 2020-03-20 | 2023-03-07 | Capital One Services, Llc | Separately collecting and storing form contents |
CN111428257B (zh) * | 2020-03-30 | 2023-09-01 | 北京东方金信科技股份有限公司 | 一种通过自动审批将数据库元数据开放的系统和方法 |
CN111460500B (zh) * | 2020-03-31 | 2023-12-01 | 贵州电网有限责任公司 | 一种网络资源的权限管理方法 |
CN115526579A (zh) * | 2021-11-26 | 2022-12-27 | 北京字跳网络技术有限公司 | 确定项目流的方法、装置、电子设备及存储介质 |
US20230022024A1 (en) * | 2022-10-01 | 2023-01-26 | Bishwadeep Bhattacharyya | Post-election automatic handover of position and administrative privileges |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102468971A (zh) * | 2010-11-04 | 2012-05-23 | 北京北方微电子基地设备工艺研究中心有限责任公司 | 权限管理方法和装置、权限控制方法和装置 |
CN103455888A (zh) * | 2013-09-10 | 2013-12-18 | 山东中创软件工程股份有限公司 | 一种配置流程权限的方法及装置 |
CN107180334A (zh) * | 2017-04-29 | 2017-09-19 | 成都牵牛草信息技术有限公司 | 基于角色对用户一对一的工作流控制方法和系统 |
Family Cites Families (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6088679A (en) * | 1997-12-01 | 2000-07-11 | The United States Of America As Represented By The Secretary Of Commerce | Workflow management employing role-based access control |
US7669244B2 (en) * | 2004-10-21 | 2010-02-23 | Cisco Technology, Inc. | Method and system for generating user group permission lists |
US20060218394A1 (en) * | 2005-03-28 | 2006-09-28 | Yang Dung C | Organizational role-based controlled access management system |
US9455990B2 (en) * | 2006-07-21 | 2016-09-27 | International Business Machines Corporation | System and method for role based access control in a content management system |
US20120203588A1 (en) * | 2011-02-04 | 2012-08-09 | International Business Machines Corporation | Task assignment in a workflow system |
US9916461B2 (en) * | 2012-09-10 | 2018-03-13 | International Business Machines Corporation | Identity context-based access control |
US9280566B2 (en) * | 2012-11-02 | 2016-03-08 | Ca, Inc. | System and method for visual role engineering |
CN104346663A (zh) * | 2013-07-26 | 2015-02-11 | 镇江雅迅软件有限责任公司 | 一种基于工作流的合同审批方法 |
US20200076818A1 (en) * | 2013-10-03 | 2020-03-05 | The Board Of Regents Of The University Of Texas System | Risk-aware sessions in role based access control systems and methods of use |
CN105376198A (zh) * | 2014-08-22 | 2016-03-02 | 中兴通讯股份有限公司 | 访问控制方法及装置 |
US20160232294A1 (en) | 2015-02-11 | 2016-08-11 | Ricoh Company, Ltd. | Managing Access To Workflows Using Roles |
CN105005730A (zh) | 2015-08-13 | 2015-10-28 | 杭州杉石科技有限公司 | 一种基于app应用的权限设计方法 |
CN106529761A (zh) | 2016-09-26 | 2017-03-22 | 山东浪潮商用系统有限公司 | 一种工作流引擎及其实现方法 |
-
2017
- 2017-04-29 CN CN201710297689.2A patent/CN107180334A/zh active Pending
-
2018
- 2018-04-28 WO PCT/CN2018/085162 patent/WO2018196876A1/zh active Application Filing
- 2018-04-28 KR KR1020197032195A patent/KR20190130639A/ko not_active Application Discontinuation
- 2018-04-28 US US16/609,444 patent/US11363026B2/en active Active
- 2018-04-28 EA EA201992530A patent/EA201992530A1/ru unknown
- 2018-04-28 EP EP18791757.0A patent/EP3617962A4/en active Pending
- 2018-04-28 CN CN201810398996.4A patent/CN108717620A/zh active Pending
- 2018-04-28 AU AU2018258773A patent/AU2018258773A1/en not_active Abandoned
- 2018-04-28 CA CA3066854A patent/CA3066854A1/en not_active Abandoned
-
2019
- 2019-10-25 ZA ZA2019/07066A patent/ZA201907066B/en unknown
- 2019-11-26 PH PH12019502672A patent/PH12019502672A1/en unknown
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102468971A (zh) * | 2010-11-04 | 2012-05-23 | 北京北方微电子基地设备工艺研究中心有限责任公司 | 权限管理方法和装置、权限控制方法和装置 |
CN103455888A (zh) * | 2013-09-10 | 2013-12-18 | 山东中创软件工程股份有限公司 | 一种配置流程权限的方法及装置 |
CN107180334A (zh) * | 2017-04-29 | 2017-09-19 | 成都牵牛草信息技术有限公司 | 基于角色对用户一对一的工作流控制方法和系统 |
Non-Patent Citations (1)
Title |
---|
See also references of EP3617962A4 * |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111711529A (zh) * | 2020-06-12 | 2020-09-25 | 腾讯科技(深圳)有限公司 | 群操作处理方法、装置、系统、设备及存储介质 |
CN111711529B (zh) * | 2020-06-12 | 2022-03-15 | 腾讯科技(深圳)有限公司 | 群操作处理方法、装置、系统、设备及存储介质 |
Also Published As
Publication number | Publication date |
---|---|
EA201992530A1 (ru) | 2020-06-08 |
US20200145424A1 (en) | 2020-05-07 |
PH12019502672A1 (en) | 2020-06-08 |
CN107180334A (zh) | 2017-09-19 |
ZA201907066B (en) | 2021-02-24 |
EP3617962A4 (en) | 2020-09-09 |
AU2018258773A1 (en) | 2019-12-05 |
KR20190130639A (ko) | 2019-11-22 |
EP3617962A1 (en) | 2020-03-04 |
CN108717620A (zh) | 2018-10-30 |
CA3066854A1 (en) | 2018-11-01 |
US11363026B2 (en) | 2022-06-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2018196876A1 (zh) | 基于角色对用户一对一的工作流控制方法和系统 | |
WO2018210248A1 (zh) | 基于表单字段的工作流审批节点设置审批角色的方法 | |
WO2018214891A1 (zh) | 工作流审批节点按部门设置审批角色的方法 | |
WO2018214890A1 (zh) | 工作流审批节点按角色设置审批角色的方法 | |
WO2019011220A1 (zh) | 基于依据字段设置审批流程的方法 | |
WO2018205942A1 (zh) | 工作流审批节点按部门级别设置审批角色的方法 | |
WO2018210245A1 (zh) | 工作流及其审批节点的表单字段操作权限的设定方法 | |
WO2018224024A1 (zh) | 工作流审批节点高效审批方法 | |
JP7540660B2 (ja) | フォームフィールド値の操作権限承認方法 | |
WO2018214889A1 (zh) | 基于会签的审批节点在审批流程中的设置方法 | |
WO2019007292A1 (zh) | 基于角色的表单操作权限授权方法 | |
WO2019029650A1 (zh) | 表单数据操作的审核方法 | |
WO2018192557A1 (zh) | 基于角色对用户的一对一的权限授权方法和系统 | |
JP7318894B2 (ja) | 統計列表の操作権限の承認方法 | |
WO2018214828A1 (zh) | 基于投票的审批节点在审批流程中的设置方法 | |
WO2019011304A1 (zh) | 基于角色获取的表单数据的授权方法 | |
WO2018219230A1 (zh) | 审批工作流的委托及其再委托方法 | |
WO2019015539A1 (zh) | 一种表单数据操作权限授权方法 | |
WO2019029648A1 (zh) | 基于改进型rbac权限控制机制的审批任务转交方法 | |
WO2019029649A1 (zh) | 对使用者进行审批流程及其审批节点授权的方法 | |
WO2019007291A1 (zh) | 根据表单字段值对表单操作权限进行分别授权的方法 | |
WO2018224023A1 (zh) | 系统中员工登录其账户后的权限显示方法 | |
WO2019011162A1 (zh) | 快捷功能设置方法 | |
WO2018205940A1 (zh) | 基于角色对用户的一对一的组织结构图生成及应用方法 | |
WO2019011255A1 (zh) | 通过第三方字段对表单字段的字段值进行授权的方法 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 18791757 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 20197032195 Country of ref document: KR Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2018791757 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 2018258773 Country of ref document: AU Date of ref document: 20180428 Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 3066854 Country of ref document: CA |