WO2018214890A1

WO2018214890A1 - Role-based method for setting approval role for workflow approval node

Info

Publication number: WO2018214890A1
Application number: PCT/CN2018/087920
Authority: WO
Inventors: 陈达志
Original assignee: 成都牵牛草信息技术有限公司
Priority date: 2017-05-23
Filing date: 2018-05-22
Publication date: 2018-11-29
Also published as: CN108734400A; CN107045675A

Abstract

Disclosed is a role-based method for setting an approval role for a workflow approval node. The method comprises: creating roles included by a system organization structure; displaying candidate roles when setting a workflow approval node; and selecting one or more roles from the candidate roles as an approval role of the node. According to the present invention, a system workflow setting staff only needs to select a particular role when setting an approval role, without paying attention to concrete users; there is no need to set an approval role again even if the user associated with the role is changed, operation is convenient, and it is not likely to make errors. The roles which are independent individuals serve as the main body of a workflow approval operation; a new employee is associated to a role in the approval flow if there is a change in the employee/user; or if the approval authority of a certain employee is changed, it is only required to adjust the approval authority of the role in a targeted way instead of resetting/adjusting the flow; and setting is convenient, and the workflow reliability is improved greatly.

Description

Workflow Approval Node Method for Setting Approval Roles by Role

Technical field

The invention relates to a method for setting and managing an approval node approval role in a workflow of a management software system such as an ERP, in particular to a method for setting an approval role by a workflow approval node according to a role.

Background technique

Role-based access control (RBAC) is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive. Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years. The basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.

A large number of tables and views are often built in large application systems, which makes the management and authorization of database resources very complicated. It is very difficult for the user to directly manage the access and permissions of the database resources. It requires the user to have a very thorough understanding of the database structure and is familiar with the use of the SQL language, and once the application system structure or security requirements have changed, To carry out a large number of complex and cumbersome authorization changes, it is very easy to have some security vulnerabilities caused by unexpected authorization errors. Therefore, designing a simple and efficient rights management method for large-scale application systems has become a common requirement for system and system users.

The role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.

However, the traditional role-based user rights management and workflow control methods adopt the "role-to-user one-to-many" association mechanism, and the "role" is group/class nature, that is, one role can simultaneously correspond to/associate multiple users. The role is similar to the concept of position/position/work type. The authorization of user rights under this association mechanism is basically divided into the following three forms: 1. As shown in Figure 1, the user is authorized directly. The disadvantage is that the workload is large and the operation is frequent. And trouble; the approval operation subject of the approval node in the approval process is the user, and the workflow approval node directly selects the employee/user as the approval subject. When an employee change occurs (such as transfer, resignation, etc.), all processes involved in the employee must be Corresponding adjustments, especially for company management personnel, involve many approval processes, and the workload of process adjustment is large and complicated, which is prone to errors or omissions, affecting the normal operation of the enterprise and even causing unpredictable losses.

Even if only the employee approval authority changes, it is necessary to adjust the process involved in the employee. There are similar problems.

2. As shown in Figure 2, the role (class/group/post/work type) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the approval operation subject is the group/class nature role; As shown in Figure 3, the above two methods are combined.

In the above expressions, both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization and workflow control through the role of class/group/post/work type has the following disadvantages: 1. When the user rights change Difficulties in operation: In the actual system use process, it is often necessary to adjust the user's authority during the operation process. For example, when dealing with employee permission changes, the employee rights associated with the role change, we cannot because of this Changes in employee permissions change the permissions of the entire role, because the role is also associated with other employees whose permissions have not changed. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.

When the employee/user's approval authority changes, either the employee/user is removed from the role, the workflow approval node directly selects the employee/user as the approval subject, or the new role is added to meet the requirements of the approval process. In the first way, when employee changes occur (such as transfer, resignation, etc.), all the processes involved in the employee must be adjusted accordingly, especially for company management personnel, which involves more approval processes and process adjustments. Large amount, complicated, easy to make mistakes or omissions, affecting the normal operation of the company, and even causing unpredictable losses. Even if only the employee approval authority changes, it is necessary to adjust the process involved in the employee. There are similar problems. In the second way, the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.

2. It is difficult to remember the specific permissions contained in the role for a long time: if the role has more permission functions, it will be difficult to remember the specific permissions of the roles, and it is more difficult to remember the difference in permissions between the roles with similar permissions. The permissions of a role are also easily confused; if you want to associate a new user, you cannot accurately determine how the association should be selected.

3, because the user permissions change, it will cause more and more role creation (if you do not create a new role, it will greatly increase the authorization of the user directly), it is more difficult to distinguish the specific differences of the roles of each role.

4. When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.

When the existing workflow's approval node is set, the corresponding person is usually selected, but each person's job responsibilities usually change. When the personnel responsibility is adjusted, the new responsible person needs to be selected, which is easy to make mistakes.

technical problem

The purpose of the present invention is to overcome the deficiencies of the prior art, and to provide a method for setting an approval role by a workflow approval node according to a role, and only need to select a corresponding role when setting an approval role, and the operation is convenient.

Technical solution

The object of the present invention is achieved by the following technical solutions: The workflow approval node sets the role of the approval role by role, including: creating a role included in the system organization structure; displaying the candidate role when setting the workflow approval node; One or more roles are selected from the candidate roles as an approval role for the node.

Preferably, each role is an independent individual, not a group/class. One role can only associate a unique user at a time, and one user associates one or more roles.

Preferably, the method for generating the workflow includes: constructing a three-layer mechanism model of user-role-permission, wherein: a role layer: an operation subject of process approval in a workflow is a role, and each role is an independent individual, instead Group/class, a role can only be associated with a unique user in the same period, and a user is associated with one or more roles; privilege layer: consists of the permissions required for workflow execution, permissions are directly delegated to the role; user layer: user The approval task in the workflow is determined by the associated role, and the approval operation is performed with the permission of the associated role; the workflow is controlled by the three-layer structure model, and an approval process includes a start node, at least one approval node, and an end node. , where: start node: approval process start; approval node: approval authority authorization (or setting) for the corresponding approval role; end node: approval process end; user determines the approval task to be processed according to its associated role, and according to The permissions of the associated role are approved.

Preferably, a role with workflow initiating permissions can initiate/apply/submit a workflow as a submitting role.

Preferably, the role belongs to a department, and the role is authorized according to the working content of the role.

Preferably, the name of the role is unique under the department, and the number of the role is unique in the system.

Preferably, when the user moves across the department, the user is associated with the role in the original department, and the user is associated with the role in the new department.

Preferably, the user determines the authority by its association with the role, one employee corresponds to one user account, and one user account corresponds to one employee.

Preferably, the display form of the candidate character includes one or more of a list, an organizational structure tree diagram, and an organizational structure diagram.

The workflow approval node sets the role of the approval role by role, including: creating the role contained in the system organization structure; selecting (or setting) to set the approval role by role; displaying candidates when setting the workflow approval node Role; select one or more roles from the candidate roles as the approval role for the node.

Beneficial effect

The beneficial effects of the present invention are as follows: (1) The system workflow setting personnel only need to select the corresponding role as the approval role when setting the approval role, and it is not necessary to select a specific user, even if the user associated with the role changes, it is not required. Resetting the approval role is easy and error-free.

For example, the administrative department of the company has role A and role B. If role A is the department supervisor role of the administrative department, when performing the workflow approval setting for leave, simply select role A as the approval role instead of selecting role A. The user, even if the user associated with role A is changed from Zhang San to Li Si, does not need to re-approve the role setting.

(2) The main body of the approval operation in the workflow is the role, and the role is an independent individual rather than a traditional group/class role. Even if employee/user changes occur (such as transfer, separation, etc.), only new employees are required. Re-associate to the role in the approval process; or change the employee approval authority, adjust the role approval authority in a targeted manner, no need to reset/adjust the process, easy to set up, no mistakes or omissions, no impact on the enterprise Normal operation greatly improves the reliability of the workflow. The role of the nature of the post number is the approval authority of the approval link node. The user determines which approval tasks are available through the role. The user can approve the operation by associating the role permissions; the understanding is clear and simple, and the nature of each post number/station number The role is the smallest unit of the work subject, and this application can be well satisfied for each role's different requirements for approval.

(3) The role of the application is a one-to-one relationship to the user. A role can only be associated with a unique user at the same time. The advantage of this is that as long as the user is associated with the role, the user can obtain the associated role (ie, the user obtains the associated role). Permissions), and the role's permission changes are much less than the user permissions in the traditional mechanism. The number of roles of the nature of the independent body (the nature of the post number/station number) is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.

(4) The operation of dynamic management, on-the-job adjustment, etc. is simple and convenient, high in efficiency and high in reliability: the application of the entry/departure/admission in the approval process is simple, and the operation subject of the approval of the workflow is the role, when the employee/user There is no need to reset the approval process when the change occurs (the user only needs to cancel or associate the role: the user who is no longer in the role of the job number/station number cancels the role association and takes over the role of the job number/station number. If the user is associated with the role of the job number, the user associated with the role automatically obtains the related tasks and permissions of the role in the approval workflow, without resetting the approval workflow or reauthorizing the roles in the workflow. , greatly improving the efficiency, security and reliability of process settings.

For example: due to Zhang San’s resignation or transfer, Zhang San is no longer working as a “buyer 3”, Zhang San cancels the association with the role; Li Si took over as “Purchaser 3” For the role work, Li Si is associated with the role, and Li Si automatically obtains the approval task and approval authority for the role of “Purchase 3” in the approval process.

(5) The traditional rights management mechanism defines the role as a group, a job type, a class, etc. The role is a one-to-many relationship with the user. In the actual system use process, it is often necessary to perform the user's authority during the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.

However, under the method of the present application, since the role is an independent individual, the role permission can be changed to achieve the goal. Although the method of the present application seems to increase the workload when the system is initialized, it can be made by copying and the like to make the role or authorization more efficient than the traditional group-based role, because the role of the group is not considered. In the commonality of the related users, the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user. The efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.

(6) The traditional group-based role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization errors, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.

(7) Under the traditional group-based role authorization method, if the role has more privilege function points, it takes a long time to remember the specific privilege of the role, and it is more difficult to remember the privilege difference between the roles with similar privilege. If you want to associate a new user, you cannot accurately determine how to select the association. The role of the method of the present application itself has the nature of the job number/station number, and the choice is clear at a glance.

(8) When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.

The method of the present application is as follows: the transferred user associates several roles. When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.

(9) If the role belongs to the department, the department of the role cannot be replaced, and the role cannot be changed. Reason 1: Because the role of this application is equivalent to a station number/post number, different station number/post number The work content/permissions are different. For example, the salesperson 1 role under the sales department and the developer 1 role of the technical department are completely different two station numbers/post numbers, and their permissions are different; Reason 2: If the department (sales department) of the salesperson 1 role is replaced with the technical department, and the role of the salesperson 1 is unchanged, there is a role in the technical department that has the authority of the sales department, which may lead to management confusion and security loopholes.

DRAWINGS

1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art;

2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art;

3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art;

4 is a flow chart of a method for setting an approval role by a workflow approval node according to a role in the present invention;

Figure 5 is a schematic view of a workflow in the present invention;

FIG. 6 is still another flow chart of a method for setting an approval role by a workflow approval node according to a role in the present invention.

Embodiments of the invention

The technical solution of the present invention will be described in further detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following.

[Embodiment 1] As shown in FIG. 4, the workflow approval node sets the role of the approval role by role, including: creating a role included in the system organization structure. For example, create role a, role b, role c, and role d.

Role definition: The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).

For example: a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5... User-role relationship: If the company employee Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights to these two roles.

The concept of traditional roles is group/class/post/position/work type, and one role can correspond to multiple users. The concept of "role" in this application is equivalent to the post number/station number, and is similar to the role in the film and television drama: a character can only be played by one actor at the same time (childhood, juvenile, middle-aged...). And an actor may be decorated with multiple angles.

Each role is a separate entity, not a group/class. A role can only be associated with a unique user at the same time, and a user is associated with one or more roles.

The role belongs to the department, and the role is authorized according to the work content of the role; the role is composed of a name and a number, the name of the role is unique under the department, and the number of the role is unique in the system.

When the user moves across departments, the user is associated with the role in the original department, and the user is associated with the role in the new department. After the role is created, you can associate the role in the process of creating the user, or you can associate it at any time after the user is created. After the user associates the role, the relationship with the role can be released at any time, and the relationship with other roles can be established at any time.

The user determines the authority through its association with the role, one employee corresponds to one user account, and one user account corresponds to one employee.

The candidate role is displayed when the workflow's approval node is set. The display form of the candidate character includes one or more of a list, an organizational structure tree diagram, and an organizational structure diagram. For example, when selecting an approval node, role a, role b, role c, and role d are displayed for selection.

As shown in FIG. 5, the method for generating the workflow includes: constructing a three-layer mechanism model of user-role-permission, wherein: a role layer: an operation subject of process approval in a workflow is a role, and each role is an independent individual. Instead of a group/class, a role can only be associated with a unique user at the same time, and a user is associated with one or more roles; the privilege layer: consists of the permissions required for workflow execution, and the permissions are directly delegated to the role; the user Layer: The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role. The workflow is controlled by the three-layer structure model. One approval process includes a start node and at least one approval node. An end node, where: start node: initiate/subscribe/submit workflow as the start node, or start node as the first approval node; approve node: approve authority (or set) for the corresponding approval role; end node : The approval process flow ends when the approval process flow goes to this node, and the end node does not approve For; or approval to a node as the last end node, the end node requires approval operation; user to determine the required approval tasks associated with processing according to its role and operating under the authority of the role approval associated.

One or more roles are selected from the candidate roles as approval roles. For example, if you select role a as the approval role, you can directly select role a as the approval role.

[Embodiment 2] This embodiment describes the present invention with an approval node setting of a leave workflow.

The administrative department of a company has role A, role B, role C, role D, role E, and role F. All company leave requires role A to approve. The setting of the approval node of the leave workflow includes the following steps: creating a role A, role B, role C, role D, role E, and role F.

Select an approval node in the leave workflow, and the candidate role is displayed. The candidate roles include role A, role B, role C, role D, role E, and role F (if there are other roles in the system organization structure, Show these roles).

Select role A as the approval role from the candidate roles.

Assuming that the user associated with role A is Zhang San, Zhang San obtains the approval task and approves it.

Assume that the user associated with role A changes from Zhang San to Li Si. Since the approval role is held by role A, although the user associated with role A has changed, role A is still in the approval role in the leave workflow, and there is no need to reset the approval. Roles reduce workload and reduce the possibility of errors.

[Embodiment 3] As shown in FIG. 6, the workflow approval node sets the role of the approval role by role, including: creating a role included in the system organization structure; selecting (or setting) to perform the role setting by the role mode; The candidate role is displayed when the approval node of the workflow is set; one or more roles are selected from the candidate roles as the approval role of the node.

The above is only a preferred embodiment of the present invention, and it should be understood that the present invention is not limited to the forms disclosed herein, and is not to be construed as being limited to the other embodiments, but may be used in various other combinations, modifications and environments. Modifications can be made by the techniques or knowledge of the above teachings or related art within the scope of the teachings herein. All changes and modifications made by those skilled in the art are intended to be within the scope of the appended claims.

Claims

The workflow approval node sets the role of the approval role by role, and is characterized by: creating a role included in the system organization structure;

Display candidate roles when setting up workflow approval nodes;

One or more roles are selected from the candidate roles as an approval role for the node.
The method for setting an approval role by a workflow approval node according to claim 1, wherein each role is an independent individual, not a group/class, and a role can only associate a unique user in the same period, and one A user associates one or more roles.
The method for generating an approval role by a workflow approval node according to claim 2, wherein the method for generating the workflow includes:

Construct a three-tiered model of user-role-permission, where: role layer: the main body of the process approval in the workflow is the role, each role is an independent individual, not a group/class, and one role can only be uniquely associated in the same time period. Users, while one user is associated with one or more roles;

Privilege layer: consists of the privilege required to be used in the execution of the workflow, and the privilege is directly delegated to the role;

User layer: The user determines the approval task in the workflow through the associated role, and performs the approval operation with the permission of the associated role;

The workflow is controlled by a three-layer structure model. One approval process includes a start node, at least one approval node, and an end node, wherein: the start node: the approval process starts;

Approval node: Authorize authority for the corresponding approval role;

End node: the approval process ends;

The user determines the approval tasks to be processed according to their associated roles and performs approval operations based on the permissions of the associated roles.
The method for setting an approval role by a workflow approval node according to claim 3, wherein a role having a workflow initiation authority can be used as a submission role to initiate/apply/submit a workflow.
The method for setting an approval role by a workflow approval node according to claim 2, wherein the role belongs to a department, and the role is authorized according to the work content of the role.
The method for setting an approval role by a workflow approval node according to claim 5, wherein the name of the role is unique under the department, and the number of the role is unique in the system.
The method for setting an approval role by a workflow approval node according to claim 5, wherein when the user moves across the department, the user is disconnected from the role in the original department, and the user and the new department are Roles are associated.
The method for setting an approval role by a workflow approval node according to claim 2, wherein the user determines the authority by its association with the role, one employee corresponds to one user account, and one user account corresponds to one employee.
The method for setting an approval role by a workflow approval node according to claim 1, wherein the display form of the candidate role comprises a list, an organizational structure tree diagram, and an organizational structure diagram.
The workflow approval node sets the role of the approval role by role, and is characterized by: creating a role included in the system organization structure;

Select to set the approval role by role;

Display candidate roles when setting up workflow approval nodes;

One or more roles are selected from the candidate roles as an approval role for the node.