Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
  • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
  • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
  • G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
  • G06F3/0481—Interaction techniques based on graphical user interfaces [GUI] based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
  • G06F3/0482—Interaction with lists of selectable items, e.g. menus
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F40/00—Handling natural language data
  • G06F40/10—Text processing
  • G06F40/166—Editing, e.g. inserting or deleting
  • G06F40/174—Form filling; Merging
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q10/00—Administration; Management
  • G06Q10/10—Office automation; Time management
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q10/00—Administration; Management
  • G06Q10/10—Office automation; Time management
  • G06Q10/105—Human resources
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/08—Access security
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

• the invention relates to a method for authorizing authorization of form data operation authority such as ERP.
• the control of the operation authority of the form data through the form is the basic authorization method of the system, but the entire form can only be authorized as a whole, and the specific operation of one (one or more) form data cannot be performed. Permission to authorize.
• the form data refers to a certain range of data belonging to the form, and it is not required to determine whether the form field on the form has obtained the field value during authorization, and whether the form field obtains the field value and the authorization mode. None.
• the traditional form authorization method can be implemented: Authorize Li Si to view (modify and delete) all customers in the electrical industry (such as 10,000 customers in the electrical industry, one of which is Haier Electric Company), and authorized Wang Wu to view ( Modify, delete) all customers in the construction industry (such as the construction industry has 5,000 customers, one of which is Haitian Construction Company).
• Authorize Li Si to view (modify and delete) all customers in the electrical industry such as 10,000 customers in the electrical industry, one of which is Haier Electric Company
• authorized Wang Wu to view ( Modify, delete) all customers in the construction industry such as the construction industry has 5,000 customers, one of which is Haitian Construction Company.
• the traditional way of authorizing the form data operation authority through the form cannot be authorized only for Haier Electric or Haitian Construction Company, and there are certain limitations in authorization.
• the traditional form authorization method cannot implement separate authorization for a specific piece (one or more) of form data. Once the form is granted permissions according to a rule, all data under the form that conforms to the rule is granted the right, the enterprise's Information security is worrying, which may cause some confidential form data of the enterprise to leak out, posing risks to the enterprise.
• role-based access control is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). .
• Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive.
• Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years.
• the basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.
• the role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.
• the traditional role-based user rights management adopts the "role-to-user one-to-many" association mechanism, and the "role” is group/class nature, that is, one role can simultaneously correspond to/associate multiple users, and the role is similar to the post/
• the concept of position/work type the authorization of user rights under this association mechanism is basically divided into the following three forms: 1. As shown in Figure 1, the user is authorized directly, the disadvantage is that the workload is large, the operation is frequent and troublesome; Employee changes (such as transfer, resignation, etc.), all the form operation rights involved in the employee must be adjusted accordingly, especially for company management personnel, the form permissions involved, the task of authority adjustment is large and complicated. It is easy to make mistakes or omissions, affecting the normal operation of the company and even causing unpredictable losses.
• the role (class/group/post/work type) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the approval operation subject is the group/class nature role; As shown in Figure 3, the above two methods are combined.
• both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization and workflow control through the role of class/group/post/work type has the following disadvantages: 1.
• Difficulties in operation In the actual system use process, it is often necessary to adjust the user's authority during the operation process. For example, when dealing with employee permission changes, the employee rights associated with the role change, we cannot because of this Changes in employee permissions change the permissions of the entire role, because the role is also associated with other employees whose permissions have not changed. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements.
• the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
• the employee/user's form operation permissions change either the employee/user is removed from the role or the role is added to meet the job requirements.
• the defect of the first method is the same as the above-mentioned "direct authorization to the user" method.
• the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.
• the object of the present invention is to overcome the deficiencies of the prior art, and provide a form data operation authority authorization method, which realizes separate authorization of specific form data operation authority and improves system management fineness.
• a form data operation authority authorization method including a step of selecting form data, a step of selecting an authorized person, an operation authority authorization step, a step of selecting form data, and The order of selecting the authorized person is in no particular order; the step of selecting the form data: selecting one or more form data that requires authorization of the operation authority; the step of selecting the authorized person: selecting one or more of the required authorizations for the operation authority Authorizer; Operation Authority Authorization Step: Authorizes the selected licensee to perform the operation authority of the selected form data.
• It also includes a step of authorizing the viewing and/or modifying permissions of the field values for each form field of each selected form data.
• the operation authority authorization step includes the following two authorization methods: (1) performing operation authority authorization on each selected form data separately; and (2) authorizing operation authority on all selected form data as a whole.
• the operation authority includes a combination of one or more of viewing, modifying, deleting, printing, and viewing rights of the associated information.
• the authorized person includes a combination of one or more of a person, a user, a group/class nature role, and an independent individual nature role.
• the authorized person is an independent individual character, and the independent individual nature role is different from the group/class nature role.
• an independent individual nature role can only be associated with a unique user, and one user is associated with one or more independent individual nature roles. .
• the independent individual role belongs to the department, the name of the role is unique under the department, the number of the role is unique in the system, the role is authorized according to the working content of the role, and the user obtains the right by the associated role.
• a form data operation authority authorization method includes the following sequential steps: S1: selecting form data: the authorizer selects one or more form data that needs authorization for operation authority; S2: selects the authorized person: the authorizer selects one or more An authorized person who needs authorization for operation authority, the authorized authority of the authorized form should have less than or equal to the operation authority of the authorized person to the selected form data; S3: operation authority authorization step: for the selected The authorized person authorizes the operation authority of the selected form data.
• a form data operation authority authorization method includes the following sequential steps: SS1: Step of selecting an authorized person: the authorized person selects one or more authorized persons who need to perform operation authority authorization; SS2: Step of selecting form data: Authorizer Select one or more form data that needs to be authorized for operation authority; the operation authority of the selected authorized person to the form data should be less than or equal to the authority of the authorized person to operate the form data; SS3: operation authority authorization step: Authorization of the selected licensee to authorize the operation of the selected form data.
• the beneficial effects of the present invention are as follows: (1)
• the present application can independently authorize one or more form data, for example, the operation authority can be authorized only for one customer of Haier Electric Appliance Co., Ltd., and the fineness of system management is improved, and is particularly suitable.
• the operation authority can be authorized only for one customer of Haier Electric Appliance Co., Ltd.
• the fineness of system management is improved, and is particularly suitable.
• it is beneficial to protect the confidential form data of the enterprise from being leaked and meet the actual use requirements of the enterprise.
• the application directly authorizes the form data, and the required fields on the form of the form data must have a value, which is specific data that has been created, such as "Haier Electric Company"; and the traditional basic authorization is for the customer
• the form is authorized, not for a specific customer or customers, and this application is for specific customers such as Haier Electric Company.
• sales department has sales staff Li Si, Wang Wu, Zhao Liu, sales manager is Zhang San; traditional form through the form (customer form) on the form data operation permissions (view, modify, delete, print, export)
• the result is: Li Si is responsible for the customers in the electrical industry, and its operation authority is to view (one of the customers in the electrical industry is Haier Electric), and Wang Wu is responsible for the customers in the construction industry. Modification and deletion (one of the customers in the construction industry is Haitian Construction Company), Zhao Six is responsible for customers in the chemical industry, and its operation authority is for viewing; Zhang San is responsible for customers in the electrical and construction industries, and its operation authority is to view, modify, Delete, print.
• the traditional method can not see the form data of all customers in an industry for the licensee, or the form data of one customer in the industry can not be seen, and it is impossible to separately control an authorized person to Haier Electric Company and Haitian Construction Company.
• the operation permission of a specific piece of form data can not see the form data of all customers in an industry for the licensee, or the form data of one customer in the industry can not be seen, and it is impossible to separately control an authorized person to Haier Electric Company and Haitian Construction Company. The operation permission of a specific piece of form data.
• Li Si can see all customers in the electrical industry, but he is not allowed to see Haier Electric Company.
• Wang Wu does not see all customers in the construction industry, but allows See Haitian Construction Company.
• the licensor of this application can be either a system setup person or a department head with certain form data operation authority.
• the department head can authorize the authorized person whose authority is less than or equal to him according to the operation authority he has.
• the operation facilitates the department head to authorize and control the form data according to the needs, so that the middle-level leaders of the enterprise can perform the management work and meet the actual needs of the enterprise.
• Zhang San the sales manager, considered that the salesperson Zhao Liu had served as a manager at Haier Electric Co., Ltd., which facilitated sales negotiations. Therefore, he wanted Zhao Six to be responsible for the customer.
• Zhang San wanted to delegate the customer of Haier Electric to Zhao Six.
• Zhang San only authorized Zhao Liu to have the authority to view and modify the data of Haier Electric Appliance Co., Ltd., and other employees do not have these rights.
• Zhang San has the right to view, modify, delete and print the customer of Haier Electric Appliance Co., Ltd., and Zhao Six does not have any authority for the customer. He can choose Zhao Liu as the authorized person; when authorized, Zhang San is shown to the customer.
• the operation permission item "View, Modify, Delete, Print” because Zhao Liu does not have any operation authority for the customer of Haier Electric Appliance Co., Ltd., the "View, Modify, Delete, Print” displayed is not selected; Zhang San can be One or some or all of the permission options in "View, Modify, Delete, Print” are authorized to Zhao Six.
• Sales manager Zhang San wants to authorize Haier Electric Company's customer to Li Si (I don't want Li Si to have any operational authority for the customer, because Zhang San has let Zhao Liuquan take charge of the customer), Zhang San to Haier Electric Co., Ltd.
• the customer has the right to view, modify, delete and print, and Li Si has “View” for the customer, and can choose Li Si as the authorized person; when authorized, it displays the operation permission item of Zhang San for the customer “View and modify” , delete, print", because Li Si has the "View” operation permission for the customer, the "View” item in the "View, Modify, Delete, Print” displayed is selected; Zhang San will display the "View” The “View” selected in “Modify, Delete, Print” is changed to “Unchecked”. After the authorization is saved, Li Si will no longer have any authority for Haier Electric Company.
• Zhang San can not authorize the control of customers in the chemical industry, because Zhang San does not have any operating authority for customers in the chemical industry.
• the application can separately authorize the viewing and/or modification authority of the field value of each form field of each selected form data, and can realize the separate authorization of the operation authority of the form field value, thereby further improving the system management. accuracy.
• the role of the application is a one-to-one relationship to the user.
• One role can only be associated with a unique user at the same time, and one user is associated with one or more roles.
• Permissions that is, users gain access to their associated roles
• the role's permission changes are much less than the user permissions in the traditional mechanism.
• the number of roles of the nature of the independent body is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.
• the operation of dynamic management, on-the-job adjustment, etc. is simple and convenient, high in efficiency and high in reliability: the application of the entry/departure/adjustment in the authority management is simple, and the user/user does not need to reset the authority when the user/user changes, the user only You need to cancel or associate the role: the user who is no longer in the role cancels the role association, and the user who takes the role is associated with the role of the post number. The user associated with the role automatically obtains the related tasks and operations of the role.
• the traditional authority management mechanism defines roles as groups, types of work, classes, etc.
• the role is a one-to-many relationship with the user. In the actual system use process, the user rights are often required in the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements.
• the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
• the role since the role is an independent individual, the role permission can be changed to achieve the goal.
• the method of the present application seems to increase the workload when the system is initialized, it can be made by copying or the like to make the role or authorization more efficient than the traditional group/class nature, because the group/class role is not considered.
• the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user.
• the efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.
• the traditional group/class role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization error, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.
• the method of the present application is as follows: the transferred user associates several roles.
• the user When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.
• FIG. 1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art
• FIG. 2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art
• FIG. 3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art
• FIG. 4 is a schematic diagram of a manner in which a system authorizes a user through an independent individual role
• Figure 5 is a schematic diagram of the authorization of the existing form authorization method according to the customer industry
• FIG. 6 is a schematic diagram of form data authorization for a plurality of authorized persons according to the present invention.
• Figure 7 is a schematic diagram of the invention of the invention by the supervisor of the workshop, Zhao Liu, for the individual authorized person - Zhang San;
• FIG. 8 is a schematic diagram of the invention of the invention by the supervisor of the workshop, Zhao Liu, for a single authorized person-Hu seven;
• FIG. 9 is a schematic diagram showing the common operation authority of Zhang San and Hu Qi when authorized by the present invention.
• FIG. 10 is a schematic diagram showing the operation authority of each form data of Zhang San and Hu Qi according to the authorization of the present invention.
• This application is authorized for the operation of the form data, and the difference between authorizing the form is that when the form is authorized, it refers to the authorization of the operation authority of the entire form of a form, for example: authorization of the contract form, its operation Authorization of permissions will cover all contracts; and in the form, each field has no specific field value (ie, when the form is authorized, whether the form has corresponding form data does not affect the authorized operation of the form authorization; for example, when authorizing the contract form, Whether the specific contract data/contract has been created in the system does not affect the authorization operation of the contract form authorization; or there is no specific contract, you can also authorize the contract form).
• authorizing form data refers to the authorization of a certain piece of data of a form, for example, the authorization of the sales contract of Vanke Real Estate Company in the contract form, and the authorization of the operation authority is limited to the data of this form.
• the field value of at least one field in each field is required, that is, at least one field of the form data has a field value.
• the traditional form authorization method can be done: Authorize Li Si to view (modify and delete) all customers in the electrical industry (for example, there are 10,000 customers in the electrical industry, one of which is Haier Electric Company), and the authorized Wang Wu can view (modify, Delete) All customers in the construction industry (such as 5,000 customers in the construction industry, one of which is Haitian Construction Company).
• the traditional way of authorizing the form data operation authority through the form cannot be authorized only for Haier Electric or Haitian Construction Company, and there are certain limitations in authorization.
• the sales department has sales staff Li Si, Wang Wu, Zhao Liu, and the sales manager is Zhang San; the traditional permission to manipulate the form data through the form (customer form) (add, view, modify, After deleting, printing, and exporting, the result is: Li Si is responsible for the customers in the electrical industry, and its operation authority is new, view (one of the customers in the electrical industry is Haier Electric Company), and Wang Wu is responsible for the construction.
• the customers in the industry have the operation authority to add, view, modify and delete (one of the customers in the construction industry is Haitian Construction Company), and Zhao Six is responsible for the customers in the chemical industry.
• the operation authority is new and view; Zhang San Responsible for customers in the electrical and construction industries, their operation rights are new, view, modify, delete, and print.
• the traditional method for the authorized person can either see the form data of all the customers in an industry, or the form data of one customer in the industry can not be seen, and it is impossible to separately control an authorized person to Haier Electric Company and Haitian Construction Company ( The operation permission of a specific form data).
• a form data operation authority authorization method includes a step of selecting form data, a step of selecting an authorized person, and an operation authority authorization step, a step of selecting form data, and a step of selecting a licensee. Steps: Select form data: Select one or more form data that requires authorization for operation authority; select the authorized person: select one or more authorized persons who need authorization for operation authority; operation authority authorization steps: Authorization of the selected licensee to perform the operational rights of the selected form data.
• the form data operation authority authorization method also includes a step of authorizing the viewing and/or modification rights of the field values of each form field of each selected form data.
• the operation authority authorization step includes the following two authorization methods: (1) performing operation authority authorization for each selected form data; and (2) operating all selected form data as a whole.
• Authorization permission check the operation permission item (in the box in the figure, that is, "view" column name).
• the operation authority includes a combination of one or more of viewing, modifying, deleting, printing, and viewing rights of the associated information.
• the authorized person includes a combination of one or more of a person, a user, a group/class nature role, and an independent individual nature role.
• the authorized person of the present application is an independent individual character, and the independent individual nature role is different from the group/class nature role, and an independent individual nature role can only be associated with a unique user in the same period.
• a user associates one or more independent individual nature roles.
• the independent individual role belongs to the department, the name of the role is unique under the department, the number of the role is unique in the system, the role is authorized according to the working content of the role, and the user obtains the right by the associated role.
• the user moves across departments, the user is first associated with the role in the original department, and then the user is associated with the role in the new department.
• the following is an analysis of the advantages of the user's form data operation authority authorization method through the independent individual role: the user determines (acquires) the right through the association with the role, and if the user's permission is to be modified, the role has the authority In order to achieve the purpose of changing the permissions of the user associated with the role. Once a user associates a role, that user has all the operational privileges for that role.
• the relationship of the role (independent individual role) to the user is one-to-one (when the role is associated with one user, other users can no longer associate the role; if the role is not associated with the user, it can be selected by other users; At the same time, a character can and can only be associated with one user).
• a user's relationship to a role is one-to-many (one user can associate multiple roles at the same time).
• Role definition The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).
• a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
• general manager deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
• Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights to these two roles.
• roles are group/class/post/position/work type, and one role can correspond to multiple users.
• the concept of "role" in this application is equivalent to the post number/station number, and is similar to the role in the film and television drama: a character can only be played by one actor at the same time (childhood, juvenile, middle-aged). And an actor may be decorated with multiple angles.
• the role After the role is created, you can associate the role in the process of creating the user, or you can associate it at any time after the user is created. After the user associates the role, the relationship with the role can be released at any time, and the relationship with other roles can be established at any time.
• the composition of the character is: post name + post number.
• workshop production workers 1, workshop production workers 2, workshop production workers 3... roles are independent individuals, equivalent to the concept of job number and station number, different from the role in the traditional authority management system, the concept of role in the traditional system It is the group/class nature of the position/position/work type.
• the following example shows the relationship between employees, users and roles after the employee Zhang San enters a company: 1. New entry: The employee is newly hired, and directly associates the role of the corresponding job number/station number for the user (employee). Yes, for example: Zhang San joined the company (the company assigned a three-user for Zhang San), the job content is in the sales department, responsible for the sales of refrigerator products in Beijing area (the corresponding role is to sell the sales engineer under the 5 "This role", Zhang San users directly select the "sales engineer 5" role association.
• Zhang also arranged for Zhang San to be responsible for the sales of regional TV products in Beijing (the corresponding role is to sell the role of “Sales Engineer 8” under the Ministry of Sales) and concurrently as the head of the after-sales department (corresponding to the after-sales department)
• the three users added the roles of “sales engineer 8” under the sales department and “sales department supervisor 1” under the after-sales department.
• Zhang San employees associated three roles, respectively.
• Zhang San users have the authority of these three roles.
• Zhang San serves as the post-sales manager (corresponding to the role of “after-sales manager” in the after-sales department) and no longer take up other jobs. Then Zhang San user is associated with the role of “after-sales manager” in the after-sales department, and cancels the three roles previously associated (Sales Engineer 5 under Sales, Sales Engineer 8 and “After Sales Manager 1” under the after-sales department) At this time, Zhang San users only have the authority of the role of “after-sales manager” under the after-sales department.
• This application authorizes the role of the nature of the post number/station number, and the user determines the (acquired) authority by associating the role, and the control of the user authority is realized by a simple user-role relationship. It makes the permission control simple, easy to operate, clear and clear, and greatly improves the authorization efficiency and authorization reliability.
• a form data operation authority authorization method includes the following sequential steps: S1: Select form data: the authorizer selects one or more form data requiring authorization authority to operate; S2: Select authorized person: Authorizer Selecting one or more authorized persons who need to perform operation authority authorization, and the authorized person's operation authority on the selected form data should be less than or equal to the authorized authority's operation authority on the selected form data; S3: operation authority authorization Step: Authorize the selected authorized person to perform the operational rights of the selected form data.
• the viewing and/or modifying rights of the field values of each form field of each selected form data can be separately authorized, and for the same selected form data, the authorized person has each of the form data
• the operational authority of the field value of the form field shall be less than or equal to the operational authority of the authorizer for the field value of each form field of the piece of form data.
• the licensor of this application can be either a system setup person or a department head with certain form data operation authority.
• the department head can authorize the authorized person whose authority is less than or equal to his authorized operation according to the operation authority he has.
• the department heads authorize and control the form data according to the needs, which is convenient for the middle-level leaders of the enterprise to perform management work, in line with the actual needs of the enterprise.
• Zhang San the sales manager, considered that the salesperson Zhao Liu had served as a manager at Haier Electric Co., Ltd., which facilitated sales negotiations. Therefore, he wanted Zhao Six to be responsible for the customer.
• Zhang San wanted to delegate the customer of Haier Electric to Zhao Six.
• Zhang San only authorized Zhao Liu to have the authority to view and modify the data of Haier Electric Appliance Co., Ltd., and other employees do not have these rights.
• Zhang San has the right to view, modify, delete and print the customer of Haier Electric Appliance Co., Ltd., and Zhao Six does not have any authority for the customer. He can choose Zhao Liu as the authorized person; when authorized, Zhang San is shown to the customer.
• the operation permission item "View, Modify, Delete, Print” because Zhao Liu does not have any operation authority for the customer of Haier Electric Appliance Co., Ltd., the "View, Modify, Delete, Print” displayed is not selected; Zhang San can be One or some or all of the permission options in "View, Modify, Delete, Print” are authorized to Zhao Six.
• Sales manager Zhang San wants to authorize Haier Electric Company's customer to Li Si (I don't want Li Si to have any operational authority for the customer, because Zhang San has let Zhao Liuquan take charge of the customer), Zhang San to Haier Electric Co., Ltd.
• the customer has the right to view, modify, delete and print, and Li Si has “View” for the customer, and can choose Li Si as the authorized person; when authorized, it displays the operation permission item of Zhang San for the customer “View and modify” , delete, print", because Li Si has the "View” operation permission for the customer, the "View” item in the "View, Modify, Delete, Print” displayed is selected; Zhang San will display the "View” The “View” selected in “Modify, Delete, Print” is changed to “Unchecked”. After the authorization is saved, Li Si will no longer have any authority for Haier Electric Company.
• Zhang San can not authorize the control of customers in the chemical industry, because Zhang San does not have any operating authority for customers in the chemical industry.
• a form data operation authority authorization method includes the following sequential steps: SS1: Step of selecting an authorized person: the authorized person selects one or more authorized persons who need to perform operation authority authorization; SS2: Select form data Step: the licensor selects one or more form data that needs authorization for operation authority; the operation authority of the selected authorized person to the form data should be less than or equal to the authority of the licensor to operate the form data; SS3: operation Authority Authorization Step: Authorizes the selected licensee to perform the operation rights of the selected form data.
• the authorized authority A's operation authority for the form data should be superimposed by the operation authority granted by each licensor. (As long as there is an licensor granting the licensor certain operational rights to the form data, the licensor will eventually have the privilege). For example, a licensor grants A permission to operate on a form data to be modified/cannot be deleted/printable, and another licensor grants A permission to operate the form data cannot be modified/can be deleted/cannot be printed, then authorized The final operation authority of the A data for the form is: can be modified / can be deleted / can print.
• Zhao Six has “View, “Haier Electric Company” Modify, print” permissions.
• the authorized person is selected first, and then the data is selected: Zhang San selects the authorized person Li Si, Wang Wu, Zhao Liu, and Zhang San can select any one or more customers in the electrical appliance and construction industry (because Zhang San The operating authority of customers in the electrical and construction industries is greater than the operating authority of any one of Li Si, Wang Wu and Zhao Liu. Zhang San can also choose other operating rights greater than or equal to Li Si, Wang Wu and Zhao Liu.
• Form data (such as contract, order form data, Zhang San at least have the contract, the order view of the order data).
• the system can control the operation authority of the “data authorization”.
• the control method includes: when the authorization authority of the form is authorized, only the authorized person is authorized to operate the “data authorization” operation right of the form, The authorized person can authorize the form data with authority in the form data corresponding to the form that has “data authorization”.
• Zhang San authorized the operation authority of the “data authorization” of the customer form
• Zhang San can authorize the form data (electrical appliances, customers in the construction industry) that he has permission, although Zhang
• Zhang The third is the manager of the sales department, but it does not have the authority of customers in the chemical industry, so it is not possible to authorize data for customers in the chemical industry.
• the authorization priority of the form data is higher than the authorization of the form: when the form data authorized by the form includes the form data of the authorization mode of the application, the data of the type is executed with the authorization authority of the application.
• Zhang San has authorized the customer form in the form of form authorization (authorized to view and modify the authority), after authorization, Zhang San is authorized to include customer A; in the manner of this application, Zhang Sanye
• the authorization for the client A is authorized (authorization is to view, modify, and delete the authority); then the operation authority of the data of the customer A is performed by the authority authorized by the application, that is, the client A can view, modify, and delete.
• Zhang San has authorized the customer form in the form of form authorization (authorized to view and modify the authority)
• the authorization Zhang San is authorized to include customer A; in the manner of this application, Zhang San is also carried out.
• Authorization of customer A one authority is not authorized, that is, the authorization cannot be viewed, modified, etc.
• the operation authority of Zhang San to customer A is executed with the authority authorized by this application, that is, the customer A cannot Make any changes such as viewing changes.
• the licensor may cancel the authorization in the manner of the present application, and the data involved in the cancellation of the authorization is no longer controlled by the authorization method of the application: the licensor may cancel the authorization of the client A in the manner of the application, when authorized After canceling the authorization for the customer A to Zhang San in this application mode (ie, canceling the authorization that has been previously authorized), Zhang San operates the customer A with the authority authorized by the form (because there is no The authorization of the application method controls the operation of the client A), that is, the permission of Zhang San to the customer A is viewed and modified.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• Computer Security & Cryptography (AREA)
• Human Resources & Organizations (AREA)
• Entrepreneurship & Innovation (AREA)
• Strategic Management (AREA)
• Software Systems (AREA)
• Computer Hardware Design (AREA)
• Quality & Reliability (AREA)
• Tourism & Hospitality (AREA)
• Operations Research (AREA)
• Marketing (AREA)
• Economics (AREA)
• Data Mining & Analysis (AREA)
• General Business, Economics & Management (AREA)
• Human Computer Interaction (AREA)
• General Health & Medical Sciences (AREA)
• Health & Medical Sciences (AREA)
• Multimedia (AREA)
• Technology Law (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Databases & Information Systems (AREA)
• Bioethics (AREA)
• Audiology, Speech & Language Pathology (AREA)
• Computing Systems (AREA)
• Artificial Intelligence (AREA)
• Computational Linguistics (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Storage Device Security (AREA)
• Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
• Time Recorders, Dirve Recorders, Access Control (AREA)

Priority Applications (14)

Applications Claiming Priority (2)

Publications (1)

Family

ID=60227420

Family Applications (1)

Country Status (16)

Families Citing this family (8)

Citations (6)

Family Cites Families (63)

• 2017
  • 2017-07-16 CN CN201710578153.8A patent/CN107330307A/zh active Pending
• 2018
  • 2018-07-13 KR KR1020207003240A patent/KR20200022494A/ko not_active Ceased
  • 2018-07-13 CN CN201810771765.3A patent/CN109032459B/zh active Active
  • 2018-07-13 MX MX2020000526A patent/MX2020000526A/es unknown
  • 2018-07-13 CA CA3070011A patent/CA3070011A1/en not_active Abandoned
  • 2018-07-13 PE PE2020000072A patent/PE20200328A1/es unknown
  • 2018-07-13 MY MYPI2020000209A patent/MY203858A/en unknown
  • 2018-07-13 EA EA202090305A patent/EA202090305A1/ru unknown
  • 2018-07-13 EP EP18835429.4A patent/EP3657365A4/en not_active Withdrawn
  • 2018-07-13 WO PCT/CN2018/095700 patent/WO2019015539A1/zh not_active Ceased
  • 2018-07-13 AU AU2018302991A patent/AU2018302991A1/en not_active Abandoned
  • 2018-07-13 US US16/631,359 patent/US11599656B2/en active Active
  • 2018-07-13 BR BR112020000938-5A patent/BR112020000938A2/pt not_active IP Right Cessation
  • 2018-07-13 JP JP2020501265A patent/JP7231910B2/ja active Active
• 2020
  • 2020-01-10 PH PH12020500090A patent/PH12020500090A1/en unknown
  • 2020-01-15 ZA ZA2020/00279A patent/ZA202000279B/en unknown
  • 2020-01-15 CO CONC2020/0000430A patent/CO2020000430A2/es unknown

Patent Citations (6)

Also Published As

Similar Documents

Legal Events