WO2019024899A1

WO2019024899A1 - Method for supervising approval operations, authorization operations and form operations

Info

Publication number: WO2019024899A1
Application number: PCT/CN2018/098373
Authority: WO
Inventors: 陈达志
Original assignee: 成都牵牛草信息技术有限公司
Priority date: 2017-08-03
Filing date: 2018-08-02
Publication date: 2019-02-07
Also published as: CN109087001A; CN107392494A; CN109087001B

Abstract

A method for supervising approval operations, authorization operations and form operations, comprising: creating roles in a system, wherein the roles are independent entities, and at any one time, a single role may only be associated with a single user, while a single user may be associated with one or more roles; when a role executes an approval/authorization/form operation, recording the role executing the operation; configuring one or more roles as a supervising role/supervised role, and configuring a supervised role/supervising role for each supervising role/supervised role; and supervising, by means of the supervising role, an approval/authorization/form operation record executed by the supervised role. The supervising and supervised subjects are independent roles that are individual in nature; work content of users/staff is distinguished according to post number/workstation number, respectively corresponding to one independent role which is individual in nature; supervision permissions are configured for each role, wherein supervising and supervised permissions undergo refined authorization, thus meeting actual operation and usage requirements of companies.

Description

Method of monitoring approval operations, authorization operations, and form operations

Technical field

The invention relates to a method for monitoring approval operation, authorization operation and form operation in a management system such as ERP and CRM.

Background technique

It is very important to supervise and blame the user operation records in the management system. In the existing management system, in many cases, managers with management authority are required to supervise the operation records of the supervised objects, although the managed objects can be supervised and monitored. The work operation record, however, the traditional system adopts the method of directly supervising and monitoring the user/employee. Once the supervision authority is granted, the supervisor can supervise all the work operation records of the user/employee. However, a user/employee often has multiple roles, and the supervisor's supervisory authority over the user/employee often cannot cover the work content involved in all of his positions, and it is difficult to balance the two. For example: employee Zhang San is the production workshop director in the company and concurrently the director of the research and development department. The work content is the authorized operation of the production workshop staff and the form operation of the R&D department. After giving the manager Li Si the supervision authority of Zhang San, Li Si can supervise all the work records of Zhang San, including the authorization operation record of the production workshop staff and the form operation record of the R&D department. However, in the actual operation of the enterprise, it is often necessary to separate some of the employee's work content, such as content that needs to be kept secret, or part of the content that a supervisor does not have the right to view, etc., and cannot record all the work operations as a whole. Shown in front of a supervisor. Sometimes, different supervisors have different supervisory authority for the same user, and need to distinguish the user's work content and separate supervisory authority according to the post number/station number. For example, Wang Wu, the deputy general manager responsible for managing production, can only supervise Zhang San’s authorized operation records. Zhao Six, the deputy general manager in charge of research and development, can only supervise Zhang San’s form operation records. Traditional techniques cannot achieve this function.

In another example, the traditional method cannot achieve dynamic management of monitoring and being monitored in business operations. For example, the traditional system directly monitors/monitors the user/employee. Once the supervisory authority is granted, the supervisor A can supervise the relevant work and operation records of the supervised user/employee; however, if there is a supervised employee B After leaving the job, the new employee C takes over the work of employee B. The employee C cannot automatically become the supervised object of supervisor A, and needs to reset C to become the supervised object of supervisor A. Similarly, if supervisor A leaves, The new employee K has taken over the work of A, and also needs to set K as the supervisor of the supervised person; these will change at any time in the dynamic management of the enterprise, so the traditional enterprise can not realize the automatic change of this function, there is supervision / The lack of management brought by the supervision of the lag.

For example, the traditional method can not achieve the supervision of only certain post number/station number, or the operation record of a post number/station number is supervised by which post number/station number, no matter who is doing this position. The work of the number/station number has a corresponding supervisor/supervised job number/station number.

Role-based access control (RBAC) is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive. Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years. The basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.

A large number of tables and views are often built in large application systems, which makes the management and authorization of database resources very complicated. It is very difficult for the user to directly manage the access and permissions of the database resources. It requires the user to have a very thorough understanding of the database structure and is familiar with the use of the SQL language, and once the application system structure or security requirements have changed, To carry out a large number of complex and cumbersome authorization changes, it is very easy to have some security vulnerabilities caused by unexpected authorization errors. Therefore, designing a simple and efficient rights management method for large-scale application systems has become a common requirement for system and system users.

The role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.

However, the traditional role-based user rights management adopts the "role-to-user one-to-many" association mechanism, and the "role" is group/class nature, that is, one role can simultaneously correspond to/associate multiple users, and the role is similar to the post/ The concept of position/work type, the authorization of user rights under this association mechanism is basically divided into the following three forms: 1. As shown in Figure 1, the user is authorized directly, the disadvantage is that the workload is large, the operation is frequent and troublesome; Employee changes (such as transfer, resignation, etc.), all the rights involved in the employee must be adjusted accordingly, especially for company management personnel, which involve a lot of permissions, the task of authority adjustment is large, complicated, error-prone or Missing, affecting the normal operation of the company, and even causing unpredictable losses.

2. As shown in Figure 2, the role (class/group/post/work type) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the authority authority is the group/class nature role; As shown in Figure 3, the above two methods are combined.

In the above expressions, both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization through the role of class/group/post/work type has the following disadvantages: 1. The operation when the user rights change is difficult: In the actual system use process, it is often necessary to adjust the user's authority during the operation process. For example, when the employee permission changes, the employee rights associated with the role change, we cannot change the individual employee rights. And change the permissions of the entire role, because the role is also associated with other employees whose permissions have not changed. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.

When the employee/user's form operation permissions change, either the employee/user is removed from the role or the role is added to meet the job requirements. The defect of the first method is the same as the above-mentioned "direct authorization to the user" method. In the second way, the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.

2. It is difficult to remember the specific permissions contained in the role for a long time: if the role has more permission functions, it will be difficult to remember the specific permissions of the roles, and it is more difficult to remember the difference in permissions between the roles with similar permissions. The permissions of a role are also easily confused; if you want to associate a new user, you cannot accurately determine how the association should be selected.

3, because the user permissions change, it will cause more and more role creation (if you do not create a new role, it will greatly increase the authorization of the user directly), it is more difficult to distinguish the specific differences of the roles of each role.

4. When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.

technical problem

It is an object of the present invention to overcome the deficiencies of the prior art and to provide a method of monitoring approval operations, authorization operations, and form operations.

Technical solution

The object of the present invention is achieved by the following technical solutions: a method for monitoring an approval operation, comprising the following steps:

(1) Create a role in the system, the role is an independent individual, not a group / class, a role can only be associated with a unique user, and a user is associated with one or more roles;

(2) The role records the role of performing the approval operation when performing the approval operation (it may also be understood that the role/user associated with the role records the execution of the approval operation when performing the approval operation) The role and/or the user associated with the role), so that the system can find the operation of the monitored role for the monitoring role;

(3) Set one or more roles as supervisor roles, set one or more roles for each supervisor role as their monitored roles; or set one or more roles as monitored roles for each monitored role One or more roles as their supervisory role;

(4) The supervisory role monitors the audit operation records performed by the monitored role, or the user associated with the supervisor role monitors the audit operation records performed by the user associated with the monitored role.

Steps (1) to (4) are sequentially performed, or steps (1), (3), (2), and (4) are sequentially performed, or steps (1), (3), and (4) are performed. Step (2) is performed sequentially.

The role can only select one department. Once the role is selected, the role belongs to the department. The name of the role is unique under the department. The number of the role is unique in the system, according to the work content of the role. The role is authorized.

The method of checking the approval operation further includes a step of managing the management of the user across departments, including: (1) canceling the association between the user and the role in the original department; (2) associating the user with the role in the new department, the user automatically Obtain supervision or supervision of the role in the new department.

When setting the monitored role, select one or more departments, all the roles under the selected department are set to be monitored, and the subsequent added roles under the selected department are also set to be monitored.

A method of monitoring authorized operations, including the following steps:

(2) the role records the role of performing the authorization operation when performing the authorization operation (it may also be understood that the role/user associated with the role records the execution of the authorization operation when performing the authorization operation) The role and/or the user associated with the role), so that the system can find the operation of the monitored role for the monitoring role;

(4) The monitoring role monitors the authorized operation record performed by the monitored role, or the user associated with the monitoring role monitors the authorized operation record performed by the user associated with the monitored role.

The method for monitoring the authorization operation further includes a step of managing the cross-department management of the user, which includes: (1) canceling the association between the user and the role in the original department; (2) associating the user with the role in the new department, the user automatically Obtain supervision or supervision of the role in the new department.

A method of monitoring the operation of a form, including the following steps:

(2) the character records the role of performing the form operation when performing the form operation (it may also be understood that the character/the user associated with the role records the execution of the form operation when performing the form operation) The role and/or the user associated with the role), so that the system can find the operation of the monitored role for the monitoring role;

(4) The monitoring role monitors the form operation record executed by the monitored role, or the user associated with the monitoring role monitors the form operation record executed by the user associated with the monitored role.

Beneficial effect

The beneficial effects of the present invention are as follows: (1) The subject to be monitored and monitored by the present invention is an independent individual character, and the role has the nature of the post number/station number, and each of the roles requiring the monitoring authority is separately monitored. Set up, fine-tune authorization for monitoring and monitored authority to meet the actual operational needs of the enterprise.

For example: the role of the user associated with Zhang San is: production workshop director 1, research and development department minister 1, the work content is the authorization operation of the production workshop staff, the R&D department form operation. The role "Production Workshop Director 1" is set as the monitored role, and the supervisor role is set to "Deputy General Manager 1", and the employee corresponding to the "Deputy General Manager 1" is the employee of the production workshop. The authorized operation record of the role is supervised (if: "The user associated with the supervisory role monitors the authorized operation record performed by the user associated with the monitored role", then the employee corresponding to the "deputy general manager 1" corresponds to the employee Wang Wuneng. The production workshop director 1" supervises the authorized operation records of the user associated with this role; similarly, the role "R&D Department Minister 1" is set as the monitored role, and the supervisor role is set to "Deputy General Manager 3", then "Deputy Zhao Liuneng, the employee corresponding to the general manager 3's associated user, supervises the form operation record of the “R&D Department Minister 1” (if: “The user associated with the supervisory role monitors the form operation record executed by the user associated with the monitored role” The employee corresponding to the user of the "Deputy General Manager 3", Zhao Liuneng, supervises the form operation record of the user associated with the "R&D Department 1".

(2) The invention realizes the switching and updating of the monitoring related authority through the association/disassociation of the user and the role when the employee leaves the job and adjusts the post, and can realize the seamless handover of the authority, and ensure that the user is monitored and the authority is monitored. Timely update, there will be no lag or omission of authority update, will not affect the normal operation of the enterprise, and also avoid the risk of leakage of confidential information.

Example of resignation: the user associated role of the employee Zhang San “production worker 1”. When Zhang San leaves the post, the system administrator (or the corresponding administrator) directly cancels the association between the user corresponding to Zhang San and the role of “production worker 1”. Zhang San automatically lost the corresponding supervision and supervision authority of “production worker 1”, avoiding the delay in the transfer of supervision authority, which made Zhang San still have the supervision authority after leaving the company, resulting in the disclosure of relevant confidential information to Zhang San; the newly recruited employee Li Si succeeded Zhang San When working directly, the user corresponding to Li Si is directly associated with “production worker 1”, Li Si automatically obtains the supervision and supervision authority corresponding to the role of “production worker 1”, and no need to reset the monitoring and Monitoring authority, operation is simple and fast, greatly reducing the workload.

Example of transfer: The employee Zhang San should be transferred from the production department to the after-sales department. The system administrator (or the corresponding administrator) cancels the association between the user corresponding to Zhang San and the original character “production worker 1”, and then links to the new after-sales department. The role of "after-sales service personnel 3", Zhang San automatically obtained the role of "after-sales service personnel 3" corresponding to the monitoring and monitoring authority.

The traditional approach cannot achieve dynamic management of monitoring and being monitored in business operations. For example, the traditional system directly monitors/monitors the user/employee. Once the supervisory authority is granted, the supervisor A can supervise the relevant operation records of the supervised user/employee; however, if a supervised employee B leaves the job The new employee C takes over the work of employee B. The employee C cannot automatically become the supervised object of supervisor A. It needs to reset C to become the supervised object of supervisor A. Similarly, if supervisor A leaves, new The incoming employee K takes over the work of A, and also needs to set K as the supervisor of the supervised person; these will change at any time in the management of the enterprise dynamics, so the traditional enterprise cannot realize the automatic change of this function; When an employee joins a job, because the employee's corresponding user is an associated role, the employee/user automatically obtains the supervisory/supervised authority through its associated role, then the employee/user's supervision and supervised authority, and the role associated with the user. After setting up the “supervised and supervised relationship”, after the employee’s employment replacement work (associated role), he was automatically supervised or Governor authority, without setting again, thus avoiding supervision and lack of supervision / supervised / supervisory authority is set to lag brings.

(3) When the monitored role is set, the selected department is selected, and all the roles under the selected department are set as the monitored role, and the subsequent added roles in the selected department are also set as the monitored role, and the setting method is convenient and quick. Applicable to department heads as a monitoring role to monitor the relevant operational records of all roles within the entire department.

(4) The role of the application is a one-to-one relationship to the user. One role can only be associated with a unique user at the same time, and one user is associated with one or more roles. The advantage of this is that as long as the user is associated with the role, Permissions (that is, users gain access to their associated roles), and the role's permission changes are much less than the user permissions in the traditional mechanism. The number of roles of the nature of the independent body (the nature of the post number/station number) is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.

(5) The operation of dynamic management, on-the-job adjustment, etc. is simple and convenient, high efficiency, high reliability: the application of the entry/departure/adjustment in the authority management is simple, and the user/user does not need to reset the permission when the user/user changes, the user only The role needs to be canceled or associated: the user who is no longer in the role cancels the role association, and the user who takes over the role is associated with the role of the role number. The user associated with the role automatically obtains the monitoring of the role. Monitoring permissions eliminates the need to re-authorize roles, greatly improving the efficiency, security, and reliability of system setup.

For example: due to Zhang San’s resignation or transfer, Zhang San will no longer work as a “buyer 3”, and Zhang will cancel the association with “Purchaser 3”; Li Si will take over as “Purchaser”. 3) The role of this role, only need to associate Li Si with the role, then Li Si automatically obtained the role of "Purchaser 3" to monitor and be monitored.

(6) The traditional authority management mechanism defines roles as groups, types of work, classes, etc. The role is a one-to-many relationship with the user. In the actual system use process, the user's authority is often required in the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.

However, under the method of the present application, since the role is an independent individual, the role permission can be changed to achieve the goal. Although the method of the present application seems to increase the workload when the system is initialized, it can be made by copying or the like to make the role or authorization more efficient than the traditional group/class nature, because the group/class role is not considered. In the commonality of the related users, the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user. The efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.

(7) The traditional group/class role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization error, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.

(8) Under the traditional group-based role authorization method, if the role has more privilege function points, it takes a long time to remember the specific privilege of the role, and it is more difficult to remember the privilege difference between the roles with similar privilege. If you want to associate a new user, you cannot accurately determine how to select the association. The role of the method of the present application itself has the nature of the job number/station number, and the choice is clear at a glance.

(9) When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.

The method of the present application is as follows: the transferred user associates several roles. When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.

DRAWINGS

1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art;

2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art;

3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art;

4 is a schematic diagram of a manner in which a system authorizes a user through an independent individual role;

Figure 5 is a flowchart of Embodiment 1 of the present invention;

Figure 6 is a flowchart of Embodiment 2 of the present invention;

Figure 7 is a flowchart of Embodiment 3 of the present invention;

Figure 8 is a flow chart of Embodiment 4 of the present invention.

Embodiments of the invention

The technical solution of the present invention will be described in further detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following.

[Embodiment 1] As shown in FIG. 5, a method for monitoring an approval operation includes the following steps: creating a role in the system, as shown in FIG. 4, the role is an independent individual, not a group/class, at the same time, A role can only be associated with a unique user, and a user is associated with one or more roles; one user corresponds to one employee, one employee corresponds to one user, and the employee determines (acquires) through its corresponding user-associated role (independent individual role) Permissions. The employee and the user are each in a one-to-one relationship and are bound for life. After the user corresponds to the employee, the user belongs to the employee, and the user cannot associate with other employees; if the employee leaves the job, the user cannot correspond to other employees. After the employee re-joins, the employee still uses the original user.

The role records the role of performing the approval operation when performing the approval operation; setting one or more roles as the monitoring role, setting one or more roles as the monitored role for each monitoring role; monitoring by the monitoring role The record of the approval operation performed by the monitored role, or the user associated with the monitored role monitors the record of the approval operation performed by the user associated with the monitored role (the monitoring role can count/view all the approval operation records performed by the monitored role to analyze Issues mapped by the relevant operational actions of the monitored role and corresponding processing, etc.).

The subject of monitoring and being monitored by the present invention is an independent individual character, and the work content of the user/employee is distinguished by the post number/station number, and each post number/station number corresponds to an independent individual character. For each role that needs to set the monitoring authority, the monitoring authority is set separately, and the monitoring and monitoring authority are refined and authorized to meet the actual operation and use requirements of the enterprise.

For example: the role of the user associated with Zhang San is: production workshop director 1, research and development department minister 1, the work content is the authorization operation of the production workshop staff, the R&D department form operation. The role "Production Workshop Director 1" is set as the monitored role, and the supervisor role is set to "Deputy General Manager 1", and the employee corresponding to the "Deputy General Manager 1" is the employee of the production workshop. The role authorization operation record is supervised; similarly, the role "R&D Department Minister 1" is set as the monitored role, and the supervisor role is set to "Deputy General Manager 3", and the corresponding employee of the "Deputy General Manager 3" is associated. Zhao Liuneng supervised the form operation record of the “R&D Department Minister 1”.

The invention realizes the switching and updating of the monitoring related authority through the association/disassociation of the user and the role when the employee leaves the job and adjusts the post, and can realize the seamless handover of the authority, and ensure that the user monitoring and the monitored authority are updated in time. There will be no lag or omission in the privilege update, which will not affect the normal operation of the enterprise, and also avoid the risk of leakage of confidential information.

Example of resignation: employee Zhang's corresponding user role "production worker 1". When Zhang San is transferred or resigned, the system administrator (or the corresponding administrator) directly cancels the role of Zhang San's corresponding user and "production worker 1". The association (if it is to adjust the post, it is necessary to associate a new role for the user corresponding to Zhang San), then Zhang San automatically loses the corresponding supervision and supervision authority of "production worker 1", avoiding the delay of supervision and transfer of authority, making Zhang Sanguan Or after leaving the post, he still has the supervision authority, which leads to the disclosure of relevant confidential information to Zhang San; when the new employee Li Si takes over Zhang San’s work, he directly associates the user of Li Si with “production worker 1”, then Li Si automatically obtained “ The role of production worker 1” corresponds to the monitoring and supervision rights. It is no longer necessary to reset the monitoring and monitoring authority for Li Si. The operation is simple and quick, which greatly reduces the workload.

[Embodiment 2] As shown in FIG. 6, the method for monitoring an approval operation includes the following steps: creating a role in the system, as shown in FIG. 4, the role is an independent individual, not a group/class, at the same time. A role can only be associated with a unique user, and a user is associated with one or more roles; one user corresponds to one employee, one employee corresponds to one user, and the employee determines (acquires) permissions through the role associated with the corresponding user.

The role records the role of performing the approval operation when performing the approval operation; setting one or more roles as the monitored role, and setting one or more roles as the supervisory role for each monitored role; Monitor the audit operation records performed by the monitored role, or monitor the approval operation records performed by the users associated with the monitored role by the user associated with the monitoring role (the monitoring role can count/view all the approval operation records performed by the monitored role to Analyze the problems mapped by the relevant operational actions of the monitored role and deal with them accordingly.

The role can only select one department. Once the role is selected, the role belongs to the department (the department cannot be changed), the name of the role is unique under the department, and the number of the role is unique in the system. The role's work content authorizes the role.

If the user needs to adjust the posts across departments, it also includes a user cross-department management process, which includes: (1) canceling the association between the user and the role in the original department; and (2) associating the user with the role in the new department. The user automatically obtains the monitoring or monitored rights of the role in the new department.

In this embodiment, when the monitored role is set, the department can be selected, and the setting mode is convenient and quick, and is applicable to the department head as a monitoring role to monitor the related operation records of all the roles in the entire department.

[Embodiment 3] As shown in FIG. 7, a method for monitoring an authorization operation includes the steps of: creating a role in a system, the role being an independent individual, not a group/class, and a role can only be associated uniquely during the same time period. User, and a user associates one or more roles; the role records the role performing the authorization operation when performing an authorization operation; sets one or more roles as the monitoring role, and sets one or each for each monitoring role Multiple roles as their monitored role; the monitoring role monitors the authorized operation records performed by the monitored role, or the user associated with the monitoring role monitors the authorized operation records performed by the user associated with the monitored role (monitoring role statistics/viewing) All authorized operation records performed by the monitored role to analyze the problems mapped by the relevant operational actions of the monitored role and to deal with them accordingly.

[Embodiment 4] As shown in FIG. 8, a method for monitoring a form operation includes the following steps: creating a role in a system, the role is an independent individual, not a group/class, and a role can only be associated uniquely during the same time period. a user, and a user associates one or more roles; the role records the role performing the form operation when performing a form operation; setting one or more roles as the monitored role, setting for each monitored role One or more roles as their monitoring role; the monitoring role monitors the form operation records performed by the monitored role, or the user associated with the monitoring role monitors the form operation records performed by the user associated with the monitored role (monitoring role statistics/ View all the form operation records executed by the monitored role to analyze the problems mapped by the related operational actions of the monitored role and handle them accordingly.

Based on a similar approach, the present invention also enables monitoring of audit operations.

In the above embodiment, as shown in FIG. 4, the monitored and monitored roles of the present application are independent individual roles, and the following advantages are analyzed for the advantages of authorizing users through independent individual roles: the user determines through the association with the roles. (Acquire) permission, if you want to modify the user's permissions, by adjusting the permissions owned by the role to achieve the purpose of changing the permissions of the user associated with the role. Once a user associates a role, that user has all the operational privileges for that role.

The role of the role to the user is one-to-one (when the role is associated with a user, other users can no longer associate the role; if the role is not associated with the user, it can be selected by other users; that is, a role can be And can only be associated by one user). A user's relationship to a role is one-to-many (one user can associate multiple roles at the same time).

Role definition: The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).

For example: a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5... User-role relationship: If the company employee Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights to these two roles.

The concept of traditional roles is group/class/post/position/work type, and one role can correspond to multiple users. The concept of "role" in this application is equivalent to the post number/station number, and is similar to the role in the film and television drama: a character can only be played by one actor at the same time (childhood, juvenile, middle-aged...). And an actor may be decorated with multiple angles.

After the role is created, you can associate the role in the process of creating the user, or you can associate it at any time after the user is created. After the user associates the role, the relationship with the role can be released at any time, and the relationship with other roles can be established at any time.

The composition of the character is: post name + post number. For example: workshop production workers 1, workshop production workers 2, workshop production workers 3... roles are independent individuals, equivalent to the concept of job number and station number, different from the role in the traditional authority management system, the concept of role in the traditional system It is the group/class nature of the position/position/work type.

The following example shows the relationship between employees, users and roles after the employee Zhang San enters a company: 1. New entry: The employee is newly hired, and directly associates the role of the corresponding job number/station number for the user (employee). Yes, for example: Zhang San joined the company (the company assigned a three-user for Zhang San), the job content is in the sales department, responsible for the sales of refrigerator products in Beijing area (the corresponding role is to sell the sales engineer under the 5 "This role", Zhang San users directly select the "sales engineer 5" role association.

2. Adding positions: After working for a period of time, Zhang also arranged for Zhang San to be responsible for the sales of regional TV products in Beijing (the corresponding role is to sell the role of “Sales Engineer 8” under the Ministry of Sales) and concurrently as the head of the after-sales department (corresponding to the after-sales department) In the role of supervisor 1, the three users added the roles of “sales engineer 8” under the sales department and “sales department supervisor 1” under the after-sales department. At this time, Zhang San employees associated three roles, respectively. In order to sell a "sales engineer 5", "sales engineer 8" and "after-sales department supervisor 1" under the after-sales department, Zhang San users have the authority of these three roles.

3. Reducing the position: After a while, the company decided to let Zhang San serve as the post-sales manager (corresponding to the role of “after-sales manager” in the after-sales department) and no longer take up other jobs. Then Zhang San user is associated with the role of “after-sales manager” in the after-sales department, and cancels the three roles previously associated (Sales Engineer 5 under Sales, Sales Engineer 8 and “After Sales Manager 1” under the after-sales department) At this time, Zhang San users only have the authority of the role of “after-sales manager” under the after-sales department.

4, the adjustment of the role permissions (for the adjustment of the permissions of the role itself): If the company decides to increase the authority of the after-sales manager, then only need to increase the authorization of the role of the after-sales manager, then Zhang San users because of the after-sales department The authority of the manager has increased, and the permissions of Zhang San users have also increased.

5. Resignation: After one year, Zhang San resigned, and the relationship between Zhang San users and the post-sales department manager of the after-sales department can be cancelled.

For example: in the dynamic operation of the company, the entry and exit of the staff are often continued, but the change of the post number/station number is very small (even within a certain period of time).

Traditional authorization method: In the case of a large number of system functions, authorization in the traditional group/class role, not only the authorization workload is large, complicated, but also easy to make mistakes, even if it is wrong, it is not easy to find in a short time. It is easy to cause damage to the system user.

Authorization method of the present application: This application authorizes the role of the nature of the post number/station number, and the user determines the (acquired) authority by associating the role, and the control of the user authority is realized by a simple user-role relationship. It makes the permission control simple, easy to operate, clear and clear, and greatly improves the authorization efficiency and authorization reliability.

The above is only a preferred embodiment of the present invention, and it should be understood that the present invention is not limited to the forms disclosed herein, and is not to be construed as being limited to the other embodiments, but may be used in various other combinations, modifications and environments. Modifications can be made by the techniques or knowledge of the above teachings or related art within the scope of the teachings herein. All changes and modifications made by those skilled in the art are intended to be within the scope of the appended claims.

Claims

A method of monitoring an approval operation, which is characterized by the following steps:

Create roles in the system, the roles are independent individuals, not groups/classes. At the same time, one role can only be associated with a unique user, and one user is associated with one or more roles;

The role records the role performing the approval operation when performing an approval operation;

Set one or more roles as the monitoring role, set one or more roles for each monitored role as their monitored role; or set one or more roles as the monitored role, setting one or more for each monitored role Roles as their supervisory role;

The monitoring role monitors the audit operation records performed by the monitored role, or the user associated with the monitoring role monitors the approval operation records performed by the user associated with the monitored role.
The method of monitoring an approval operation according to claim 1, wherein the role can and can only select one department, and once the role is selected, the role belongs to the department, and the name of the role is under the department. Uniquely, the role's number is unique in the system and the role is authorized based on the role's work content.
The method for monitoring an approval operation according to claim 2, further comprising: a step of managing the user's inter-departmental adjustment, specifically comprising: (1) canceling the association between the user and the role in the original department;

(2) Associate the user with the role in the new department, and the user automatically obtains the monitoring or monitored authority of the role in the new department.
The method for monitoring an approval operation according to claim 2, wherein when the monitored role is set, one or more departments are selected, and all roles under the selected department are set as the monitored role, and the selected department is selected. The next added role is also set to be monitored.
A method of monitoring an authorization operation, comprising the steps of:

Create roles in the system, the roles are independent individuals, not groups/classes. At the same time, one role can only be associated with a unique user, and one user is associated with one or more roles;

The role records the role of performing the authorization operation when performing the authorization operation;

Set one or more roles as the monitoring role, set one or more roles for each monitored role as their monitored role; or set one or more roles as the monitored role, setting one or more for each monitored role Roles as their supervisory role;

The monitoring role monitors the authorized operation record performed by the monitored role, or the user associated with the monitoring role monitors the authorized operation record performed by the user associated with the monitored role.
The method for monitoring an authorization operation according to claim 5, wherein the role can and can only select one department, and once the role is selected, the role belongs to the department, and the name of the role is under the department. Uniquely, the role's number is unique in the system and the role is authorized based on the role's work content.
The method for monitoring an authorization operation according to claim 6, further comprising: a step of managing the inter-departmental management of the user, comprising: (1) canceling the association between the user and the role in the original department;

(2) Associate the user with the role in the new department, and the user automatically obtains the monitoring or monitored authority of the role in the new department.
The method for monitoring an approval operation according to claim 6, wherein when the monitored role is set, one or more departments are selected, and all roles under the selected department are set as the monitored role, and the selected department is selected. The next added role is also set to be monitored.
A method of monitoring the operation of a form, comprising the steps of:

Create roles in the system, the roles are independent individuals, not groups/classes. At the same time, one role can only be associated with a unique user, and one user is associated with one or more roles;

The character records the role of performing the form operation when performing a form operation;

Set one or more roles as the monitoring role, set one or more roles for each monitored role as their monitored role; or set one or more roles as the monitored role, setting one or more for each monitored role Roles as their supervisory role;

The monitoring role monitors the form operation record executed by the monitored role, or the user associated with the monitoring role monitors the form operation record executed by the user associated with the monitored role.
The method for monitoring the operation of a form according to claim 9, wherein when the monitored character is set, one or more departments are selected, and all the roles under the selected department are set as the monitored role, and the selected department is selected. The next added role is also set to be monitored.