WO2019029648A1 - Improved rbac right mechanism-based approval task transfer method - Google Patents
Improved rbac right mechanism-based approval task transfer method Download PDFInfo
- Publication number
- WO2019029648A1 WO2019029648A1 PCT/CN2018/099767 CN2018099767W WO2019029648A1 WO 2019029648 A1 WO2019029648 A1 WO 2019029648A1 CN 2018099767 W CN2018099767 W CN 2018099767W WO 2019029648 A1 WO2019029648 A1 WO 2019029648A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- role
- approval
- user
- approval task
- employee
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/103—Workflow collaboration or project management
Definitions
- the invention relates to a management method for an approval task in a management system such as ERP and CRM, and particularly relates to an approval task handover method based on an improved RBAC authority control mechanism.
- Role-based access control is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive. Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years.
- the basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.
- the role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.
- the traditional role-based user rights management adopts the "role-to-user one-to-many” association mechanism, and the "role” is group/class nature, that is, one role can simultaneously correspond to/associate multiple users, and the role is similar to the post/
- the concept of position/work type the authorization of user rights under this association mechanism is basically divided into the following three forms: 1.
- the role (class/group/post/work type) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the system operation subject is the group/class nature role; As shown in Figure 3, the above two methods are combined.
- both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization through the role of class/group/post/work type has the following disadvantages: 1.
- the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
- the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.
- the approval task is directly transferred to a specific user/employee.
- the transferred user/employee leaves or adjusts the post, it needs to return the approval task and re-approve.
- the transfer of tasks, the large amount of work and the lag or omission of task processing, may bring unpredictable losses to the enterprise.
- the object of the present invention is to overcome the deficiencies of the prior art and provide an approval task handover method based on the improved RBAC authority control mechanism.
- an approval task handover method based on the improved RBAC permission control mechanism including the following steps:
- the role is an independent individual nature role, rather than a group/class nature role, an independent individual nature role can only be associated with a unique user at the same time, and one user is associated with one or more independent Individual nature role;
- the transferor transfers the approval task to the transferred person, and the transferred person is an independent individual character in the system.
- Steps (1) to (3) are sequentially performed, or steps (2), (1), and (3) are sequentially performed.
- the transferee includes one of an employee, a user, a group/class nature role, and an independent individual nature role.
- the transferee also includes a step to complete the transfer note when transferring the approval task.
- the method for transferring the approval task based on the improved RBAC authority control mechanism further includes a step of the transferee selecting whether to accept the transfer. If the transfer is not accepted, the transfer fails.
- the transferee transfers the approval task to the transferred person
- the approval task is processed by the transferred person.
- the method for transferring the approval task based on the improved RBAC permission control mechanism further includes a step of the transferee re-transferring the approval task.
- the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again, but can return it to the original transferee.
- One user corresponds to one employee, one employee corresponds to one user, and the employee obtains the rights of the corresponding user-associated role.
- the employee needs to adjust the post, it also includes an employee adjustment management step, which includes: (1) canceling the employee corresponding user Association with the original role; (2) Associate the user corresponding to the employee with the corresponding new role after the transfer, and the employee automatically obtains the approval task for the new role.
- the approval process includes a start node, at least one approval node, and an end node: a start node: an approval process start; an approval node: an approver approves the approval task; and an end node: the approval process ends.
- the beneficial effects of the present invention are as follows: (1) The transferred person adopts an independent individual role, and when the employee corresponding to the user associated with the role of the transferee leaves the job and adjusts the post, the original association is simply removed, and the user corresponding to the new employee is associated with The role of the transferred person can automatically obtain all the submitted approval tasks of the role.
- the assignment of the role is realized by the association of the role, the workload is small, the use is convenient, and the seamless docking can be realized without approval. Lag or omission of task transfer to ensure that urgent tasks are handled in a timely manner to avoid affecting the normal operation of the enterprise.
- the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her.
- the approval task For example, if the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her. The approval task.
- Example of resignation the user associated role of the employee Zhang San “production worker 1”.
- the system administrator or the corresponding administrator directly cancels the association between the user corresponding to Zhang San and the role of “production worker 1”.
- Zhang San automatically lost the approval task of “production worker 1” being transferred, avoiding the delay in the transfer of approval tasks, and Zhang San could still view and process the submitted approval tasks after leaving the company, resulting in chaotic management; the newly recruited employee Li Si succeeded Zhang San
- the user corresponding to Li Si is directly associated with “production worker 1”, and Li Si automatically obtains the approval task that “production worker 1” is currently transferred, and no need to re-submit the approval task for Li Si. Simple and fast, greatly reducing the workload.
- Example of transfer The employee Zhang San should be transferred from the production department to the after-sales department.
- the system administrator (or the corresponding administrator) cancels the association between the user corresponding to Zhang San and the original character “production worker 1”, and then links to the new after-sales department.
- the role of "after-sales service personnel 3", Zhang San automatically obtained the “after-sales service personnel 3" role is currently transferred to the approval task.
- the role of the application is a one-to-one relationship to the user.
- One role can only be associated with a unique user at the same time, and one user is associated with one or more roles.
- Permissions that is, users gain access to their associated roles
- the role's permission changes are much less than the user permissions in the traditional mechanism.
- the number of roles of the nature of the independent body is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.
- the traditional rights management mechanism defines the role as a group, a job type, a class, etc.
- the role is a one-to-many relationship with the user.
- the user's authority is often required in the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements.
- the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
- the role since the role is an independent individual, the role permission can be changed to achieve the goal.
- the method of the present application seems to increase the workload when the system is initialized, it can be made by copying or the like to make the role or authorization more efficient than the traditional group/class nature, because the group/class role is not considered.
- the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user.
- the efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.
- the traditional group/class role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization error, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.
- the method of the present application is as follows: the transferred user associates several roles.
- the user When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.
- FIG. 1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art
- FIG. 2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art
- FIG. 3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art
- FIG. 4 is a schematic diagram of a manner in which a system authorizes a user through an independent individual role
- Figure 5 is a schematic diagram of the approval process of the present invention.
- FIG. 6 is a flowchart of a method for transferring an approval task according to the present invention.
- the approval process includes a start node, at least one approval node (such as 5 approval nodes in FIG. 5), and an end node: a start node: an approval process starts; an approval node: an approver approves an approval task. End node: The approval process ends.
- the approval task can be forwarded, and the transferred person can help the transferor complete the approval task.
- the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her.
- the approval task For example, if the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her. The approval task.
- the approval task handover method based on the improved RBAC permission control mechanism includes the following steps: creating a role in the system, as shown in FIG. 4, the role is an independent individual role, instead of Group/class nature role, an independent individual nature role can only be associated with a unique user at the same time, and one user is associated with one or more independent individual nature roles; the user obtains the rights of its associated role (the approved approval task is also authorized) a form).
- the transferor obtains the approval task in the approval process, and the transferee may be one of an employee, a user, a group/class nature role, and an independent individual nature role; the transferor transfers the approval task to the transferred person, the The person being transferred is an independent individual role in the system.
- the transferor may fill in the transfer remarks when submitting the approval task, so as to explain the reason for the transfer and the precautions to the transferee.
- the system can be designed as follows: the transferred person can choose whether to accept the transfer. If the transfer is not accepted, the transfer fails. The approval task is still handled by the original transferor, and can be handled by the original transferor or re-transferred by the original transferor.
- the system can also be designed such that once the transferee transfers the approval task to the transferred person, the approval task is processed by the transferred person, that is, the transfer is successful (the transferee cannot refuse).
- the system can be designed as: the transferred person can re-submit the approval task; or can be designed: once the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again, but can return it to the authorized task. The original transferee.
- a role independent individual role
- the role belongs to the department, and the role is authorized according to the work content of the role, and the name of the role is unique under the department. The number of this role is unique in the system.
- One user corresponds to one employee, one employee corresponds to one user, and the employee obtains the rights of the corresponding user-associated role (independent individual role); if the employee needs to adjust the post, it also includes an employee adjustment management step, including: () The association between the user corresponding to the employee and the original role is cancelled; (2) the user corresponding to the employee is associated with the corresponding new role after the transfer, and the employee automatically obtains the approval task for the new role.
- the transferred person adopts the independent individual role.
- the employee corresponding to the user of the transferee is resigned or transferred, the original association is simply released, and the user corresponding to the new employee is automatically associated with the role of the transferred person.
- All the roles that have been transferred are approved by the role.
- the assignment of the roles is achieved by the association of the roles.
- the workload is small, easy to use, and seamlessly connected. There is no lag or omission in the transfer of approval tasks to ensure urgent tasks. Get timely treatment to avoid affecting the normal operation of the company.
- Example of resignation the user associated role of the employee Zhang San “production worker 1”.
- the system administrator or the corresponding administrator directly cancels the association between the user corresponding to Zhang San and the role of “production worker 1”.
- Zhang San automatically lost the approval task of “production worker 1” being transferred, avoiding the delay in the transfer of approval tasks, and Zhang San could still view and process the submitted approval tasks after leaving the company, resulting in chaotic management; the newly recruited employee Li Si succeeded Zhang San
- the user corresponding to Li Si is directly associated with “production worker 1”, and Li Si automatically obtains the approval task that “production worker 1” is currently transferred, and no need to re-submit the approval task for Li Si. Simple and fast, greatly reducing the workload.
- Example of transfer The employee Zhang San should be transferred from the production department to the after-sales department.
- the system administrator (or the corresponding administrator) cancels the association between the user corresponding to Zhang San and the original character “production worker 1”, and then links to the new after-sales department.
- the role of "after-sales service personnel 3", Zhang San automatically obtained the “after-sales service personnel 3" role is currently transferred to the approval task.
- the following is an analysis of the advantages of authorizing a user through an independent individual role: the user determines (acquires) the right through its association with the role (independent individual role), and if the user's permission is to be modified, by adjusting the role's possession Permission to achieve the purpose of changing the permissions of the user associated with the role. Once a user associates a role, that user has all the operational rights and audit/approval tasks for that role.
- the relationship of the role (independent individual role) to the user is one-to-one (when the role is associated with one user, other users can no longer associate the role; if the role is not associated with the user, it can be selected by other users; At the same time, a character can and can only be associated with one user).
- a user's relationship to a role is one-to-many (one user can associate multiple roles at the same time).
- Role definition The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).
- a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
- general manager deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
- Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights and tasks of these two roles.
- the concept of traditional roles is group/class/post/position/work type, and one role can correspond to multiple users.
- the concept of the "role" (independent individual role) of this application is equivalent to the post number/station number, and is also similar to the role in the film and television drama: a character can only be in the same time period (childhood, juvenile, middle age%) Played by an actor, and an actor may be decorated with multiple angles.
- the role (independent individual character role) is composed of: post name + post number.
- workshop production workers 1, workshop production workers 2, workshop production workers 3... roles are independent individuals, equivalent to the concept of job number and station number, different from the role in the traditional authority management system, the concept of role in the traditional system It is the group/class nature of the position/position/work type.
- the following example shows the relationship between employees, users and roles (independent individual roles) after entering the company: 1.
- New entry The employee is newly hired, and the corresponding job number/worker is directly selected for the user (employee).
- the role of the number can be associated, for example: Zhang San joined the company (the company assigned a three-user for Zhang San), the work content is in the sales department, responsible for the sales of refrigerator products in Beijing area (the corresponding role is sales one) Under the role of "Sales Engineer 5", Zhang San users can directly select the role of "Sales Engineer 5".
- Zhang also arranged for Zhang San to be responsible for the sales of regional TV products in Beijing (the corresponding role is to sell the role of “Sales Engineer 8” under the Ministry of Sales) and concurrently as the head of the after-sales department (corresponding to the after-sales department)
- the three users added the roles of “sales engineer 8” under the sales department and “sales department supervisor 1” under the after-sales department.
- Zhang San employees associated three roles, respectively.
- Zhang San users In order to sell a "Sales Engineer 5", "Sales Engineer 8" and "After Sales Department Supervisor 1" under the after-sales department, Zhang San users have the rights and tasks of these three roles.
- Zhang San serves as the post-sales manager (corresponding to the role of “after-sales manager” in the after-sales department) and no longer take up other jobs. Then Zhang San user is associated with the role of “after-sales manager” in the after-sales department, and cancels the three roles previously associated (Sales Engineer 5 under Sales, Sales Engineer 8 and “After Sales Manager 1” under the after-sales department) At this time, Zhang San users only have the authority and tasks of the role of “after-sales manager” under the after-sales department.
- This application authorizes the role of the nature of the post number/station number, and the user determines the (acquired) authority by associating the role, and the control of the user authority is realized by a simple user-role relationship. It makes the permission control simple, easy to operate, clear and clear, and greatly improves the authorization efficiency and authorization reliability.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Physics & Mathematics (AREA)
- Strategic Management (AREA)
- Human Resources & Organizations (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Entrepreneurship & Innovation (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Quality & Reliability (AREA)
- Data Mining & Analysis (AREA)
- Economics (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Storage Device Security (AREA)
Abstract
An improved RBAC right control mechanism-based approval task transfer method, comprising: creating roles in a system, the roles being independent individual roles, the independent individual roles being able to only be associated with a unique user in the same period, and one user being associated with one or more independent individual roles; a transferring party acquiring an approval task in an approval process; and the transferring party transferring the approval task to a transferred party, the transferred party being an independent individual role.
Description
本发明涉及一种ERP、CRM等管理系统中审批任务的管理方法,特别是涉及一种基于改进型RBAC权限控制机制的审批任务转交方法。 The invention relates to a management method for an approval task in a management system such as ERP and CRM, and particularly relates to an approval task handover method based on an improved RBAC authority control mechanism.
基于角色的访问控制(RBAC)是近年来研究最多、思想最成熟的一种数据库权限管理机制,它被认为是替代传统的强制访问控制(MAC)和自主访问控制(DAC)的理想候选。传统的自主访问控制的灵活性高但是安全性低,强制访问控制安全性高但是限制太强;基于角色的访问控制两者兼具,不仅易于管理而且降低了复杂性、成本和发生错误的概率,因而近年来得到了极大的发展。基于角色的访问控制(RBAC)的基本思想是根据企业组织视图中不同的职能岗位划分不同的角色,将数据库资源的访问权限封装在角色中,用户通过被赋予不同的角色来间接访问数据库资源。Role-based access control (RBAC) is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC). Traditional autonomous access control has high flexibility but low security. Forced access control is highly secure but too restrictive. Role-based access control combines both ease of management and reduces the complexity, cost, and probability of errors. Therefore, it has been greatly developed in recent years. The basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.
在大型应用系统中往往都建有大量的表和视图,这使得对数据库资源的管理和授权变得十分复杂。由用户直接管理数据库资源的存取和权限的收授是十分困难的,它需要用户对数据库结构的了解非常透彻,并且熟悉SQL语言的使用,而且一旦应用系统结构或安全需求有所变动,都要进行大量复杂而繁琐的授权变动,非常容易出现一些意想不到的授权失误而引起的安全漏洞。因此,为大型应用系统设计一种简单、高效的权限管理方法已成为系统和系统用户的普遍需求。A large number of tables and views are often built in large application systems, which makes the management and authorization of database resources very complicated. It is very difficult for the user to directly manage the access and permissions of the database resources. It requires the user to have a very thorough understanding of the database structure and is familiar with the use of the SQL language, and once the application system structure or security requirements have changed, To carry out a large number of complex and cumbersome authorization changes, it is very easy to have some security vulnerabilities caused by unexpected authorization errors. Therefore, designing a simple and efficient rights management method for large-scale application systems has become a common requirement for system and system users.
基于角色的权限控制机制能够对系统的访问权限进行简单、高效的管理,极大地降低了系统权限管理的负担和代价,而且使得系统权限管理更加符合应用系统的业务管理规范。The role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.
然而,传统基于角色的用户权限管理均采用“角色对用户一对多”的关联机制,其“角色”为组/类性质,即一个角色可以同时对应/关联多个用户,角色类似于岗位/职位/工种等概念,这种关联机制下对用户权限的授权基本分为以下三种形式:1、如图1所示,直接对用户授权,缺点是工作量大、操作频繁且麻烦;当发生员工变动(如调岗、离职等),该员工涉及到的所有权限必须要作相应调整,特别是对于公司管理人员,其涉及到的权限多,权限调整的工作量大、繁杂,容易出错或遗漏,影响企业的正常运营,甚至造成不可预估的损失。However, the traditional role-based user rights management adopts the "role-to-user one-to-many" association mechanism, and the "role" is group/class nature, that is, one role can simultaneously correspond to/associate multiple users, and the role is similar to the post/ The concept of position/work type, the authorization of user rights under this association mechanism is basically divided into the following three forms: 1. As shown in Figure 1, the user is authorized directly, the disadvantage is that the workload is large, the operation is frequent and troublesome; Employee changes (such as transfer, resignation, etc.), all the rights involved in the employee must be adjusted accordingly, especially for company management personnel, which involve a lot of permissions, the task of authority adjustment is large, complicated, error-prone or Missing, affecting the normal operation of the company, and even causing unpredictable losses.
2、如图2所示,对角色(类/组/岗位/工种性质)进行授权(一个角色可以关联多个用户),用户通过角色获得权限,系统操作主体是组/类性质角色;3、如图3所示,以上两种方式结合。2. As shown in Figure 2, the role (class/group/post/work type) is authorized (a role can be associated with multiple users), the user obtains the permission through the role, and the system operation subject is the group/class nature role; As shown in Figure 3, the above two methods are combined.
以上的表述中,2、3均需要对类/组性质的角色进行授权,而通过类/组/岗位/工种性质的角色进行授权的方式有以下缺点:1、用户权限变化时的操作难:在实际的系统使用过程中,在企业运营过程中经常需要对用户的权限进行调整,比如:在处理员工权限变化时,角色关联的某个员工权限发生变化,我们不能因该个别员工权限的变化而改变整个角色的权限,因为该角色还关联了其他权限未变的员工。因此为了应对该种情况,要么创建新角色来满足该权限发生变化的员工,要么对该员工根据权限需求直接授权(脱离角色)。以上两种处理方式,在角色权限较多的情况下对角色授权不仅所需时间长,而且容易犯错,使用方操作起来繁琐又麻烦,也容易出错导致对系统使用方的损失。In the above expressions, both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization through the role of class/group/post/work type has the following disadvantages: 1. The operation when the user rights change is difficult: In the actual system use process, the user's authority is often adjusted during the operation of the enterprise. For example, when the employee's authority changes, the employee's authority associated with the role changes. We cannot change the individual employee's authority. And change the permissions of the entire role, because the role is also associated with other employees whose permissions have not changed. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
员工/用户的权限发生变化时,要么员工/用户脱离角色,要么新增角色来满足工作要求。第一种方式的缺陷同上述“直接对用户授权”方式的缺陷。第二种方式,新增角色便涉及到角色的新建、关联、授权工作,特别在角色多、角色关联的用户也多的情况下,角色具体关联了哪些用户是很难记住的。When the employee/user's permissions change, either the employee/user leaves the role or the role is added to meet the job requirements. The defect of the first method is the same as the above-mentioned "direct authorization to the user" method. In the second way, the new role involves the creation, association, and authorization of the role. Especially in the case of a large number of roles and a large number of users associated with the role, it is difficult to remember which users are associated with the role.
2、要长期记住角色包含的具体权限难:若角色的权限功能点比较多,时间一长,很难记住角色的具体权限,更难记住权限相近的角色之间的权限差别,相近角色的权限也很容易混淆;若要关联新的用户,无法准确判断应当如何选择关联。2. It is difficult to remember the specific permissions contained in the role for a long time: if the role has more permission functions, it will be difficult to remember the specific permissions of the roles, and it is more difficult to remember the difference in permissions between the roles with similar permissions. The permissions of a role are also easily confused; if you want to associate a new user, you cannot accurately determine how the association should be selected.
3、因为用户权限变化,则会造成角色创建越来越多(若不创建新角色,则会大幅增加直接对用户的授权),更难分清各角色权限的具体差别。3, because the user permissions change, it will cause more and more role creation (if you do not create a new role, it will greatly increase the authorization of the user directly), it is more difficult to distinguish the specific differences of the roles of each role.
4、调岗时,若要将被调岗用户的很多个权限分配给另外几个用户承担,则处理时必须将被调岗用户的这些权限区分开来,分别再创建角色来关联另外几个用户,这样的操作不仅复杂耗时,而且还很容易发生错误。4. When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.
传统管理系统中,通常也具有审批任务的转交功能,然而都是将审批任务直接转交给具体某用户/员工,当被转交的用户/员工离职或调岗时,需要退回审批任务并重新进行审批任务的转交,工作量较大且容易出现任务处理的滞后或遗漏,可能给企业带来无法预估的损失。In the traditional management system, there is usually a transfer function for the approval task. However, the approval task is directly transferred to a specific user/employee. When the transferred user/employee leaves or adjusts the post, it needs to return the approval task and re-approve. The transfer of tasks, the large amount of work and the lag or omission of task processing, may bring unpredictable losses to the enterprise.
本发明的目的在于克服现有技术的不足,提供一种基于改进型RBAC权限控制机制的审批任务转交方法。The object of the present invention is to overcome the deficiencies of the prior art and provide an approval task handover method based on the improved RBAC authority control mechanism.
本发明的目的是通过以下技术方案来实现的:基于改进型RBAC权限控制机制的审批任务转交方法,包括以下步骤:The object of the present invention is achieved by the following technical solutions: an approval task handover method based on the improved RBAC permission control mechanism, including the following steps:
(1)创建系统中的角色,所述的角色是独立个体性质角色,而非组/类性质角色,同一时段一个独立个体性质角色只能关联唯一的用户,而一个用户关联一个或多个独立个体性质角色;(1) Create a role in the system, the role is an independent individual nature role, rather than a group/class nature role, an independent individual nature role can only be associated with a unique user at the same time, and one user is associated with one or more independent Individual nature role;
(2)转交者获取审批流程中的审批任务;(2) The transferee obtains the approval task in the approval process;
(3)转交者将审批任务转交给被转交者,所述的被转交者为系统中的独立个体性质角色。(3) The transferor transfers the approval task to the transferred person, and the transferred person is an independent individual character in the system.
步骤(1)~步骤(3)顺序执行,或步骤(2)、步骤(1)、步骤(3)顺序执行。Steps (1) to (3) are sequentially performed, or steps (2), (1), and (3) are sequentially performed.
所述的转交者包括员工、用户、组/类性质角色、独立个体性质角色中的一种。The transferee includes one of an employee, a user, a group/class nature role, and an independent individual nature role.
转交者在转交审批任务时还包括一个填写转交备注的步骤。The transferee also includes a step to complete the transfer note when transferring the approval task.
基于改进型RBAC权限控制机制的审批任务转交方法,还包括一个被转交者选择是否接受转交的步骤,若不接受转交,则此次转交失败。The method for transferring the approval task based on the improved RBAC authority control mechanism further includes a step of the transferee selecting whether to accept the transfer. If the transfer is not accepted, the transfer fails.
一旦转交者将审批任务转交给被转交者,则该审批任务由该被转交者处理。Once the transferee transfers the approval task to the transferred person, the approval task is processed by the transferred person.
基于改进型RBAC权限控制机制的审批任务转交方法,还包括一个被转交者对审批任务进行再次转交的步骤。The method for transferring the approval task based on the improved RBAC permission control mechanism further includes a step of the transferee re-transferring the approval task.
一旦转交者将审批任务转交至被转交者,被转交者不能再次转交该审批任务。Once the transferee transfers the approval task to the transferred person, the transferee cannot forward the approval task again.
一旦转交者将审批任务转交至被转交者,被转交者不能再次转交该审批任务,但能够退回给原转交者。Once the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again, but can return it to the original transferee.
一个用户对应一个员工,一个员工对应一个用户,员工获得其对应的用户关联的角色的权限;如果员工需要调岗,还包括一个员工调岗管理步骤,具体包括:(1)取消员工对应的用户与原角色的关联;(2)将员工对应的用户与调岗后相应的新角色进行关联,员工自动获得该新角色的审批任务。One user corresponds to one employee, one employee corresponds to one user, and the employee obtains the rights of the corresponding user-associated role. If the employee needs to adjust the post, it also includes an employee adjustment management step, which includes: (1) canceling the employee corresponding user Association with the original role; (2) Associate the user corresponding to the employee with the corresponding new role after the transfer, and the employee automatically obtains the approval task for the new role.
所述的审批流程包括一个开始节点、至少一个审批节点、一个结束节点:开始节点:审批流程开始;审批节点:审批者对审批任务进行审批;结束节点:审批流程结束。The approval process includes a start node, at least one approval node, and an end node: a start node: an approval process start; an approval node: an approver approves the approval task; and an end node: the approval process ends.
本发明的有益效果是:(1)被转交者采用独立个体性质角色,被转交者的角色关联的用户对应的员工离职、调岗时,只需解除原关联,将新任员工对应的用户关联到被转交者的角色即可自动获得该角色当前所有被转交的审批任务,通过角色的关联顺带就实现了审批任务的交接,工作量小,使用方便,而且能够实现无缝对接,不会出现审批任务转交的滞后或遗漏,确保紧急任务得到及时处理,避免影响企业正常运营。The beneficial effects of the present invention are as follows: (1) The transferred person adopts an independent individual role, and when the employee corresponding to the user associated with the role of the transferee leaves the job and adjusts the post, the original association is simply removed, and the user corresponding to the new employee is associated with The role of the transferred person can automatically obtain all the submitted approval tasks of the role. The assignment of the role is realized by the association of the role, the workload is small, the use is convenient, and the seamless docking can be realized without approval. Lag or omission of task transfer to ensure that urgent tasks are handled in a timely manner to avoid affecting the normal operation of the enterprise.
例如:总经理处理某审批任务有困难、没时间处理或不愿意处理,可以将该审批任务转交给其助理角色“总经理助理1”,由其助理角色当前关联的用户对应的员工帮助其处理该审批任务。For example, if the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her. The approval task.
离职举例:员工张三对应的用户关联角色“生产工人1”,张三离职时,系统管理员(或相应管理员)直接取消张三对应的用户与“生产工人1”这一角色的关联,则张三自动失去“生产工人1”被转交的审批任务,避免审批任务交接滞后使得张三离职后仍能查看和处理被转交的审批任务,造成公司管理混乱;新入职员工李四接替张三的工作时,直接让李四对应的用户关联“生产工人1”,则李四自动获得了“生产工人1”这一角色当前被转交的审批任务,无需再为李四重新转交审批任务,操作简单快捷,大大减少了工作量。Example of resignation: the user associated role of the employee Zhang San “production worker 1”. When Zhang San leaves the post, the system administrator (or the corresponding administrator) directly cancels the association between the user corresponding to Zhang San and the role of “production worker 1”. Zhang San automatically lost the approval task of “production worker 1” being transferred, avoiding the delay in the transfer of approval tasks, and Zhang San could still view and process the submitted approval tasks after leaving the company, resulting in chaotic management; the newly recruited employee Li Si succeeded Zhang San When working directly, the user corresponding to Li Si is directly associated with “production worker 1”, and Li Si automatically obtains the approval task that “production worker 1” is currently transferred, and no need to re-submit the approval task for Li Si. Simple and fast, greatly reducing the workload.
调岗举例:员工张三要从生产部调岗到售后部,系统管理员(或相应管理员)取消张三对应的用户与原角色“生产工人1”的关联,再关联到售后部的新角色“售后服务人员3”,张三则自动获得了“售后服务人员3”这一角色当前被转交的审批任务。Example of transfer: The employee Zhang San should be transferred from the production department to the after-sales department. The system administrator (or the corresponding administrator) cancels the association between the user corresponding to Zhang San and the original character “production worker 1”, and then links to the new after-sales department. The role of "after-sales service personnel 3", Zhang San automatically obtained the "after-sales service personnel 3" role is currently transferred to the approval task.
(2)本申请角色对用户是一对一的关系,同一时段一个角色只能关联唯一的用户,一个用户关联一个或多个角色,这样做的好处是,只要将用户关联到角色即可获得权限(即用户获得其关联的角色的权限),而且角色的权限变更比传统机制中的用户权限变更要少得多。独立体性质(岗位号/工位号性质)的角色数量变化小,虽然员工流动大,但岗位号/工位号的变化小(甚至在一定时段内是没有变化的,即角色没有变化),这样将极大简化用户的权限管理,减少系统的开销。(2) The role of the application is a one-to-one relationship to the user. One role can only be associated with a unique user at the same time, and one user is associated with one or more roles. The advantage of this is that as long as the user is associated with the role, Permissions (that is, users gain access to their associated roles), and the role's permission changes are much less than the user permissions in the traditional mechanism. The number of roles of the nature of the independent body (the nature of the post number/station number) is small. Although the employee turnover is large, the change of the post number/station number is small (even if there is no change in a certain period of time, that is, the role does not change), This will greatly simplify the user's rights management and reduce the overhead of the system.
(3)动态管理、入职调岗等的操作简单方便,效率高,可靠性高:入职/离职/调岗在权限管理中的应用简单,当员工/用户发生变化时不用重新设置权限,用户只需取消或关联角色即可:不再任职该角色的用户就取消该角色关联,接手任职该角色的用户关联该岗位号性质的角色,关联该角色的用户自动就获得了该角色的审批任务和操作权限,无需对角色进行重新授权,极大地提高了系统设置的效率、安全性和可靠性。(3) The operation of dynamic management, on-the-job adjustment, etc. is simple and convenient, high in efficiency and high in reliability: the application of the entry/departure/adjustment in the authority management is simple, and the user/user does not need to reset the permission when the user/user changes, the user only The role needs to be canceled or associated: the user who is no longer in the role cancels the role association, and the user who takes over the role is associated with the role of the role number, and the user associated with the role automatically obtains the role approval task and Operational privileges eliminate the need to reauthorize roles, greatly improving the efficiency, security, and reliability of system setup.
举例:因张三用户离职或调岗等原因,张三不再做“采购员3”这个角色的工作,则将张三取消与“采购员3”的关联;另外李四接手做“采购员3”这个角色的工作,只需将李四关联该角色,则李四自动获得了“采购员3”这个角色的审批任务和操作权限。For example: due to Zhang San’s resignation or transfer, Zhang San will no longer work as a “buyer 3”, and Zhang will cancel the association with “Purchaser 3”; Li Si will take over as “Purchaser”. 3) The role of this role, only need to associate Li Si with the role, then Li Si automatically obtained the approval task and operation authority of the role of "Purchaser 3".
(4)传统的权限管理机制将角色定义为组、工种、类等性质,角色对用户是一对多的关系,在实际的系统使用过程中,因为在运营过程中经常需要对用户的权限进行调整,比如:在处理员工权限变化的时候,角色关联的某个员工的权限发生变化,我们不能因该个别员工权限的变化而改变整个角色的权限,因为该角色还关联了其他权限未变的员工。因此为了应对该种情况,要么创建新角色来满足该权限发生变化的员工,要么对该员工根据权限需求直接授权(脱离角色)。以上两种处理方式,在角色权限较多的情况下对角色授权不仅所需时间长,而且容易犯错,使用方操作起来繁琐又麻烦,也容易出错导致对系统使用方的损失。(4) The traditional rights management mechanism defines the role as a group, a job type, a class, etc. The role is a one-to-many relationship with the user. In the actual system use process, the user's authority is often required in the operation process. Adjustments, for example, when the employee permissions are changed, the permissions of an employee associated with the role change. We cannot change the permissions of the entire role because of the change of the individual employee permissions, because the role is also associated with other permissions. Staff. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements. The above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
但在本申请的方法下,因为角色是一个独立的个体,则可以选择改变角色权限即可达到目的。本申请的方法,虽然看起来在系统初始化时会增加工作量,但可以通过复制等方法,使其创建角色或授权的效率高于传统组/类性质的角色,因为不用考虑组/类性质角色在满足关联用户时的共通性,本申请方案会让权限设置清晰,明了;尤其是在系统使用一段时间后(用户/角色权限动态变化),该申请方案能为系统使用方大幅度提高系统使用中的权限管理效率,使动态授权更简单,更方便,更清晰、明了,提高权限设置的效率和可靠性。However, under the method of the present application, since the role is an independent individual, the role permission can be changed to achieve the goal. Although the method of the present application seems to increase the workload when the system is initialized, it can be made by copying or the like to make the role or authorization more efficient than the traditional group/class nature, because the group/class role is not considered. In the commonality of the related users, the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user. The efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.
(5)传统组/类性质的角色授权方法容易出错,本申请方法大幅降低了授权出错的几率,因为本申请方法只需考虑作为独立个体的角色,而不用考虑传统方法下关联该组性质角色的多个用户有哪些共通性。即使授权出错也只影响关联到该角色的那一个用户,而传统以组性质的角色则会影响关联到该角色的所有用户。即使出现权限授权错误,本申请的修正方法简单、时间短,而传统以组性质的角色在修正错误时需要考虑关联到该角色的所有用户的权限共通性,在功能点多的情况下不仅修改麻烦、复杂,非常容易出错,且很多情况下只能新创建角色才能解决。(5) The traditional group/class role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization error, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.
(6)在传统以组为性质的角色授权方法下,若角色的权限功能点比较多,时间一长,很难记住角色的具体权限,更难记住权限相近的角色之间的权限差别,若要关联新的用户,无法准确判断应当如何选择关联。本申请方法的角色本身就具有岗位号/工位号的性质,选择一目了然。(6) Under the traditional group-based role authorization method, if the role has more privilege function points, it takes a long time to remember the specific privilege of the role, and it is more difficult to remember the privilege difference between the roles with similar privilege. If you want to associate a new user, you cannot accurately determine how to select the association. The role of the method of the present application itself has the nature of the job number/station number, and the choice is clear at a glance.
(7)调岗时,若要将被调岗用户的很多个权限分配给另外几个用户承担,则处理时必须将被调岗用户的这些权限区分开来,分别再创建角色来关联另外几个用户,这样的操作不仅复杂耗时,而且还很容易发生错误。(7) When adjusting the post, if you want to assign a lot of rights of the transferred users to other users, you must separate the rights of the transferred users and create roles to associate with others. Users, such an operation is not only complicated and time consuming, but also prone to errors.
本申请方法则为:被调岗用户关联了几个角色,在调岗时,首先取消用户与原部门内的角色的关联(被取消的这几个角色可以被重新关联给其他用户),然后将用户与新部门内的角色进行关联即可。操作简单,不会出错。The method of the present application is as follows: the transferred user associates several roles. When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.
图1为背景技术中系统直接对用户进行授权的方式示意图;1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art;
图2为背景技术中系统对组/类性质角色进行授权的方式示意图;2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art;
图3为背景技术中系统对用户直接授权和对组/类性质角色授权相结合的方式示意图;3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art;
图4为本发明系统通过独立个体性质角色对用户进行授权的方式示意图;4 is a schematic diagram of a manner in which a system authorizes a user through an independent individual role;
图5为本发明审批流程示意图;Figure 5 is a schematic diagram of the approval process of the present invention;
图6为本发明审批任务转交方法流程图。FIG. 6 is a flowchart of a method for transferring an approval task according to the present invention.
下面结合附图进一步详细描述本发明的技术方案,但本发明的保护范围不局限于以下所述。The technical solution of the present invention will be described in further detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following.
如图5所示,审批流程包括一个开始节点、至少一个审批节点(如图5中审批节点有5个)、一个结束节点:开始节点:审批流程开始;审批节点:审批者对审批任务进行审批;结束节点:审批流程结束。As shown in FIG. 5, the approval process includes a start node, at least one approval node (such as 5 approval nodes in FIG. 5), and an end node: a start node: an approval process starts; an approval node: an approver approves an approval task. End node: The approval process ends.
在审批节点审批者对审批任务进行审批时,可以转交审批任务,由被转交者帮助转交者完成审批任务。When the approval node approver approves the approval task, the approval task can be forwarded, and the transferred person can help the transferor complete the approval task.
例如:总经理处理某审批任务有困难、没时间处理或不愿意处理,可以将该审批任务转交给其助理角色“总经理助理1”,由其助理角色当前关联的用户对应的员工帮助其处理该审批任务。For example, if the general manager has difficulty in processing an approval task, has no time to process it, or is unwilling to handle it, he can forward the approval task to his assistant role “Assistant General Manager 1”, and the employee corresponding to the user currently associated with his assistant role can help him or her. The approval task.
具体的,如图6所示,基于改进型RBAC权限控制机制的审批任务转交方法,包括以下步骤:创建系统中的角色,如图4所示,所述的角色是独立个体性质角色,而非组/类性质角色,同一时段一个独立个体性质角色只能关联唯一的用户,而一个用户关联一个或多个独立个体性质角色;用户获得其关联的角色的权限(被转交的审批任务也是权限的一种形式)。Specifically, as shown in FIG. 6, the approval task handover method based on the improved RBAC permission control mechanism includes the following steps: creating a role in the system, as shown in FIG. 4, the role is an independent individual role, instead of Group/class nature role, an independent individual nature role can only be associated with a unique user at the same time, and one user is associated with one or more independent individual nature roles; the user obtains the rights of its associated role (the approved approval task is also authorized) a form).
转交者获取审批流程中的审批任务,所述的转交者可以是员工、用户、组/类性质角色、独立个体性质角色中的一种;转交者将审批任务转交给被转交者,所述的被转交者为系统中的独立个体性质角色。转交者在转交审批任务时可填写转交备注,以便向被转交者说明转交原因及注意事项等。The transferor obtains the approval task in the approval process, and the transferee may be one of an employee, a user, a group/class nature role, and an independent individual nature role; the transferor transfers the approval task to the transferred person, the The person being transferred is an independent individual role in the system. The transferor may fill in the transfer remarks when submitting the approval task, so as to explain the reason for the transfer and the precautions to the transferee.
系统可设计为:被转交者能够选择是否接受转交,若不接受转交,则此次转交失败,该审批任务仍由原转交者处理,可由原转交者自行处理,也可由原转交者重新转交。The system can be designed as follows: the transferred person can choose whether to accept the transfer. If the transfer is not accepted, the transfer fails. The approval task is still handled by the original transferor, and can be handled by the original transferor or re-transferred by the original transferor.
系统也可设计为:一旦转交者将审批任务转交给被转交者,则该审批任务由该被转交者处理,即此次转交成功(被转交者无法拒绝)。The system can also be designed such that once the transferee transfers the approval task to the transferred person, the approval task is processed by the transferred person, that is, the transfer is successful (the transferee cannot refuse).
进一步的,系统可设计为:被转交者可对审批任务进行再次转交;也可设计为:一旦转交者将审批任务转交至被转交者,被转交者不能再次转交该审批任务,但能够退回给原转交者。Further, the system can be designed as: the transferred person can re-submit the approval task; or can be designed: once the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again, but can return it to the authorized task. The original transferee.
在角色(独立个体性质角色)创建时或角色创建后为该角色选择一个部门,则该角色归属于该部门,根据角色的工作内容对角色进行授权,且该角色的名称在该部门下唯一,该角色的编号在系统中唯一。When a role (independent individual role) is created or a role is selected for the role after the role is created, the role belongs to the department, and the role is authorized according to the work content of the role, and the name of the role is unique under the department. The number of this role is unique in the system.
一个用户对应一个员工,一个员工对应一个用户,员工获得其对应的用户关联的角色(独立个体性质角色)的权限;如果员工需要调岗,还包括一个员工调岗管理步骤,具体包括:(1)取消员工对应的用户与原角色的关联;(2)将员工对应的用户与调岗后相应的新角色进行关联,员工自动获得该新角色的审批任务。One user corresponds to one employee, one employee corresponds to one user, and the employee obtains the rights of the corresponding user-associated role (independent individual role); if the employee needs to adjust the post, it also includes an employee adjustment management step, including: () The association between the user corresponding to the employee and the original role is cancelled; (2) the user corresponding to the employee is associated with the corresponding new role after the transfer, and the employee automatically obtains the approval task for the new role.
被转交者采用独立个体性质角色,被转交者的角色关联的用户对应的员工离职、调岗时,只需解除原关联,将新任员工对应的用户关联到被转交者的角色即可自动获得该角色当前所有被转交的审批任务,通过角色的关联顺带就实现了审批任务的交接,工作量小,使用方便,而且能够实现无缝对接,不会出现审批任务转交的滞后或遗漏,确保紧急任务得到及时处理,避免影响企业正常运营。The transferred person adopts the independent individual role. When the employee corresponding to the user of the transferee is resigned or transferred, the original association is simply released, and the user corresponding to the new employee is automatically associated with the role of the transferred person. All the roles that have been transferred are approved by the role. The assignment of the roles is achieved by the association of the roles. The workload is small, easy to use, and seamlessly connected. There is no lag or omission in the transfer of approval tasks to ensure urgent tasks. Get timely treatment to avoid affecting the normal operation of the company.
离职举例:员工张三对应的用户关联角色“生产工人1”,张三离职时,系统管理员(或相应管理员)直接取消张三对应的用户与“生产工人1”这一角色的关联,则张三自动失去“生产工人1”被转交的审批任务,避免审批任务交接滞后使得张三离职后仍能查看和处理被转交的审批任务,造成公司管理混乱;新入职员工李四接替张三的工作时,直接让李四对应的用户关联“生产工人1”,则李四自动获得了“生产工人1”这一角色当前被转交的审批任务,无需再为李四重新转交审批任务,操作简单快捷,大大减少了工作量。Example of resignation: the user associated role of the employee Zhang San “production worker 1”. When Zhang San leaves the post, the system administrator (or the corresponding administrator) directly cancels the association between the user corresponding to Zhang San and the role of “production worker 1”. Zhang San automatically lost the approval task of “production worker 1” being transferred, avoiding the delay in the transfer of approval tasks, and Zhang San could still view and process the submitted approval tasks after leaving the company, resulting in chaotic management; the newly recruited employee Li Si succeeded Zhang San When working directly, the user corresponding to Li Si is directly associated with “production worker 1”, and Li Si automatically obtains the approval task that “production worker 1” is currently transferred, and no need to re-submit the approval task for Li Si. Simple and fast, greatly reducing the workload.
调岗举例:员工张三要从生产部调岗到售后部,系统管理员(或相应管理员)取消张三对应的用户与原角色“生产工人1”的关联,再关联到售后部的新角色“售后服务人员3”,张三则自动获得了“售后服务人员3”这一角色当前被转交的审批任务。Example of transfer: The employee Zhang San should be transferred from the production department to the after-sales department. The system administrator (or the corresponding administrator) cancels the association between the user corresponding to Zhang San and the original character “production worker 1”, and then links to the new after-sales department. The role of "after-sales service personnel 3", Zhang San automatically obtained the "after-sales service personnel 3" role is currently transferred to the approval task.
以下对通过独立个体性质角色对用户进行授权所具备的优势进行分析:用户通过其与角色(独立个体性质角色)的关联确定(获得)权限,如果要修改用户的权限,通过调整角色所拥有的权限以达到改变关联了该角色的用户的权限的目的。一旦用户关联角色后,该用户就拥有了该角色的所有操作权限和审核/审批任务。The following is an analysis of the advantages of authorizing a user through an independent individual role: the user determines (acquires) the right through its association with the role (independent individual role), and if the user's permission is to be modified, by adjusting the role's possession Permission to achieve the purpose of changing the permissions of the user associated with the role. Once a user associates a role, that user has all the operational rights and audit/approval tasks for that role.
角色(独立个体性质角色)对用户的关系为一对一(该角色与一个用户关联时,其他用户则不能再关联该角色;若该角色未被用户关联,则可以被其他用户选择关联;即同一时段,一个角色能且只能被一个用户关联)。用户对角色的关系为一对多(一个用户可以同时关联多个角色)。The relationship of the role (independent individual role) to the user is one-to-one (when the role is associated with one user, other users can no longer associate the role; if the role is not associated with the user, it can be selected by other users; At the same time, a character can and can only be associated with one user). A user's relationship to a role is one-to-many (one user can associate multiple roles at the same time).
角色的定义:角色不具有组/类/类别/岗位/职位/工种等性质,而是一个非集合的性质,角色具有唯一性,角色是独立存在的独立个体;在企事业单位应用中相当于岗位号(此处的岗位号非岗位,一个岗位同时可能有多个员工,而同一时段一个岗位号只能对应一个员工)。Role definition: The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).
举例:某个公司系统中可创建如下角色:总经理、副总经理1、副总经理2、北京销售一部经理、北京销售二部经理、北京销售三部经理、上海销售工程师1、上海销售工程师2、上海销售工程师3、上海销售工程师4、上海销售工程师5……用户与角色的关联关系:若该公司员工张三任职该公司副总经理2,同时任职北京销售一部经理,则张三需要关联的角色为副总经理2和北京销售一部经理,张三拥有了这两个角色的权限和任务。For example: a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5... User-role relationship: If the company employee Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights and tasks of these two roles.
传统角色的概念是组/类/岗位/职位/工种性质,一个角色能够对应多个用户。而本申请“角色”(独立个体性质角色)的概念相当于岗位号/工位号,也类同于影视剧中的角色:一个角色在同一时段(童年、少年、中年……)只能由一个演员来饰演,而一个演员可能会分饰多角。The concept of traditional roles is group/class/post/position/work type, and one role can correspond to multiple users. The concept of the "role" (independent individual role) of this application is equivalent to the post number/station number, and is also similar to the role in the film and television drama: a character can only be in the same time period (childhood, juvenile, middle age...) Played by an actor, and an actor may be decorated with multiple angles.
在创建角色(独立个体性质角色)之后,可以在创建用户的过程中关联角色,也可以在用户创建完成后随时进行关联。用户关联角色后可以随时解除与角色的关联关系,也可以随时建立与其他角色的关联关系。After creating a role (independent individual role), you can associate the role in the process of creating the user, or you can associate it at any time after the user is created. After the user associates the role, the relationship with the role can be released at any time, and the relationship with other roles can be established at any time.
所述角色(独立个体性质角色)的构成为:岗位名+岗内编号。例如:车间生产工人1、车间生产工人2、车间生产工人3……角色是独立个体,相当于岗位号、工位号的概念,不同于传统权限管理体系中的角色,传统体系中角色的概念是岗位/职位/工种等的组/类性质。The role (independent individual character role) is composed of: post name + post number. For example: workshop production workers 1, workshop production workers 2, workshop production workers 3... roles are independent individuals, equivalent to the concept of job number and station number, different from the role in the traditional authority management system, the concept of role in the traditional system It is the group/class nature of the position/position/work type.
以下举例员工张三进入某公司后,员工、用户与角色(独立个体性质角色)之间的关系为:1、新入职:员工新入职,直接为该用户(员工)选择相应的岗位号/工位号的角色进行关联即可,例:张三入职公司(公司为张三分配了一个张三用户),工作内容是在销售一部,负责北京区域冰箱产品的销售(对应的角色是销售一部下的“销售工程师5”这个角色),则张三用户直接选择“销售工程师5”这个角色关联即可。The following example shows the relationship between employees, users and roles (independent individual roles) after entering the company: 1. New entry: The employee is newly hired, and the corresponding job number/worker is directly selected for the user (employee). The role of the number can be associated, for example: Zhang San joined the company (the company assigned a three-user for Zhang San), the work content is in the sales department, responsible for the sales of refrigerator products in Beijing area (the corresponding role is sales one) Under the role of "Sales Engineer 5", Zhang San users can directly select the role of "Sales Engineer 5".
2、增加职位:张三工作一段时间后,公司还安排张三负责北京区域电视产品的销售(对应的角色是销售一部下的“销售工程师8”这个角色)并兼任售后部主管(对应售后部主管1这个角色),则张三用户再增加关联销售一部下的“销售工程师8”和售后部下的“售后部主管1”这两个角色,此时,张三员工关联了三个角色,分别为销售一部下的“销售工程师5”、“销售工程师8”和售后部下的“售后部主管1”,张三用户则拥有了这三个角色的权限和任务。2. Adding positions: After working for a period of time, Zhang also arranged for Zhang San to be responsible for the sales of regional TV products in Beijing (the corresponding role is to sell the role of “Sales Engineer 8” under the Ministry of Sales) and concurrently as the head of the after-sales department (corresponding to the after-sales department) In the role of supervisor 1, the three users added the roles of “sales engineer 8” under the sales department and “sales department supervisor 1” under the after-sales department. At this time, Zhang San employees associated three roles, respectively. In order to sell a "Sales Engineer 5", "Sales Engineer 8" and "After Sales Department Supervisor 1" under the after-sales department, Zhang San users have the rights and tasks of these three roles.
3、减少职位:又过了一段时间,公司决定让张三任职售后部经理(对应售后部下“售后部经理”这个角色),且不再兼任其他工作。则张三用户关联售后部下“售后部经理”这个角色,同时取消此前关联的三个角色(销售一部下的“销售工程师5”、“销售工程师8”和售后部下的“售后部主管1”),此时,张三用户只拥有售后部下“售后部经理”这个角色的权限和任务。3. Reducing the position: After a while, the company decided to let Zhang San serve as the post-sales manager (corresponding to the role of “after-sales manager” in the after-sales department) and no longer take up other jobs. Then Zhang San user is associated with the role of “after-sales manager” in the after-sales department, and cancels the three roles previously associated (Sales Engineer 5 under Sales, Sales Engineer 8 and “After Sales Manager 1” under the after-sales department) At this time, Zhang San users only have the authority and tasks of the role of “after-sales manager” under the after-sales department.
4、角色权限的调整(针对角色本身所拥有的权限的调整):如公司决定增加售后部经理的权限,则只需增加对售后部经理这个角色的授权即可,则张三用户因为售后部经理这个角色的权限增加了,张三用户的权限也增加了。4, the adjustment of the role permissions (for the adjustment of the permissions of the role itself): If the company decides to increase the authority of the after-sales manager, then only need to increase the authorization of the role of the after-sales manager, then Zhang San users because of the after-sales department The authority of the manager has increased, and the permissions of Zhang San users have also increased.
5、离职:一年后,张三离职了,则取消张三用户与售后部下“售后部经理”这个角色的关联即可。5. Resignation: After one year, Zhang San resigned, and the relationship between Zhang San users and the post-sales department manager of the after-sales department can be cancelled.
举例:公司在动态的经营中,职员的入职、离职是经常持续发生的,但岗位号/工位号的变化非常少(甚至在一定时期内是没有变化的)。For example: in the dynamic operation of the company, the entry and exit of the staff are often continued, but the change of the post number/station number is very small (even within a certain period of time).
传统授权方法:在系统功能点多的情况下,以传统的组/类性质的角色进行授权,不仅授权工作量大,繁杂,而且很容易出错,甚至出错了在短时间内都不容易发现,容易对系统使用方造成损失。Traditional authorization method: In the case of a large number of system functions, authorization in the traditional group/class role, not only the authorization workload is large, complicated, but also easy to make mistakes, even if it is wrong, it is not easy to find in a short time. It is easy to cause damage to the system user.
本申请授权方法:本申请是对岗位号/工位号性质的角色进行授权,用户关联角色而确定(获得)权限,则对用户权限的控制,通过简单的用户-角色的关联关系来实现,让权限控制变得简单、易操作,清晰明了,大幅度提高了授权效率和授权可靠性。Authorization method of the present application: This application authorizes the role of the nature of the post number/station number, and the user determines the (acquired) authority by associating the role, and the control of the user authority is realized by a simple user-role relationship. It makes the permission control simple, easy to operate, clear and clear, and greatly improves the authorization efficiency and authorization reliability.
以上所述仅是本发明的优选实施方式,应当理解本发明并非局限于本文所披露的形式,不应看作是对其他实施例的排除,而可用于各种其他组合、修改和环境,并能够在本文所述构想范围内,通过上述教导或相关领域的技术或知识进行改动。而本领域人员所进行的改动和变化不脱离本发明的精神和范围,则都应在本发明所附权利要求的保护范围内。The above is only a preferred embodiment of the present invention, and it should be understood that the present invention is not limited to the forms disclosed herein, and is not to be construed as being limited to the other embodiments, but may be used in various other combinations, modifications and environments. Modifications can be made by the techniques or knowledge of the above teachings or related art within the scope of the teachings herein. All changes and modifications made by those skilled in the art are intended to be within the scope of the appended claims.
Claims (10)
- 基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于,包括以下步骤:The approval task handover method based on the improved RBAC authority control mechanism is characterized in that it comprises the following steps:创建系统中的角色,所述的角色是独立个体性质角色,而非组/类性质角色,同一时段一个独立个体性质角色只能关联唯一的用户,而一个用户关联一个或多个独立个体性质角色;Create roles in the system, the roles are independent individual roles, not group/class nature roles. In the same period, an independent individual character can only associate with a unique user, and a user associates with one or more independent individual roles. ;转交者获取审批流程中的审批任务;The transferee obtains the approval task in the approval process;转交者将审批任务转交给被转交者,所述的被转交者为系统中的独立个体性质角色。The transferee forwards the approval task to the transferred person, which is an independent individual role in the system.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:所述的转交者包括员工、用户、组/类性质角色、独立个体性质角色中的一种。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein the transferee includes one of an employee, a user, a group/class nature role, and an independent individual nature role.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:转交者在转交审批任务时还包括一个填写转交备注的步骤。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein the transferor further includes a step of filling in the transfer note when transferring the approval task.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:还包括一个被转交者选择是否接受转交的步骤,若不接受转交,则此次转交失败。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, further comprising: a step of the transferee selecting whether to accept the transfer, and if the transfer is not accepted, the transfer fails.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:一旦转交者将审批任务转交给被转交者,则该审批任务由该被转交者处理。The approval task handover method based on the improved RBAC authority control mechanism according to claim 1, wherein the approval task is processed by the transferred person once the transferee transfers the approval task to the transferred person.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:还包括一个被转交者对审批任务进行再次转交的步骤。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, further comprising the step of transferring the approval task again by the transferee.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:一旦转交者将审批任务转交至被转交者,被转交者不能再次转交该审批任务。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein once the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:一旦转交者将审批任务转交至被转交者,被转交者不能再次转交该审批任务,但能够退回给原转交者。The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein once the transferee transfers the approval task to the transferred person, the transferred person cannot transfer the approval task again, but can return it to the transfer task. The original transferee.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:一个用户对应一个员工,一个员工对应一个用户,员工获得其对应的用户关联的角色的权限;The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein one user corresponds to one employee, one employee corresponds to one user, and the employee obtains the permission of the corresponding user-associated role;如果员工需要调岗,还包括一个员工调岗管理步骤,具体包括:(1)取消员工对应的用户与原角色的关联;If the employee needs to adjust the post, it also includes an employee transfer management step, which includes: (1) canceling the association between the user corresponding to the original role and the original role;(2)将员工对应的用户与调岗后相应的新角色进行关联,员工自动获得该新角色的审批任务。(2) Associate the user corresponding to the employee with the corresponding new role after the transfer, and the employee automatically obtains the approval task for the new role.
- 根据权利要求1所述的基于改进型RBAC权限控制机制的审批任务转交方法,其特征在于:所述的审批流程包括一个开始节点、至少一个审批节点、一个结束节点:The method for transferring an approval task based on the improved RBAC authority control mechanism according to claim 1, wherein the approval process comprises a start node, at least one approval node, and an end node:开始节点:审批流程开始;Start node: the approval process begins;审批节点:审批者对审批任务进行审批;Approval node: The approver approves the approval task;结束节点:审批流程结束。End node: The approval process ends.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201710682720.4A CN107480512A (en) | 2017-08-10 | 2017-08-10 | Examination & approval task based on modified RBAC mechanism of authorization control delivers method |
CN201710682720.4 | 2017-08-10 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2019029648A1 true WO2019029648A1 (en) | 2019-02-14 |
Family
ID=60600376
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2018/099767 WO2019029648A1 (en) | 2017-08-10 | 2018-08-09 | Improved rbac right mechanism-based approval task transfer method |
Country Status (2)
Country | Link |
---|---|
CN (2) | CN107480512A (en) |
WO (1) | WO2019029648A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110443010A (en) * | 2019-07-22 | 2019-11-12 | 安徽智恒信科技股份有限公司 | One kind permission visual configuration control method, device, terminal and storage medium in information system |
CN114862375A (en) * | 2022-07-07 | 2022-08-05 | 巨网云互联(北京)科技股份有限公司 | Personnel identity management method, device, terminal and storage medium |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107491668A (en) * | 2017-07-24 | 2017-12-19 | 成都牵牛草信息技术有限公司 | Method to set up of the user in the authority of information interchange unit in system |
CN107480512A (en) * | 2017-08-10 | 2017-12-15 | 成都牵牛草信息技术有限公司 | Examination & approval task based on modified RBAC mechanism of authorization control delivers method |
CN109918945A (en) * | 2019-03-05 | 2019-06-21 | 山东浪潮通软信息科技有限公司 | A kind of method of expansible temporary Authorization |
CN110175437A (en) * | 2019-04-11 | 2019-08-27 | 全球能源互联网研究院有限公司 | It is a kind of for access terminal authorization control method, apparatus and host terminal |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102104599A (en) * | 2010-12-29 | 2011-06-22 | 北京理工大学 | Method for improving dRBAC model based on trust mechanism |
CN104112085A (en) * | 2013-04-19 | 2014-10-22 | 阿里巴巴集团控股有限公司 | Data permission control method and device for application system clusters |
CN106295265A (en) * | 2015-05-22 | 2017-01-04 | 阿里巴巴集团控股有限公司 | A kind of method and device of user authority management |
CN106790060A (en) * | 2016-12-20 | 2017-05-31 | 微梦创科网络科技(中国)有限公司 | The right management method and device of a kind of role-base access control |
CN107480512A (en) * | 2017-08-10 | 2017-12-15 | 成都牵牛草信息技术有限公司 | Examination & approval task based on modified RBAC mechanism of authorization control delivers method |
Family Cites Families (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101714196A (en) * | 2009-11-20 | 2010-05-26 | 上海电机学院 | Authority entrusting method based on cycle time |
JP5814639B2 (en) * | 2011-06-09 | 2015-11-17 | キヤノン株式会社 | Cloud system, cloud service license management method, and program |
CN102316216A (en) * | 2011-09-07 | 2012-01-11 | 宇龙计算机通信科技(深圳)有限公司 | Terminal adaptive role method and terminal thereof |
CN104346663A (en) * | 2013-07-26 | 2015-02-11 | 镇江雅迅软件有限责任公司 | Contract approval method based on workflow |
CN103455888A (en) * | 2013-09-10 | 2013-12-18 | 山东中创软件工程股份有限公司 | Method and device for configuring flow permission |
CN104463005A (en) * | 2013-09-25 | 2015-03-25 | 天津书生投资有限公司 | Method for controlling access permissions of electronic document |
US9842221B2 (en) * | 2015-06-26 | 2017-12-12 | Sap Se | Role analyzer and optimizer in database systems |
CN105005730A (en) * | 2015-08-13 | 2015-10-28 | 杭州杉石科技有限公司 | Authority design method based on APP (application) |
CN105303084A (en) * | 2015-09-24 | 2016-02-03 | 北京奇虎科技有限公司 | Privilege management system and method |
CN106779619B (en) * | 2016-12-30 | 2024-02-02 | 全民互联科技(天津)有限公司 | Auditing and signing method and system for perfecting business approval |
-
2017
- 2017-08-10 CN CN201710682720.4A patent/CN107480512A/en active Pending
-
2018
- 2018-08-09 CN CN201810905224.5A patent/CN109165524B/en active Active
- 2018-08-09 WO PCT/CN2018/099767 patent/WO2019029648A1/en active Application Filing
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102104599A (en) * | 2010-12-29 | 2011-06-22 | 北京理工大学 | Method for improving dRBAC model based on trust mechanism |
CN104112085A (en) * | 2013-04-19 | 2014-10-22 | 阿里巴巴集团控股有限公司 | Data permission control method and device for application system clusters |
CN106295265A (en) * | 2015-05-22 | 2017-01-04 | 阿里巴巴集团控股有限公司 | A kind of method and device of user authority management |
CN106790060A (en) * | 2016-12-20 | 2017-05-31 | 微梦创科网络科技(中国)有限公司 | The right management method and device of a kind of role-base access control |
CN107480512A (en) * | 2017-08-10 | 2017-12-15 | 成都牵牛草信息技术有限公司 | Examination & approval task based on modified RBAC mechanism of authorization control delivers method |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110443010A (en) * | 2019-07-22 | 2019-11-12 | 安徽智恒信科技股份有限公司 | One kind permission visual configuration control method, device, terminal and storage medium in information system |
CN114862375A (en) * | 2022-07-07 | 2022-08-05 | 巨网云互联(北京)科技股份有限公司 | Personnel identity management method, device, terminal and storage medium |
Also Published As
Publication number | Publication date |
---|---|
CN109165524A (en) | 2019-01-08 |
CN109165524B (en) | 2021-10-29 |
CN107480512A (en) | 2017-12-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2019029648A1 (en) | Improved rbac right mechanism-based approval task transfer method | |
WO2018196876A1 (en) | Workflow control method and system based on one-to-one correspondence between roles and users | |
WO2018214891A1 (en) | Method for setting up approval role according to department by approval node in workflow | |
WO2018214890A1 (en) | Role-based method for setting approval role for workflow approval node | |
WO2019029650A1 (en) | Form data operation auditing method | |
WO2019011220A1 (en) | Method for setting approval procedure based on base fields | |
WO2018192557A1 (en) | Permission granting method and system based on one-to-one correspondence between roles and users | |
WO2019007292A1 (en) | Role-based form operation authority granting method | |
WO2018210248A1 (en) | Method based on form fields for arranging examination and approval roles at workflow examination and approval nodes | |
WO2018205942A1 (en) | Method for setting approval roles according to department levels on workflow approval nodes | |
WO2019007260A1 (en) | Method for authorizing operation permissions of form field values | |
WO2018210245A1 (en) | Method for setting form field operation authority of workflow, and method for setting form field operation authority of approval node | |
WO2019015656A1 (en) | System dispatching method | |
WO2019020118A1 (en) | Method for managing instant messaging account in management system | |
JP7318894B2 (en) | How to authorize the operation privileges for the statistics column table | |
WO2019024831A1 (en) | Method for presetting instant messaging account contacts and presetting address book according to messaging relationship between roles | |
US20200389463A1 (en) | Permission granting method and system based on one-to-one correspondence between roles and users | |
WO2018219230A1 (en) | Approval workflow entrusting and re-entrusting method | |
WO2019034023A1 (en) | Method for approver to ask for reference opinion for approval task | |
WO2019019981A1 (en) | Method for setting permission of user in information exchange unit in system | |
WO2019011162A1 (en) | Shortcut function setting method | |
WO2019029649A1 (en) | Method for authorizing approval processes and approval nodes thereof for user | |
JP7351465B2 (en) | How to manage paperwork in a management system | |
WO2019024899A1 (en) | Method for supervising approval operations, authorization operations and form operations | |
WO2019029500A1 (en) | Column value-based separate authorization method for statistical list operations |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 18844667 Country of ref document: EP Kind code of ref document: A1 |
|
DPE1 | Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101) | ||
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 18844667 Country of ref document: EP Kind code of ref document: A1 |