WO2019075966A1

WO2019075966A1 - Data operation permission isolation method, application server and computer readable storage medium

Info

Publication number: WO2019075966A1
Application number: PCT/CN2018/076143
Authority: WO
Inventors: 李佳; 王浩
Original assignee: 平安科技（深圳）有限公司
Priority date: 2017-10-16
Filing date: 2018-02-10
Publication date: 2019-04-25
Also published as: CN107844711A; CN107844711B

Abstract

Disclosed in the invention are a data operation permission isolation method, an application server and computer readable storage medium. The method comprises: obtaining user information of an operation user logging in an application system currently, and storing the user information in first context information of the application system (S401); synchronizing the first context information to second context information connected to a database session currently (S402); based on a data table, creating a data view (S403); and according to the second context information of the database session, displaying specific data through the data view (S404). The method can acquire the user information by synchronizing the context information. An institution relationship graph is established and stored in a database, and in combination with a mode of establishing the view through the basic table, different specific data is displayed for specific users having different permissions, so that the technical effect that the users can access not only data of their department institutions but also data of lower institutions is achieved.

Description

Data operation authority isolation method, application server, and computer readable storage medium

This application claims the priority of the Chinese Patent Application filed on October 16, 2017, the Chinese Patent Office, the application number is 201710962907.X, and the invention name is "data operation authority isolation method, application server and computer readable storage medium". All content is incorporated by reference in the application.

Technical field

The present application relates to the field of database technologies, and in particular, to a data operation authority isolation method, an application server, and a computer readable storage medium.

Background technique

For the purposes of privilege isolation and security management, the data of the IT system usually needs to be quarantined for operation, that is, it can only operate the data that it can authorize and cannot operate the unauthorized data. A common operational permission isolation requirement is the isolation of upper and lower authority. For example, the A organization has subordinate organizations B and C. The requirement for data operation authority isolation is that the A organization can operate its own data and the B and C data downwards. The B organization can only operate its own data, and the C organization has the same reason.

Previously, the need for such data manipulation permission isolation was generally written in the code logic during system implementation, resulting in the addition of permission control code in the code logic for each function implemented. This has caused the system administrator to develop and maintain a large amount of work, and the function development is slow. Once the omission is added, there will be a security risk.

Summary of the invention

In view of this, the present application provides a data operation authority isolation method, an application server, and a computer readable storage medium, which can quickly complete the database to the user by setting the context information of the application system to the context information of the current database session. Acquisition of information. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization.

First, in order to achieve the above object, the present application provides an application server, where the application server includes a memory and a processor, and the memory stores a data operation authority isolation program operable on the processor, and the data operation The privilege isolation program is implemented by the processor to implement the following steps:

Obtaining user information of an operation user currently logged into the application system, and saving the user information to the first context information of the application system;

Synchronizing the first context information into second context information currently connected to the database session;

Create a data view based on a data table; and

Displaying specific data through the data view according to the second context information of the database session.

In addition, to achieve the above object, the present application further provides a data operation authority isolation method, which is applied to an application server, and the method includes:

Create a data view based on a data table; and

Further, in order to achieve the above object, the present application further provides a computer readable storage medium storing a data operation authority isolation program, the data operation authority isolation program being executable by at least one processor, The step of causing the at least one processor to perform the data operation authority isolation method as described above.

Compared with the prior art, the application server, the data operation authority isolation method, and the computer readable storage medium proposed by the present application firstly acquire user information of an operation user currently logged into the application system, and save the user information to the The first context information of the application system; secondly, the first context information is synchronized to the second context information currently connected to the database session; again, the data view is created based on the data table; finally, according to the database session Second context information through which specific data is displayed. In this way, the database information can be quickly obtained by the database by setting the context information of the application system to the context information of the current database session. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization.

DRAWINGS

1 is a schematic diagram of an optional hardware architecture of an application server of the present application;

2 is a schematic diagram of a program module of a first embodiment of the data operation authority isolation program of the present application;

3 is a schematic diagram of a program module of a second embodiment of the data operation authority isolation program of the present application;

4 is a schematic diagram of an implementation process of a first embodiment of a data operation authority isolation method according to the present application;

FIG. 5 is a schematic diagram of an implementation process of a second embodiment of a data operation authority isolation method according to the present application.

The implementation, functional features and advantages of the present application will be further described with reference to the accompanying drawings.

Detailed ways

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

It should be noted that the descriptions of "first", "second" and the like in the present application are for the purpose of description only, and are not to be construed as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. . Thus, features defining "first" and "second" may include at least one of the features, either explicitly or implicitly. In addition, the technical solutions between the various embodiments may be combined with each other, but must be based on the realization of those skilled in the art, and when the combination of the technical solutions is contradictory or impossible to implement, it should be considered that the combination of the technical solutions does not exist. Nor is it within the scope of protection required by this application.

Referring to FIG. 1, it is a schematic diagram of an optional hardware architecture of the application server 2 of the present application.

In this embodiment, the application server 2 may include, but is not limited to, the memory 11, the processor 12, and the network interface 13 being communicably connected to each other through a system bus. It is to be noted that FIG. 2 only shows the application server 2 with components 11-13, but it should be understood that not all illustrated components may be implemented, and more or fewer components may be implemented instead.

The application server 2 may be a computing device such as a rack server, a blade server, a tower server, or a rack server. The application server 2 may be an independent server or a server cluster composed of multiple servers. .

The memory 11 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (eg, SD or DX memory, etc.), a random access memory (RAM), a static Random access memory (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk, optical disk, and the like. In some embodiments, the memory 11 may be an internal storage unit of the application server 2, such as a hard disk or memory of the application server 2. In other embodiments, the memory 11 may also be an external storage device of the application server 2, such as a plug-in hard disk equipped on the application server 2, a smart memory card (SMC), and a secure digital number. (Secure Digital, SD) card, flash card, etc. Of course, the memory 11 can also include both the internal storage unit of the application server 2 and its external storage device. In this embodiment, the memory 11 is generally used to store an operating system installed in the application server 2 and various types of application software, such as program code of the data operation authority isolation program 200. Further, the memory 11 can also be used to temporarily store various types of data that have been output or are to be output.

The processor 12 may be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data processing chip in some embodiments. The processor 12 is typically used to control the overall operation of the application server 2. In this embodiment, the processor 12 is configured to run program code or process data stored in the memory 11, such as running the data operation authority isolation program 200 and the like.

The network interface 13 may comprise a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the application server 2 and other electronic devices.

So far, the hardware structure and functions of the devices related to this application have been described in detail. Hereinafter, various embodiments of the present application will be made based on the above description.

First, the present application proposes a data operation authority isolation program 200.

Referring to FIG. 2, it is a program module diagram of the first embodiment of the data operation authority isolation program 200 of the present application.

In this embodiment, the data operation authority isolation program 200 includes a series of computer program instructions stored in the memory 11, and when the computer program instructions are executed by the processor 12, the data operation authority of each embodiment of the present application can be implemented. Isolation operation. In some embodiments, the data manipulation authority isolation program 200 can be divided into one or more modules based on the particular operations implemented by the various portions of the computer program instructions. For example, in FIG. 3, the data operation authority isolation program 200 can be divided into an acquisition module 201, a synchronization module 202, a view creation module 203, and a display module 204. among them:

The obtaining module 201 is configured to acquire user information of an operation user currently logged into the application system, and save the user information to the first context information of the application system.

In an embodiment, the obtaining module 201 may acquire user information of the user when the user logs in to the application system.

The user information includes a username and an operable mechanism.

The operable mechanism is a departmental institution where the user is currently located. In an embodiment, the mechanism in which the first user is located is A, and the operable mechanism of the first user is A.

The obtaining module 201 is further configured to save the user information into the first context information of the application system.

The synchronization module 202 is configured to synchronize the first context information to the second context information currently connected to the database session;

In an embodiment, when the application system connects to the database, the synchronization module 301 first acquires its own context information.

The context information includes user information of the user.

The context information includes the username and the operable mechanism.

The synchronization module 202 is further configured to set the acquired context information into context information of the database in a current database session.

In a preferred embodiment, the database can be an oracle database.

In a preferred embodiment, the application system can be a J2EE architecture system.

The view creation module 203 is configured to create a data view based on the data table.

In an embodiment, the view creating module 203 is specifically configured to acquire the data table, and use the data table as a base table to perform the data view on the data table by using an organization name/institution coding as a key condition. Create; set the operational properties of the data view.

In a preferred embodiment, the operational attribute can be set to an editable attribute or a read-only attribute.

The display module 204 is configured to display specific data through the data view according to the second context information of the database session.

In an embodiment, the display module 204 is specifically configured to acquire second context information of the database session, and obtain an organization relationship diagram from the database, where the mechanism relationship diagram is used to store affiliation between organizations. Extracting an operable mechanism of the operating user from the second context information; retrieving and displaying corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.

Through the above-mentioned program modules 201-204, the data operation authority isolation program 200 proposed by the present application firstly acquires user information of an operation user currently logged into the application system, and saves the user information to the first context information of the application system. Secondly, the first context information is synchronized to the second context information currently connected to the database session; again, the data view is created based on the data table; finally, according to the second context information of the database session, The data view shows specific data. In this way, the database information can be quickly obtained by the database by setting the context information of the application system to the context information of the current database session. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization.

Referring to FIG. 3, it is a program module diagram of the second embodiment of the data operation authority isolation program 200 of the present application. In this embodiment, the data operation authority isolation program 200 includes a series of computer program instructions stored in the memory 11, and when the computer program instructions are executed by the processor 12, the data operation authority of each embodiment of the present application can be implemented. Isolation operation. In some embodiments, the data manipulation authority isolation program 200 can be divided into one or more modules based on the particular operations implemented by the various portions of the computer program instructions. For example, in FIG. 3, the data operation authority isolation program 200 can be divided into an acquisition module 201, a synchronization module 202, a view creation module 203, a display module 204, and an operation module 205. The program modules 201-204 are the same as the first embodiment of the data operation authority isolation program 200 of the present application, and the operation module 205 is added thereto. among them:

The operation module 205 is configured to determine, according to an operation attribute of the data view, whether to respond to an operation request of the user;

In an embodiment, if the data view is an editable attribute, the operation module 205 responds to the add/delete operation request performed by the user on the base table by using the data view;

In another embodiment, if the data view is a read-only attribute, the operation module 205 rejects the addition, deletion, and deletion operation request performed by the user on the base table by using the data view.

Through the above-mentioned program modules 201-205, the data operation authority isolation program 200 proposed by the present application firstly acquires user information of an operation user currently logged into the application system, and saves the user information to the first context information of the application system. Secondly, the first context information is synchronized to the second context information currently connected to the database session; again, the data view is created based on the data table; secondly, according to the second context information of the database session, The data view displays specific data; finally, it is determined whether to respond to the user's operation request according to the operation attribute of the data view. In this way, the database information can be quickly obtained by the database by setting the context information of the application system to the context information of the current database session. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization. At the same time, by obtaining the operation attribute of the data view, the response or rejection of the operation request issued by the user is realized.

In addition, the present application also proposes a data operation authority isolation method.

Referring to FIG. 4, it is a schematic flowchart of the implementation of the first embodiment of the data operation authority isolation method of the present application. In this embodiment, the order of execution of the steps in the flowchart shown in FIG. 4 may be changed according to different requirements, and some steps may be omitted.

Step S401: Acquire user information of an operation user currently logged into the application system, and save the user information to the first context information of the application system.

In an embodiment, the application system may acquire user information of the user when the user logs in to the application system.

In a preferred embodiment, the user information includes a username and an operable mechanism. The operable mechanism is a departmental institution where the user is currently located. In an embodiment, the mechanism in which the first user is located is A, and the operable mechanism of the first user is A.

In another preferred embodiment, the user information is saved to the first context information of the application system.

Step S402, synchronizing the first context information into the second context information currently connected to the database session.

In this embodiment, when the application system connects to the database, the application system first acquires the first context information of itself. The first context information includes user information of the user. Further, the context information includes the username and the operable mechanism.

The obtained context information is set into the first context information of the database in the current database session.

In a preferred embodiment, the database can be an oracle database. The application system can be a J2EE architecture system.

Step S403, creating a data view based on the data table.

In a preferred embodiment, the step of creating a data view based on the data table further includes:

Obtaining the data table;

Using the data table as a base table, the data table is created by using the organization name/institutional code as a keyword condition;

Setting an operation attribute of the data view, the operation attribute may be set as an editable attribute or a read-only attribute.

The data content in the data table includes data materials under the respective organizations, and the data materials may include customer data, salesperson data, policy information, and attendance data.

In this embodiment, the data view may default to an editable attribute, that is, the addition, deletion, and deletion operations may be performed on the base table by using the data view.

In a preferred embodiment, the data view may be set to a read-only attribute, that is, the data of the data table cannot be added, deleted or changed through the data view.

Step S404, displaying specific data through the data view according to the second context information of the database session.

In this embodiment, the step of displaying the specific data according to the second context information of the database session includes:

The data view acquires second context information of the database session;

Obtaining an institutional relationship map from the database, the institutional relationship map for storing affiliation between the various institutions;

And extracting, from the second context information, an operable mechanism of the operation user. Specifically, the database acquires an organization name/institution number of the operable mechanism of the user by using the context information.

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.

Optionally, the method for establishing the organization chart may include the following steps:

Obtaining institutional information of each institution, where the organization information includes an organization name, an organization number, and a relationship between the upper and lower levels;

Defining the institutional relationship map according to the institution information;

The institution information and the institutional relationship map are saved to the database.

In this embodiment, the data view retrieves and displays corresponding data in the data view according to the organization name/institution number of the user's operable mechanism and the mechanism relationship diagram. In this embodiment, if the operable mechanism of the first user is A, the upper mechanism of the mechanism A is the head office, and the lower mechanism of the mechanism A includes the mechanism B and the mechanism C, and the lower layer of the head office The mechanism may further include a mechanism D, the mechanism B and the mechanism C having no underlying mechanism. At this time, for the first user, the first specific data includes the mechanism A, the mechanism B, and the mechanism C Data.

Through the above steps S401-404, the data operation authority isolation method proposed by the present application firstly acquires the user information of the operation user currently logged into the application system, and saves the user information to the first context information of the application system; Secondly, the first context information is synchronized to the second context information currently connected to the database session; again, the data view is created based on the data table; finally, the data is transmitted according to the second context information of the database session The view shows specific data. In this way, the database information can be quickly obtained by the database by setting the context information of the application system to the context information of the current database session. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization.

Referring to FIG. 5, it is a schematic flowchart of the implementation of the second embodiment of the data operation authority isolation method of the present application. In this embodiment, the order of execution of the steps in the flowchart shown in FIG. 5 may be changed according to different requirements, and some steps may be omitted.

Step S501: Acquire user information of an operation user currently logged into the application system, and save the user information to the first context information of the application system.

Step S502: Synchronize the first context information into the second context information currently connected to the database session.

Step S503, creating a data view based on the data table.

Step S504, displaying specific data through the data view according to the second context information of the database session.

Step S505, determining, according to an operation attribute of the data view, whether to respond to an operation request of the user;

Through the above steps S501-505, the data operation authority isolation method proposed by the present application firstly acquires the user information of the operation user currently logged into the application system, and saves the user information to the first context information of the application system; Secondly, the first context information is synchronized to the second context information currently connected to the database session; again, the data view is created based on the data table; and most, according to the second context information of the database session, The data view displays specific data; finally, it is determined whether to respond to the user's operation request according to the operation attribute of the data view. In this way, the database information can be quickly obtained by the database by setting the context information of the application system to the context information of the current database session. Establishing and preserving the organization relationship diagram in the database, and combining the way of establishing the view through the basic table, realizes displaying different specific data for a specific user having different rights, and achieving data that the user can access the department of the department, or Access to the technical effects of the data of the underlying organization. At the same time, by obtaining the operation attribute of the data view, the response or rejection of the operation request issued by the user is realized.

The following is an example of logging in to the application system by the first user and performing data access to the database as an example:

(1) When the first user logs in to the application system, the current user information of the first user is obtained, and the user information is saved in the first context information of the application system. The mechanism in which the first user is located is A, that is, the operable mechanism of the first user is A. The user operable information of the first user is saved into the first context information of the application system.

(2) When the application system connects to the database, the application system first acquires the first context information of itself. At this time, the first context information includes user information of the first user. Further, the first context information includes a username of the first user and the operable mechanism A. The obtained first context information is set into the second context information of the database in the current database session. Therefore, the second context information includes the user information of the first user, that is, the second context information includes the user name of the first user and the operable mechanism A.

(3) using the data table as a base table, creating the data view on the data table by using an organization name/institutional code as a keyword condition, and setting an operation attribute of the data view, where the operation attribute can be set Is an editable property or a read-only property. The data content in the data table includes data materials under the respective organizations, and the data materials may include customer data, salesperson data, policy information, and attendance data. In this embodiment, the data view may default to an editable attribute, that is, the addition, deletion, and deletion operations may be performed on the base table by using the data view. The data view may also be set to a read-only attribute, that is, the data of the data table cannot be added, deleted or changed through the data view.

(4) acquiring the second context information of the database session, and extracting the operable organization A of the first user from the second context information. Obtaining an institutional relationship diagram of the database, the institutional relationship diagram for storing affiliation between the various institutions. The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.

The serial numbers of the embodiments of the present application are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present application.

The above is only a preferred embodiment of the present application, and is not intended to limit the scope of the patent application, and the equivalent structure or equivalent process transformations made by the specification and the drawings of the present application, or directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of this application.

Claims

A data operation authority isolation method is applied to an application server, and the method includes:

Obtaining user information of an operation user currently logged into the application system, and saving the user information to the first context information of the application system;

Synchronizing the first context information into second context information currently connected to the database session;

Create a data view based on a data table; and

Displaying specific data through the data view according to the second context information of the database session.
The data operation authority isolation method according to claim 1, wherein the step of creating a data view based on the data table further comprises:

Obtaining the data table;

Using the data table as a base table, the data table is created by using the organization name/institutional code as a keyword condition;

Setting an operation attribute of the data view, the operation attribute may be set as an editable attribute or a read-only attribute;

The data content in the data table includes data materials under the respective organizations, and the data materials may include customer data, salesperson data, policy information, and attendance data.
The data operation authority isolation method according to claim 1, wherein the step of displaying the specific data according to the second context information of the database session further includes:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view in accordance with the operational mechanism of the operational user and the institutional relationship map.
The data operation authority isolation method according to claim 2, wherein the step of displaying the specific data according to the second context information of the database session of the data view further comprises:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.
The data operation authority isolation method according to claim 3, wherein the method for establishing the organization structure map comprises the steps of:

Obtaining institutional information of each institution, where the organization information includes an organization name, an organization number, and a relationship between the upper and lower levels;

Defining the institutional relationship map according to the institution information;

The mechanism information and the institutional relationship map are stored in the database.
The data operation authority isolation method according to claim 2, wherein the method further comprises:

Determining whether to respond to the operation request of the user according to an operation attribute of the data view;

And if the data view is an editable attribute, the user is requested to perform an add/delete operation request to the base table by using the data view;

If the data view is a read-only attribute, the user is denied to perform an add/delete operation request to the base table through the data view.
The data operation authority isolation method according to claim 4, wherein the method further comprises:

Determining whether to respond to the operation request of the user according to an operation attribute of the data view;

And if the data view is an editable attribute, responding to the user performing a addition, deletion, and modification operation request on the base table by using the data view;

If the data view is a read-only attribute, the user is denied to perform an add/delete operation request to the base table through the data view.
An application server, comprising: a memory, a processor, wherein the memory stores a data operation authority isolation program executable on the processor, wherein the data operation authority isolation program is The processor implements the following steps when it executes:

Obtaining user information of an operation user currently logged into the application system, and saving the user information to the first context information of the application system;

Synchronizing the first context information into second context information currently connected to the database session;

Create a data view based on a data table; and

Displaying specific data through the data view according to the second context information of the database session.
The application server according to claim 8, wherein in the step of creating a data view based on the data table, when the data operation authority isolation program is executed by the processor, the following steps are further implemented:

Obtaining the data table;

Using the data table as a base table, the data table is created by using the organization name/institutional code as a keyword condition;

Setting an operation attribute of the data view, the operation attribute may be set as an editable attribute or a read-only attribute;

The data content in the data table includes data materials under the respective organizations, and the data materials may include customer data, salesperson data, policy information, and attendance data.
The application server according to claim 8, wherein the data view displays the specific data step according to the second context information of the database session, and specifically includes:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.
The application server according to claim 9, wherein the data view displays the specific data step according to the second context information of the database session, and specifically includes:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.
The application server according to claim 10, wherein the step of establishing the organization chart comprises:

Obtaining institutional information of each institution, where the organization information includes an organization name, an organization number, and a relationship between the upper and lower levels;

Defining the institutional relationship map according to the institution information;

The mechanism information and the institutional relationship map are stored in the database.
The application server according to claim 9, wherein said data operation authority isolation program is further implemented when said processor executes:

Determining whether to respond to the operation request of the user according to an operation attribute of the data view;

And if the data view is an editable attribute, the user is requested to perform an add/delete operation request to the base table by using the data view;

If the data view is a read-only attribute, the user is denied to perform an add/delete operation request to the base table through the data view.
The application server according to claim 11, wherein said data operation authority isolation program is further implemented when said processor executes:

Determining whether to respond to the operation request of the user according to an operation attribute of the data view;

And if the data view is an editable attribute, the user is requested to perform an add/delete operation request to the base table by using the data view;

If the data view is a read-only attribute, the user is denied to perform an add/delete operation request to the base table through the data view.
A computer readable storage medium storing a data operation authority isolation program, the data operation authority isolation program being executable by at least one processor to enable the at least one processor to execute as follows step:

Obtaining user information of an operation user currently logged into the application system, and saving the user information to the first context information of the application system;

Synchronizing the first context information into second context information currently connected to the database session;

Create a data view based on a data table; and

Displaying specific data through the data view according to the second context information of the database session.
The computer readable storage medium according to claim 15, wherein the step of creating a data view based on the data table further comprises:

Obtaining the data table;

Using the data table as a base table, the data table is created by using the organization name/institutional code as a keyword condition;

Setting an operation attribute of the data view, the operation attribute may be set as an editable attribute or a read-only attribute;

The data content in the data table includes data materials under the respective organizations, and the data materials may include customer data, salesperson data, policy information, and attendance data.
The computer readable storage medium according to claim 15, wherein the step of displaying the specific data according to the second context information of the database session of the data view further comprises:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.
The computer readable storage medium according to claim 16, wherein the step of displaying the specific data according to the second context information of the database session of the data view further comprises:

The data view acquires second context information of the database session;

Obtaining an institutional relationship diagram from the database, the institutional relationship diagram for storing affiliation between the various institutions;

Extracting an operable mechanism of the operating user from the second context information;

The data view retrieves and displays corresponding data in the data view according to the operable mechanism of the operating user and the mechanism relationship map.
The computer readable storage medium according to claim 17, wherein the method of establishing the organization chart may include the steps of:

Obtaining institutional information of each institution, where the organization information includes an organization name, an organization number, and a relationship between the upper and lower levels;

Defining the institutional relationship map according to the institution information;

The mechanism information and the institutional relationship map are stored in the database.
The computer readable storage medium of claim 16 wherein said data manipulation authority isolation program is further implemented when said processor is executed:

Determining whether to respond to the operation request of the user according to an operation attribute of the data view;

And if the data view is an editable attribute, responding to the user performing a addition, deletion, and modification operation request on the base table by using the data view;

If the data view is a read-only attribute, the user is denied to perform an add/delete operation request to the base table through the data view.