[go: up one dir, main page]

CN101763260B - Dynamic authorizing method of data based on ITSM system - Google Patents

Dynamic authorizing method of data based on ITSM system Download PDF

Info

Publication number
CN101763260B
CN101763260B CN2009102444449A CN200910244444A CN101763260B CN 101763260 B CN101763260 B CN 101763260B CN 2009102444449 A CN2009102444449 A CN 2009102444449A CN 200910244444 A CN200910244444 A CN 200910244444A CN 101763260 B CN101763260 B CN 101763260B
Authority
CN
China
Prior art keywords
user
resource
relationship
itsm
relationship object
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN2009102444449A
Other languages
Chinese (zh)
Other versions
CN101763260A (en
Inventor
贾庆亮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Shenzhou Taiyue Software Co Ltd
Original Assignee
Beijing Shenzhou Taiyue Software Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Shenzhou Taiyue Software Co Ltd filed Critical Beijing Shenzhou Taiyue Software Co Ltd
Priority to CN2009102444449A priority Critical patent/CN101763260B/en
Publication of CN101763260A publication Critical patent/CN101763260A/en
Application granted granted Critical
Publication of CN101763260B publication Critical patent/CN101763260B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Landscapes

  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a dynamic authorizing method of data based on an ITSM system. A dynamic model is added in a data analyzing center of the ITSM system, and regulation is carried out by a rule-matching algorithm, thus completing dynamic authorization for different users and organizations. The method comprises the following steps of: defining an object of data to be authorized in the ITSM system and establishing an object model; defining the attributes of the object model according to the attributes of the data to be authorized; establishing a relation object of the object and a real organization by giving attribute values to the attributes of the model; granting permission of operating the relation object by a user according to the relation object in S3 selected by the user; and scanning bottom facilities by the ITSM system, obtaining system resources and matching the system resources and the relation object by utilizing the rule-matching algorithm. The method covers ITSM of different industries, and system dynamic authorization for systems of different industries can be realized by simple operations.

Description

Based on ITSM system data dynamic authorization method and system
Technical field
The present invention relates to IT development of information system technical field based on ITSM (IT Service Management) theoretical system, particularly a kind of based on ITSM system data dynamic authorization method and system.
Background technology
ITSM is that a cover helps enterprise to the high-quality method that planning, research and development, enforcement and the operation of IT system manages, be world-leading, one overlap effective theoretical system for what enterprise solved that IT department mechanism changes.
ITSM comprises the content of 4 aspects, be respectively design and management, the exploitation of service and implement, the combining of service running and professional and IT, the complete Life cycle that runs through the IT system application " design, construction, integrated, manage and lifting ".Wherein, design and administrative standard have satisfied design, the construction demand of custom system; Exploitation and implementation criteria have solved the problem of user aspect integrated; Running standard standard pin is for user's regulatory requirement; The professional standard that combines with IT has then satisfied the requirement of Life cycle improvement stage.
The construction of ITSM system has covered different industries such as finance, insurance and telecommunications, and the institutional framework of each industry all is different, because the otherness of industry has caused a puzzlement developer's a difficult problem.The user of different institutional frameworks can check, revises, and the information resources of deletion need be according to the authority dynamic change.
Common way is to add different condition judgment in the software program of appointment, produced simultaneously problem is exactly that a large amount of condition judgment is difficult to safeguard than software itself more, in a single day user's business datum changes simultaneously, and original program is judged the output result who just is easy to produce mistake.
At present, going back the good method of neither one can address the above problem, and original way will greatly improve the implementation cost of ITSM system, even cause the extension and the failure of project.
Summary of the invention
(1) goal of the invention
The purpose of this invention is to provide a kind of based on ITSM system data dynamic authorization method, to realize that at different industries, the business datum of the ITSM system of different flow processs is carried out data grant according to different relations.
(2) summary of the invention
A kind of based on ITSM system data dynamic authorization method, may further comprise the steps:
S1: treat the object of authorization data in the definition ITSM system, and set up object model;
S2: according to the described attribute for the treatment of the attribute definition object model of authorization data;
S3: give property value by attribute, set up the relationship object of described object and actual tissue mechanism to model;
S4:, authorize the authority that the user operates this relationship object according to the relationship object among the user-selected S3;
S5:ITSM system scan bottom facilities, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, then do not filter resource.
Wherein, import the different relationship objects that different property values can be set up the same target model among the described step S3.
Wherein, among the described step S4 if the user has selected a relationship object of same model definition, then the attribute of object be with relation, as if a plurality of relationship objects of having selected same model definition, between then described a plurality of relationship objects be or relation.
Wherein, described step S5 comprises:
S51: when the user initiates operation, ITSM system scan bottom facilities obtains system resource;
S52: obtain the relationship object that the user has by the authority that the user was awarded;
S53: the executing rule matching algorithm, matching system resource and relationship object, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource;
S54: if the match is successful, then carry out the method for relationship object, filter described resource and return the system resource that the user has authority.
Wherein, the rule matching algorithm among the described step S53 is the Sunday method.
Wherein, the rule matching algorithm among the described step S53 is the BM method.
A kind of based on ITSM system data dynamic authorization system, comprising:
The authorization object definition module is used for defining the object that the ITSM system treats authorization data, and sets up object model;
The object model attributes definition module is used for the attribute for the treatment of the attribute definition object model of authorization data according to described;
Relationship object is set up module, is used for giving property value by the attribute to model, sets up the relationship object for the treatment of authorization object and actual tissue mechanism;
The relationship object authorization module is used for authorizing the authority that the user operates this relationship object according to user-selected relationship object;
The relationship object matching module, be used for ITSM system scan bottom facilities, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, resource then do not filtered.
Wherein, described relationship object matching module comprises:
The bottom facilities scan module is used for initiating operation as the user, and ITSM system scan bottom facilities obtains system resource;
The relationship object acquisition module, the authority that is used for being awarded by the user obtains the relationship object that the user has;
The matching algorithm execution module is used for the executing rule matching algorithm, matching system resource and relationship object, and whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource;
ITSM system resource authorization module is used for then carrying out the method for relationship object if the match is successful, filters described resource and returns the system resource that the user has authority.
(3) beneficial effect
The present invention has following beneficial effect:
1, covered the ITSM of different industries, can realize the system dynamics mandate by shirtsleeve operation the system of different industries;
2, utilize model to isolate different organizational structures, the present invention is suitable for the organizational structure of multiple complexity;
3, replace the data grant that a large amount of condition judgment of original usefulness could realize, reduced the complexity of system;
4, a kind of simple and practical algorithm, the effectively scan efficiency of elevator system are proposed.
Description of drawings
Fig. 1 is the ITSM structural drawing that the present invention is based on
Fig. 2 is according to the process flow diagram based on ITSM system data dynamic authorization method of the present invention;
Fig. 3 is according to the object modeling process flow diagram based on ITSM system data dynamic authorization method of the present invention;
Fig. 4 crosses scan database method synoptic diagram single time according to the inquiry string of the employing based on ITSM system data dynamic authorization method of the present invention.
Embodiment
The present invention propose based on ITSM system data dynamic authorization method, be described as follows in conjunction with the accompanying drawings and embodiments.
As shown in Figure 1, be the ITSM system construction drawing that the present invention is based on, typical ITSM model be divided into following which floor:
Client layer, client layer are the interfaces of user's using system, and the employee can file a request to system, and therefrom the existing related data of inquiry is obtained business datum;
Data acquisition, data acquisition mainly are meant and utilize certain methods that business datum is searched for or data mining;
Data analysis center, data analysis center are the cores of model, and it is in charge of and stores user's business datum;
Bottom facilities, bottom facilities is the logical organization that external user and enterprise is coupled together with network, it is the virtual network that is used for system, can use multiple interactive access approach, as management such as the Web page, voice, Web TV, ICQ with compile various dynamic datas, realize providing and collecting of data.
The present invention increases a kind of dynamic model at data analysis center, adjusts by rule matching algorithm simultaneously, finishes the dynamic authorization to different user and different tissues mechanism.Concrete enforcement method as shown in Figure 2, wherein modeling is a core of the present invention, modeling comprises first three steps, i.e. S1, S2 and S3.Fig. 3 is the modeling flow process, is modeled as next step subscriber authorisation configuration information is provided, so the accuracy of guaranteed modeling only could reflect the time of day of business datum exactly.
Treat the object of authorization data in the step S1 definition ITSM system, and set up object model.This relates generally to the width and the degree of depth of system authorization scope.In general, all database tables of operation system and the field object that system says all are to authorize the scope that relate to.Need to prove that in specific implementation process, because the differentiation of different industries, disparity items can be different to the division and the definition of model.When the width of determining to authorize and the degree of depth, the facility personnel should make rational planning for from demand, the IT of enterprise Service Management level and three aspects of operation management cost of the IT of enterprise service.In simple terms, if when the object of authorizing only relates to data-base recording, the enforcement personnel can determine that the object of mandate only is applied in the table object of database.If the object of authorizing relates to the file on the disk, then each file can abstractly be the object of a needs mandate all.Set up object model according to this object, the life cycle of this model must rely on the object of authorizing and produce or destroy.
Step S2 is according to the described attribute for the treatment of the attribute definition object model of authorization data.Generally, the principle that need follow is exactly " smart and few ".If we include a large amount of attributes in model, will strengthen the cost of maintenance of information so undoubtedly.Otherwise, if attribute is very few, through finishing normal Authorized operation.So so-called " smart and few " is exactly to find the equilibrium point that is fit to self-demand.For example, need authorize worker's single object, the attribute of the single pairing entity domains object of worker then, the attribute that needs the model that defines exactly, but need the attribute of definition must corresponding professional implication, the professional attribute of worker's list or department's attribute can be defined as the attribute of model, and the field of the version number of worker's list and status indication etc. and independent of service then need not define.
Step S3 gives property value by the attribute to model, sets up the relationship object of this object and actual tissue mechanism.The definition of relationship object also is a most important step in the data grant.For example, defined the single authorization object of a worker by above step, object has had specialty and department's attribute, two attributes is imported specialty respectively equal wireless, and department equals main office, sets up the relationship object of an authorization object and actual tissue mechanism.Repeat above step,, can set up a plurality of new relationship object of same target model promptly by giving different property values to the attribute of model.
Step S4 authorizes the authority that the user operates this relationship object according to the relationship object among the user-selected S3.In the process of authorizing, the user can select different relationship objects, if the user has selected a relationship object of same model definition, then the attribute of object be with relation, if selected a plurality of relationship objects of same model definition, then between them be or relation.For example, the user has selected worker's single object of wireless specialty and main office in the process of authorizing, and has selected worker's single object of exchange specialty again, and it is single that then the user is authorized to have operate wireless worker professional and main office worker single or the exchange specialty.
ITSM system scan bottom facilities among the step S5, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, then do not filter resource.Specifically comprise: when the user initiates operation, promptly the user of system is when the client layer operating-system resources of ITSM, and ITSM system scan bottom facilities obtains system resource; Obtain the relationship object that the user has by the authority that the user was awarded; The executing rule matching algorithm, matching system resource and relationship object, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if the match is successful, then carry out the method for relationship object, filter described resource and return the system resource that the user has authority.The rule matching algorithm synoptic diagram as shown in Figure 4, before scan database, need be at inquiry string, as finding the object of mandate in SQL or the HQL statement.The original algorithm of searching is to search by violence, in case once coupling is unsuccessful, inquiry string dates back to the next position of former position, and the object character string directly dates back to and begins the place.We can solve this problem by a simple string searching algorithm.Find unmatched the time that the object substring is moved backward, and utilizing, the information of compatible portion moves.For the character of each object substring, next_value, i.e. a next[j are arranged all], it is defined as follows:
Figure GDA0000055285930000071
Wherein, next[j] be the next position that substring moves backward when j character do not match, array a stores the substring character string, and m is the character number of substring.Promptly begin part with the afterbody coupling, if proceeded to some letters when we find the solution pattern string, whether whether we equate just passable with its next_value as long as judge previous letter so, if equate, illustrate that its coupling string has increased by one again, if unequal then continue to recall forward.
Above-mentioned inquiry string is crossed single time scan database method and can be adopted famous Sunday algorithm and BM algorithm to replace, can produce better effect, for example the BM algorithm is to do reverse comparison, and determine amount of movement according to the part of having mated, adopt after tested and the BM algorithm can obviously reduce the number of times of mobile word string.
A kind of based on ITSM system data dynamic authorization system, comprising: the authorization object definition module is used for defining the object that the ITSM system treats authorization data, and sets up object model; The object model attributes definition module is used for the attribute for the treatment of the attribute definition object model of authorization data according to described; Relationship object is set up module, is used for giving property value by the attribute to model, sets up the relationship object for the treatment of authorization object and actual tissue mechanism; The relationship object authorization module is used for authorizing the authority that the user operates this relationship object according to user-selected relationship object; The relationship object matching module, be used for ITSM system scan bottom facilities, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, resource then do not filtered.Wherein, described relationship object matching module comprises: the bottom facilities scan module, be used for initiating operation as the user, and ITSM system scan bottom facilities obtains system resource; The relationship object acquisition module, the authority that is used for being awarded by the user obtains the relationship object that the user has; The matching algorithm execution module is used for the executing rule matching algorithm, matching system resource and relationship object, and whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource; ITSM system resource authorization module is used for then carrying out the method for relationship object if the match is successful, filters described resource and returns the system resource that the user has authority.
Above embodiment only is used to illustrate the present invention; and be not limitation of the present invention; the those of ordinary skill in relevant technologies field; under the situation that does not break away from the spirit and scope of the present invention; can also make various variations and modification; therefore all technical schemes that are equal to also belong to category of the present invention, and scope of patent protection of the present invention should be defined by the claims.

Claims (8)

1. one kind based on ITSM system data dynamic authorization method, it is characterized in that, may further comprise the steps:
S1: treat the object of authorization data in the definition ITSM system, and set up object model;
S2: according to the described attribute for the treatment of the attribute definition object model of authorization data;
S3: give property value by attribute, set up the relationship object of described object and actual tissue mechanism to model;
S4:, authorize the authority that the user operates this relationship object according to the relationship object among the user-selected S3;
S5:ITSM system scan bottom facilities, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, then do not filter resource.
2. as claimed in claim 1ly it is characterized in that the different property value of input can be set up the different relationship objects of same target model among the described step S3 based on ITSM system data dynamic authorization method.
3. as claimed in claim 2 based on ITSM system data dynamic authorization method, it is characterized in that, selected a relationship object of same model definition among the described step S4 as if the user, then the attribute of object be with relation, if selected a plurality of relationship objects of same model definition, between then described a plurality of relationship objects be or relation.
4. as claimed in claim 1 based on ITSM system data dynamic authorization method, it is characterized in that described step S5 comprises:
S51: when the user initiates operation, ITSM system scan bottom facilities obtains system resource;
S52: obtain the relationship object that the user has by the authority that the user was awarded;
S53: the executing rule matching algorithm, matching system resource and relationship object, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource;
S54: if the match is successful, then carry out the method for relationship object, filter described resource and return the system resource that the user has authority.
5. as claimed in claim 4ly it is characterized in that based on ITSM system data dynamic authorization method the rule matching algorithm among the described step S53 is the Sunday method.
6. as claimed in claim 4ly it is characterized in that based on ITSM system data dynamic authorization method the rule matching algorithm among the described step S53 is the BM method.
7. one kind based on ITSM system data dynamic authorization system, it is characterized in that, comprising:
The authorization object definition module is used for defining the object that the ITSM system treats authorization data, and sets up object model;
The object model attributes definition module is used for the attribute for the treatment of the attribute definition object model of authorization data according to described;
Relationship object is set up module, is used for giving property value by the attribute to model, sets up the relationship object for the treatment of authorization object and actual tissue mechanism;
The relationship object authorization module is used for authorizing the authority that the user operates this relationship object according to user-selected relationship object;
The relationship object matching module, be used for ITSM system scan bottom facilities, obtain system resource, utilize rule matching algorithm, whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource, if, then carry out the method in the relationship object, filter resource and return described resource to the user, otherwise, resource then do not filtered.
8. as claimed in claim 7ly it is characterized in that based on ITSM system data dynamic authorization system described relationship object matching module comprises:
The bottom facilities scan module is used for initiating operation as the user, and ITSM system scan bottom facilities obtains system resource;
The relationship object acquisition module, the authority that is used for being awarded by the user obtains the relationship object that the user has;
The matching algorithm execution module is used for the executing rule matching algorithm, matching system resource and relationship object, and whether the relationship object that the comparison user has authority is included in the inquiry string of described system resource;
ITSM system resource authorization module is used for then carrying out the method for relationship object if the match is successful, filters described resource and returns the system resource that the user has authority.
CN2009102444449A 2009-12-31 2009-12-31 Dynamic authorizing method of data based on ITSM system Active CN101763260B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2009102444449A CN101763260B (en) 2009-12-31 2009-12-31 Dynamic authorizing method of data based on ITSM system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2009102444449A CN101763260B (en) 2009-12-31 2009-12-31 Dynamic authorizing method of data based on ITSM system

Publications (2)

Publication Number Publication Date
CN101763260A CN101763260A (en) 2010-06-30
CN101763260B true CN101763260B (en) 2011-07-27

Family

ID=42494432

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2009102444449A Active CN101763260B (en) 2009-12-31 2009-12-31 Dynamic authorizing method of data based on ITSM system

Country Status (1)

Country Link
CN (1) CN101763260B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104050411A (en) * 2011-04-21 2014-09-17 北京奇虎科技有限公司 Active defense method
DE102019108049A1 (en) * 2019-03-28 2020-10-01 Pilz Gmbh & Co. Kg Access control system for controlling a user's access to one or more operating functions of a technical system
CN112069303B (en) * 2020-09-17 2022-08-16 四川长虹电器股份有限公司 Matching search method and device for character strings and terminal
CN114003215A (en) * 2021-09-29 2022-02-01 欧冶云商股份有限公司 Dynamic data authorization method, medium and equipment based on visualization rule configuration

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030055804A1 (en) * 2001-09-14 2003-03-20 Labutte Brian Method and system for generating management solutions
US20080005197A1 (en) * 2006-06-29 2008-01-03 Kyusun Chang Dynamic report mapping apparatus to physical data source when creating report definitions for information technology service management reporting for peruse of report definition transparency and reuse
CN101329629A (en) * 2008-07-22 2008-12-24 中国科学院计算技术研究所 A business-level service information management method, device and system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030055804A1 (en) * 2001-09-14 2003-03-20 Labutte Brian Method and system for generating management solutions
US20080005197A1 (en) * 2006-06-29 2008-01-03 Kyusun Chang Dynamic report mapping apparatus to physical data source when creating report definitions for information technology service management reporting for peruse of report definition transparency and reuse
CN101329629A (en) * 2008-07-22 2008-12-24 中国科学院计算技术研究所 A business-level service information management method, device and system

Also Published As

Publication number Publication date
CN101763260A (en) 2010-06-30

Similar Documents

Publication Publication Date Title
Ryu et al. A data quality management maturity model
US7379934B1 (en) Data mapping
CN100375971C (en) System and method for hierarchical layout specialization
US9710529B2 (en) Data construction for extract, transform and load operations for a database
US20190087457A1 (en) Function semantic based partition-wise sql execution and partition pruning
EP3956778A1 (en) User interface for building a data privacy pipeline and contractual agreement to share data
CN101930443A (en) Data service system and data service realization method
CN105912949A (en) Data permission management method, data permission management system and service management system
CN102349050A (en) Datastore Creation
CN103179126A (en) Access control method and device
US11971909B2 (en) Data processing system with manipulation of logical dataset groups
US20210081453A1 (en) Autonomously partitioning database tables
CN101625738A (en) Method and device for generating context-aware universal workflow application
CN101546311A (en) Data processing method and data processing device for recycle bin
CN101763260B (en) Dynamic authorizing method of data based on ITSM system
CN112506892A (en) Index traceability management system based on metadata technology
CN111079131A (en) Method and system for authorization and control of authority of cross-company service
US20100114897A1 (en) Indexing and searching a network of multi-faceted entity data
CN113919680A (en) Method for constructing management information system based on general tasks
CN110968851A (en) Service authority control method, service authority control system and computer readable medium
CN105653830A (en) Data analysis method based on model driving
CN103365923A (en) Method and device for assessing partition schemes of database
US20120110011A1 (en) Managing application access on a computing device
US20100070763A1 (en) Declarative data security for a rapid application development tool component
KR20210039533A (en) Method and system for recommending SQL query

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CP02 Change in the address of a patent holder

Address after: Room 818, 8 / F, 34 Haidian Street, Haidian District, Beijing 100080

Patentee after: BEIJING ULTRAPOWER SOFTWARE Co.,Ltd.

Address before: No. 28 building, 100089 Beijing Wanliu new city Haidian District wanquanzhuang Road 5 layer

Patentee before: BEIJING ULTRAPOWER SOFTWARE Co.,Ltd.

CP02 Change in the address of a patent holder