CN115689135A - Role allocation method, device, computer equipment and storage medium - Google Patents

Abstract

The application discloses a role distribution method, a role distribution device, computer equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: in response to a selection operation on a first candidate role in the set of candidate roles, adding the first candidate role to the set of selected roles; determining target roles in the candidate role sets based on the selected role sets and the risk role sets, wherein the objects having all roles in the risk role sets have responsibility separation risks, and at least one risk role set exists and is a subset of the selected role sets after the target roles are added; removing the first candidate role and the target role from the candidate role set; in response to a confirmation operation on the selected set of characters, a role assignment is made based on the selected set of characters. By adopting the method provided by the embodiment of the application, the distributed system roles can meet the management requirement of role separation, and the role distribution efficiency is improved.

Description

Role allocation method, device, computer equipment and storage medium

technical field

The embodiments of the present application relate to the technical field of computers, and in particular, to a role assignment method, device, computer equipment, and storage medium.

Background technique

Role assignment is used for information system management. Users are usually assigned specified roles according to their job responsibilities or functions. Different roles have different information management permissions. Separation of duties is an important principle followed by the internal control management of enterprises. It requires different Compatible positions are separated from each other, reasonable setting of jobs in the enterprise, clear responsibilities and authorities, and forming a mutual check and balance mechanism.

In related technologies, special permission checking tools are usually used to check the risk of separation of duties. When assigning system roles, administrators need to adjust and assign specific roles multiple times according to management requirements, and repeatedly perform risk checks to verify whether the assigned system roles meet the requirements. Management requirements for separation of duties.

Contents of the invention

Embodiments of the present application provide a role allocation method, device, computer equipment, and storage medium. The technical scheme provided by the embodiments of the present application is as follows:

On the one hand, an embodiment of the present application provides a role assignment method, the method includes:

In response to a selection operation on a first candidate role in the set of candidate roles, adding the first candidate role to the set of selected roles;

Determine a target role in the candidate role set based on the selected role set and the risk role set, wherein there is a risk of separation of duties for an object having each role in the risk role set, and there is at least one of the risk roles The set is a subset of the selected role set after adding the target role;

removing the first candidate role and the target role from the set of candidate roles;

In response to the confirmation operation on the selected role set, role allocation is performed based on the selected role set.

On the other hand, an embodiment of the present application provides a device for assigning roles, which includes:

An adding module, configured to add the candidate role to the selected role set in response to a selection operation on the first candidate role in the candidate role set;

The first determination module is configured to determine a target role in the candidate role set based on the selected role set and the risk role set, wherein there is a risk of separation of duties for an object having each role in the risk role set, and There is at least one risk role set that is a subset of the selected role set after adding the target role;

A first removing module, configured to remove the first candidate role and the target role from the set of candidate roles;

A role allocation module, configured to perform role allocation based on the selected role set in response to the confirmation operation on the selected role set.

On the other hand, an embodiment of the present application provides a computer device, the computer device includes a processor and a memory, at least one program is stored in the memory, at least one program is loaded and executed by the processor to implement the role assignment method provided by the above aspect .

On the other hand, the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores at least one instruction, and the at least one instruction is used to be executed by a processor to implement the role assignment method provided in the above aspect.

On the other hand, an embodiment of the present application provides a computer program product or computer program, where the computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the role assignment method provided in the above aspects.

The beneficial effects brought by the technical solutions provided by the embodiments of the present application at least include:

In this embodiment of the application, when assigning roles, the first candidate role can be selected through the candidate set, and the first candidate role can be added to the selected role set; then the candidate role can be determined based on the selected role set and the risk role set The target role in the set, because the combination of the target role and the selected role set will create a risk of separation of duties, so after the target role and the first candidate role are removed from the candidate role set, the selected role set will not Risk of segregation of duties. Compared with the way of assigning roles first and then verifying risks in the prior art, it can reduce the number of manual risk verifications and improve the efficiency of role assignment.

Description of drawings

FIG. 1 shows a flowchart of a method for assigning roles provided in an exemplary embodiment of the present application;

Fig. 2 is a schematic diagram of adding a first candidate role shown in an exemplary embodiment of the present application;

FIG. 3 shows a flowchart of a method for assigning roles provided in another exemplary embodiment of the present application;

Fig. 4 is an interface diagram showing a role assignment interface shown in an exemplary embodiment of the present application;

Fig. 5 is a schematic diagram of generating a set of characters to be checked according to an exemplary embodiment of the present application;

FIG. 6 shows a flow chart of a method for assigning roles provided in another exemplary embodiment of the present application;

Fig. 7 is a schematic diagram of determining a set of functions shown in an exemplary embodiment of the present application;

Fig. 8 is a schematic diagram of determining a risk role set according to an exemplary embodiment of the present application;

FIG. 9 is a schematic diagram of an interface for updating a candidate role set according to an exemplary embodiment of the present application;

Fig. 10 is a schematic diagram of an interface showing prompt information according to an exemplary embodiment of the present application;

Fig. 11 shows a flow chart of a role allocation method provided by another exemplary embodiment of the present application;

Fig. 12 is a schematic diagram of an interface for removing a selected character shown in an exemplary embodiment of the present application;

Fig. 13 shows a schematic diagram of the principle of a method for assigning roles provided by another exemplary embodiment of the present application;

Fig. 14 shows a structural block diagram of an apparatus for assigning roles according to an exemplary embodiment of the present application;

Fig. 15 shows a structural block diagram of a computer device shown in an exemplary embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings.

For the convenience of understanding, the nouns involved in the embodiments of the present application are described below.

Separation of responsibilities: Separation of responsibilities refers to the mutual separation mechanism of responsibilities and authorities among various business departments and business operators of the enterprise. To ensure that user accounts with different job responsibilities or business functions have their own corresponding operation functions, and avoid certain related responsibilities being concentrated on the same user account at the same time, resulting in increased business error rates and fraud.

In related technologies, enterprise managers usually assign fixed roles according to users' positions, but for information systems with a large system, more business departments and users are often involved, and the same position may also have different business divisions. There may be a risk of separation of duties between different user accounts. Therefore, it is necessary to use a special permission checking tool to check the risk of separation of duties on user accounts that have been assigned roles. Moreover, the permission checking tool can only perform risk checks on user accounts that have been assigned roles, but cannot manage risks. The administrator cannot ensure that there will be no risk of role separation when assigning roles. If risks are detected after assignment, the role assignment needs to be performed again to ensure that the system roles assigned to user accounts will not have the risk of separation of duties. The role assignment is not efficient.

According to the solution provided by the embodiment of this application, when assigning roles, the administrator does not need to manually verify the risks of the created objects through the risk inspection tool multiple times, but automatically selects the specific system roles through the role assignment system. Filter the system roles that cause the risk of separation of duties to ensure that the system roles selected in the candidate role set can meet the management requirements of separation of duties, so the efficiency of role assignment is higher.

Fig. 1 is a flowchart of a role assignment method provided in an exemplary embodiment of the present application, the method including:

Step 101, in response to a selection operation on the first candidate character in the set of candidate roles, add the first candidate character to the set of selected roles.

When it is necessary to assign a corresponding operation authority to a user account, it is first necessary to obtain a candidate set in the role allocation system, and the candidate set includes a first candidate role for an administrator to select. The administrator can select the first candidate role from the candidate role set according to the job responsibilities of users who need to assign roles or the business functions that need to be performed. When receiving the selection operation for the first candidate role in the candidate set, the corresponding No. A candidate role is added to the set of selected roles. The selected role set is a set of selected roles, and the selected role set and the candidate role set are two different sets in content.

Schematically, as shown in FIG. 2 , the first candidate role 211 for the administrator to select is displayed in the candidate role set 210 , and the selected role 221 is displayed in the selected role set 220 . After the first candidate role 211 is selected, the first candidate role 211 is added to the selected role set 220 .

Step 102, based on the selected role set and the risk role set, determine the target role in the candidate role set, wherein the object with each role in the risk role set has a risk of separation of duties, and there is at least one risk role set that is to add the target role A subset of the selected character collection after.

When adding the first candidate role to the selected role set, the role allocation system will also obtain a risk role set, which is a set of all roles that may have the risk of separation of duties output after risk inspection. When the role allocation system includes When there are many system roles, there can be multiple risk role sets, and each risk role set consists of at least one system role, and the combination of various system roles in the risk role set has the risk of separation of duties.

Since the method of assigning roles first and then performing risk verification needs to be repeated multiple times, the allocation efficiency is low. Therefore, after adding the first candidate set to the selected role set, according to the selected role set and the risk role set, Determine the target role from the set of candidate roles. The combination of the target role and the selected role set contains at least one risk role set, that is, the combination of the target role and the selected role set contains the risk role set, which means that the target role and the selected role set are combined In the end, there will be a risk of separation of duties, and it is also an object that should be excluded in the subsequent selection.

Step 103, removing the first candidate role and the target role from the set of candidate roles.

Since adding the target role to the selected role set will cause a risk of separation of duties, after the target role set is determined, the target role set is removed from the candidate role set. In addition, since the first candidate role set has been added to the selected role set, in order to avoid subsequent repeated selection, the selected first candidate role needs to be removed from the candidate role set at the same time.

Step 104, in response to the confirmation operation on the selected role set, role allocation is performed based on the selected role set.

When the selected role added in the selected role set cannot realize the corresponding business function or does not have the corresponding operation authority, it is necessary to continue to add the selected role to the selected role set until the added selected role can realize Corresponding business functions or corresponding operation authority. Then, after receiving the confirmation operation of the selected role set, the role assignment is performed based on the selected role set, and the user account that has obtained the role assignment can only realize the business functions limited by the selected role set, and there will be no operation behavior of unauthorized management , and the system role assigned to the user account complies with the principle of separation of duties.

To sum up, in the embodiment of this application, when assigning roles, the first candidate role can be selected through the candidate set, and the first candidate role can be added to the selected role set; then based on the selected role set and the risk role The set determines the target role in the candidate role set. Because the combination of the target role and the selected role set will cause the risk of separation of duties, after the target role and the first candidate role are removed from the candidate role set, the subsequent selection has been completed. Selecting a set of roles does not create a separation of duties risk. Compared with the way of assigning roles first and then verifying risks in the prior art, it can reduce the number of manual risk verifications and improve the efficiency of role assignment.

Fig. 3 is a flow chart of a role assignment method provided by another exemplary embodiment of the present application, the method includes the following steps:

Step 301 , displaying a role allocation interface. The role allocation interface displays a set of candidate roles, a set of selected roles, and a role selection control. The role selection control is used to add the first candidate role in the set of candidate roles to the set of selected roles.

When the administrator needs to assign roles to user accounts, he can log in to the role assignment system and display a role assignment interface through the role assignment system. The role assignment interface displays a set of candidate roles, a set of selected roles, and a role selection control. Among them, the selected roles added by the administrator are displayed in the selected role collection, and the first candidate roles that can be selected are displayed in the candidate role collection. In addition, a role selection control is also displayed in the role selection interface, and the role selection control Used to add the selected first candidate role to the selected role set.

Schematically, as shown in Figure 4, in the role assignment interface, the first candidate role 411 is displayed in the candidate role set 410, and the corresponding role selection control 412 is displayed in the upper right corner of the first candidate role 411, and the administrator can check the Selecting the role selection control 412 selects the corresponding first candidate role 411 . In addition, a role allocation control 430 is also displayed in the role allocation interface, and the user account that needs to be assigned a role is displayed in the role allocation control 430 . In addition, the role assignment interface also displays an authority checking control 440, which can query the assigned system roles of corresponding user accounts, and also facilitates the reassignment of system roles during business adjustments.

Step 302: Add the first candidate character to the selected role set in response to a trigger operation on the role selection control corresponding to the first candidate role in the selected role set.

Candidate role set 410 as shown in FIG. All selected roles in set 420 are added from candidate role set 410 .

In another possible implementation manner, the first candidate role in the selected role set and the candidate role set in the selected role set is displayed in an enumerated manner, but when the content of the candidate set is too large to be fully displayed, you can Display by drop-down list or search, such as setting a search box in the candidate role set, displaying the first candidate role according to the input search content, and then adding the first candidate role to the selected role set by triggering an operation.

It should be noted that when the first candidate role added by the administrator to the selected role set is the first added object, the content contained in the candidate role set is all system roles. When the first candidate role is not the first When an object is added, the candidate role set contains the first candidate role that can be combined with the selected role set, and the combined selected role set will not have the risk of separation of duties.

Step 303: Combine the second candidate character in the candidate character set with the selected character set to obtain a character set to be checked. The second candidate character is different from the first candidate character.

After adding the first candidate set to the selected role set, it is necessary to verify the second candidate role in the candidate role set except the first candidate role, combine the second candidate role with the selected role set, and obtain the pending Role set, when there are many second candidate roles, combine each second candidate role with the selected role set to obtain multiple sets of roles to be checked, and store multiple sets of roles to be checked in the form of a list , where the set of roles to be checked is a set that requires separation of duties risk verification.

Schematically, as shown in FIG. 5 , for the convenience of description, the contents of the complete set of system roles are role 01 to role 07, role 04 is the first candidate role 511 added to the selected role set 510, and the candidate role set 520 The second candidate role 521 in is the other six system roles except role 04, and each second candidate role 521 is combined with the selected role set 520 respectively to form a checklist role set list 530, the checklist role The set list 530 contains six combined sets 531 of characters to be checked.

In step 304, risk verification is performed on the set of candidate roles based on the set of risk roles, and a target role in the set of candidate roles is determined. The combination of the target role and the set of selected roles has a risk of separation of duties.

After the selected role set is combined with the second candidate role set to generate the role set to be checked, risk verification needs to be performed on each role set to be checked, which is different from the previous method of role assignment and risk check after all required system roles are selected Different, when the first candidate role is added to the selected role set, risk verification will be automatically performed on the pending role set according to the risk role set, and the target role in the candidate role set will be screened out. The combination of the target role and the selected role set There is a segregation of duties risk, that is, the collection of pending roles that includes the target role creates a segregation of duties risk. Among them, the risk role set is a set obtained by combining all system roles according to the principle of separation of duties, and it is also a set of roles that cannot be selected when assigning roles. As shown in FIG. 6 , the process of obtaining a set of risk roles and determining a target role includes the following steps.

Step 304A, obtain a set of risk roles, and compare the set of roles to be checked with the set of risk roles.

After obtaining the set of roles to be checked, it is also necessary to obtain the set of risk roles, which can obtain all possible risk role sets through risk inspection before performing role assignment.

Schematically, as shown in Figure 4, the role allocation interface displays a risk check control 450. When the administrator clicks the risk check control 450, the role allocation system will obtain the complete set of system roles, and determine all possible responsibilities according to the principle of separation of duties. Set of risk roles for separation principles. Among them, the principle of obtaining the set of risk roles includes the following steps:

1. Obtain the system roles in the role allocation system, and generate a function set according to the business functions or business permissions. The system roles included in the function set are used to realize the corresponding business functions or business permissions.

When performing risk checks, the role assignment system will first obtain the complete set of system roles, which includes all system roles. Since system roles are the most basic part of role assignment, each system role is endowed with specific functional permissions. When combining system roles, it is necessary to construct a function set according to specific functions, so as to avoid forming an invalid set and failing to realize specific functions.

Schematically, as shown in FIG. 7 , roles 01 and 02 represent the browsing and editing rights to tables, and roles 03 and 04 represent the browsing and editing rights to videos. Then, when combining role function sets, role 01 and role 02 form the first function set 701, which is used to realize browsing and editing operations on tables; role 03 and role 04 form the second function set 702, which is used to realize browsing and editing of videos operate. The combination of role 01 and role 03 cannot realize any operation on the form or video, which is an invalid combination. The same reason is also an invalid combination for role 02 and role 04.

Combining function sets according to specific business functions can reduce the number of role sets, effectively reduce the amount of data calculations, and improve the accuracy of checks when performing risk checks.

2. According to the principle of segregation of duties, determine the risk role set whose function set constitutes the risk of segregation of duties.

From the above content, we can see that different function sets are used to realize the corresponding business functions, but for some business functions with related responsibilities, if they are not separated, the business error rate and fraud will increase or decrease.

Schematically, as shown in Figure 8, the third function set 801 represents the business function of making bills, and the fourth function set 802 represents the business function of bill remittance. Therefore, the combination of the third function set 801 and the fourth function set 802 constitutes a risk role set 810. When assigning roles, when a certain user account is simultaneously assigned to roles 11 to 14 At the same time, it has the authority to make bills and remittances at the same time, and the concentration of authority occurs in the business, which violates the principle of separation of duties.

According to the principle of segregation of duties, risk checks are performed on all function sets, and a risk role set is determined based on at least two related function sets until all risk role sets that may cause the risk of separation of duties are obtained and stored in the list of risk role sets. Administrators can view all risk role sets and risk types by calling the list of risk role sets.

Step 304B, in response to the fact that the set of risky roles is a subset of the set of characters to be checked, determine the second candidate role in the set of roles to be checked as the target role.

After obtaining the risk role set, compare each risk role set in the risk set list with the combination of the role sets to be checked. When there is a risk role set in the risk set list that is a subset of the role set to be checked, then The second candidate character forming the set of characters to be checked is determined as the target character.

Schematically, as shown in FIG. 5 , the risk role set list 540 contains four risk role sets 541 in total, and each risk role set and each waiting role set in the waiting set list 530 are combined with the waiting role set Each set of unchecked roles 531 in the list 530 is compared, and finally two sets of unchecked roles 531 and risky role sets 541 are determined to have the same content, that is, the set of unchecked roles composed of role 04 and role 05 and the set of unchecked roles composed of role 04 and role There is a risk of separation of duties in the set of roles to be inspected composed of 07. Character 05 and Character 07 are the target characters.

It should be noted that when it is determined that the set of risky roles is a subset of the set of roles to be checked, the target role that will cause the risk of separation of duties is determined; if the set of roles without risk is a subset of the set of roles to be checked, then There is no target role satisfying the risk of separation of duties in the set of candidate roles, therefore, after step 304A, step 304C may also be included.

Step 304C, in response to the fact that the set of risky roles is not a subset of the set of to-be-checked roles, remove the first candidate role from the set of candidate roles.

When all risk role sets in the risk role set list are not a subset of the combination of roles to be checked, it means that the role set to be checked composed of the second candidate role in the candidate role set and the selected role set does not constitute a separation of duties risk, that is, it does not There is a target role, and at this point, it is only necessary to remove the first candidate role from the set of candidate roles.

Step 305, removing the first candidate role and the target role from the set of candidate roles.

After the target role is determined from the second candidate roles, the target role and the first candidate role need to be removed from the candidate role set.

Schematically, as shown in FIG. 9 , after the target role is determined, the set of candidate roles 910 needs to be updated once, and the first candidate role and the target role are removed from the mutually selected roles, and are included in the set of candidate roles 910 Displays the remaining available roles.

In step 304, when it is determined that all the second candidate characters in the candidate character set are target characters, the candidate role set after removing the first candidate character and the target character is an empty set. At this time, prompt information may be displayed in the candidate role set area, and the prompt information is used to indicate that there is no optional role satisfying the business function or business authority in the candidate role set.

Schematically, as shown in FIG. 10, role 02, role 04, and role 06 are added to the selected role set 1010. At this time, the candidate role set 1020 is an empty set, and a prompt in the form of "can no longer be selected!" is displayed. The information 1021 indicates that there is no optional role satisfying the business function or business authority in the candidate role set 1020 .

In a possible implementation, after the target role is determined, it can be moved into the non-selectable role set, and the administrator can view the roles to be checked that constitute the separation of duties risk and the corresponding risk type through the non-selectable role set.

Step 306, in response to the confirmation operation on the selected role set, perform role assignment based on the selected role set.

When the confirmation operation on the selected role is received, it means that the selected role in the selected role set can realize the required business function, and then role assignment can be performed based on the selected role set.

As shown in FIG. 4 , after the selected roles added in the selected role set 420 can realize the required business functions, the roles are allocated to the designated user accounts by clicking the role determination control 431 .

In this embodiment of the application, when it is necessary to assign roles to user accounts, the selected first candidate role is added to the selected role set, and the second candidate role in the candidate role set is combined with the selected role set , to obtain the set of roles to be checked, so as to compare the set of risk roles with the set of roles to be checked, and determine the target role that will cause the risk of separation of duties;

Since the combination of the target role and the selected role set creates a risk of separation of duties, after the target role and the first candidate role are removed from the set of candidate roles, they can continue to be selected from the set of candidate roles without risk of separation of duties , and then perform role assignment based on the selected role set after receiving the confirmation operation on role assignment. Compared with the previous method of directly assigning roles and then performing risk verification, this solution does not need to repeatedly assign roles, and the efficiency of role assignment is higher.

In the above embodiment, after the user selects the first candidate role, the first candidate role will be directly added to the selected role set, and the candidate role set will be updated once, but in actual operation, misoperation may occur In this case, the corresponding selected role in the selected role set needs to be deleted and reselected from the candidate role set. Therefore, a role deletion control can be set in the selected role set to delete the specified selected role and update the candidate role set. As shown in Figure 11, after step 305, the following steps may also be included:

Step 307, receiving a selection operation on the character deletion control, and removing the selected selected character from the selected character set.

For the selected role in the selected role set, in order to remove the selected role conveniently, you can add a role delete control on the selected role. Remove the specified optional role without clearing the selected role set and re-selecting it. In contrast, the efficiency of role allocation can be further improved.

As shown in Figure 12, a role deletion control 1211 is set on the role 04 in the selected role set 1210. When the administrator needs to delete the role 04, by clicking the corresponding role deletion control 1211, the role 04 is removed from the selected role set 1210. removed from the .

Step 308, adding the removed selected role to the candidate role set, and updating the candidate role set based on the selected role set and the risk role set after the selected role is removed.

After removing the selected character, add the selected character back to the candidate character collection. In addition, since the selected character is added to the selected character collection, the corresponding target character will also be removed from the candidate character collection , therefore, while re-adding the selected role, it is also necessary to add the removed target role to the set of candidate roles. Here, the target role may be determined and updated based on the set of selected roles after the selected role is removed and the set of risky roles to update the set of candidate roles.

In addition, it can be known from the above step 305 that after the target character is determined, the first candidate character and the target character will be removed from the set of candidate characters, but in order to facilitate timely determination of the removed target character in this step, you can In the process of step 305 , the target role set is set, the removed candidate roles are moved into the target role set, and the target role is stored in association with the first candidate role added to the selected role set. When removing an optional character, directly select the corresponding target character from the target character set, and re-add it to the selected character set.

As shown in FIG. 12 , after the character 04 in the selected character set 1210 is removed, the character 04 is added to the candidate character set 1220 , and the removed target character is re-added to the candidate character set 1220 .

Step 309, in response to the confirmation operation on the selected role set, perform role assignment based on the selected role set.

For the implementation manner of this step, reference may be made to step 306, and details are not described here in this embodiment.

In the implementation example of this application, by setting the role deletion control on the selected role, the selected role specified in the selected role set can be moved back into the candidate role set, and at the same time, by setting the target role set, the removed character can be promptly removed The target role is moved back into the set of candidate roles. Compared with the method of clearing the selected role collection when misoperation, the efficiency of role assignment can be further improved.

The specific process of assigning roles in the above embodiment will be described below with reference to specific cases. FIG. 13 shows a schematic diagram of a method for assigning roles provided by an exemplary embodiment of the present application.

In the first stage, role 04 is added to the selected role set, and it can be determined that the risk role set composed of role 04 and role 05 and the risk role set composed of role 04 and role 07 are two to-be-checked role set lists. Then, character 04 and character 07 are determined as target characters and removed from the candidate role set. The updated candidate role set includes character 01, character 02, character 03 and character 06.

In the second stage, continue to add role 06 to the selected role set. There is no risk role set in the risk role set list. The risk role set is a subset of the role set to be checked, so there is no target role, and only need to add role 06 from the candidate role can be removed from the collection.

In the third stage, continue to add character 02 to the selected character set, similar to the second stage, only need to remove character 02 from the candidate role set, at this time, the candidate role set contains character 01 and character 02. If the selected role set can realize the required business functions, user accounts can be assigned roles. If the required business functions cannot be realized, continue to execute the fourth stage.

In the fourth stage, continue to add role 01 to the selected role set, because the risk role set composed of role 01, role 02 and role 03 in the risk role set list is a subset of the role set to be checked, then determine role 03 is the target role, and is removed from the candidate role set. The candidate role set after removing role 03 and role 01 is an empty set, corresponding to the prompt information displayed on the role assignment interface. If the selected role set can already realize the If required business functions are required, roles can be assigned to user accounts.

Referring to FIG. 14 , it shows a structural block diagram of an apparatus for assigning roles provided by an embodiment of the present application.

The unit includes:

Adding module 1401, configured to add the candidate role to the selected role set in response to a selection operation on the first candidate role in the candidate role set;

The first determining module 1402 is configured to determine a target role in the candidate role set based on the selected role set and the risk role set, wherein there is a risk of separation of duties for an object having each role in the risk role set at the same time, And there is at least one risk role set that is a subset of the selected role set after adding the target role;

A first removing module 1403, configured to remove the first candidate role and the target role from the set of candidate roles;

A role allocation module 1404, configured to perform role allocation based on the selected role set in response to the confirmation operation on the selected role set.

Optionally, the first determining module 1402 includes:

A first acquiring unit, configured to combine a second candidate character in the set of candidate characters with the set of selected characters to obtain a set of characters to be checked, where the second candidate character is different from the first candidate character;

A determination unit, configured to perform risk verification on the set of roles to be checked based on the set of risk roles, determine the target role in the set of candidate roles, and the combination of the target role and the set of selected roles has responsibilities Separate risk.

Optionally, the determining unit is used for:

Obtaining the set of risk roles, and comparing the set of roles to be checked with the set of risk roles;

In response to the fact that the set of risk roles is a subset of the set of roles to be checked, the second candidate role in the set of roles to be checked is determined as the target role.

Optionally, the device also includes:

A second removing module is configured to remove the first candidate role from the set of candidate roles in response to the fact that the set of risk roles is not a subset of the set of roles to be checked.

Optionally, the device also includes:

The second acquisition module is used to acquire system roles in the role assignment system, and generate a function set according to business functions or business permissions, and the system roles included in the function set are used to realize corresponding business functions or business permissions;

The second determination module is configured to determine the set of risk roles for which the set of functions constitutes a risk of separation of duties according to the principle of separation of duties.

Optionally, the device also includes:

A display module, configured to display a role allocation interface, where the candidate role set, the selected role set, and a role selection control are displayed on the role allocation interface, and the role selection control is used to select the candidate role set from the candidate role set. The first candidate role is added to the set of selected roles;

The adding module 1401 includes:

An adding unit, configured to add the first candidate character to the selected character set in response to a trigger operation that the first candidate character in the selected character set corresponds to the character selection control;

Optionally, the device also includes:

A prompt module, configured to display prompt information in response to the set of candidate roles being an empty set, the prompt information being used to indicate that there is no optional role that satisfies business functions or business permissions in the set of candidate roles.

The role assignment interface displays a role deletion control, and the role deletion control is used to delete the selected role in the selected role set;

The device also includes:

A deletion module, configured to receive a selection operation on the character deletion control, and remove the selected selected character from the selected character set;

An update module, configured to re-add the removed selected role to the candidate role set, and update the candidate based on the selected role set and the risk role set after the selected role is removed A collection of characters.

In this embodiment of the application, when it is necessary to assign roles to user accounts, the selected first candidate role is added to the selected role set, and the second candidate role in the candidate role set is combined with the selected role set , to obtain the set of roles to be checked, so as to compare the set of risk roles with the set of roles to be checked, and determine the target role that will cause the risk of separation of duties;

Since the combination of the target role and the selected role set creates a risk of separation of duties, after the target role and the first candidate role are removed from the set of candidate roles, they can continue to be selected from the set of candidate roles without risk of separation of duties , and then perform role assignment based on the selected role set after receiving the confirmation operation on role assignment. Compared with the previous method of directly assigning roles and then performing risk verification, this solution does not need to repeatedly assign roles, and the efficiency of role assignment is higher.

Please refer to FIG. 15 , which shows a schematic structural diagram of a computer device provided by an exemplary embodiment of the present application. Specifically: the computer device includes a central processing unit (Central Processing Unit, CPU) 1501, a system memory 1504 including a random access memory 1502 and a read-only memory 1503, and a system bus 1505 connecting the system memory 1504 and the central processing unit 1501. The computer equipment 1500 also includes a basic input/output system (Input/Output, I/O system) 1506 that helps to transmit information between various devices in the computer, and a storage system 1515 for storing operating systems 1513, application programs 1514 and other program modules 1515. mass storage device 1507 .

The basic input/output system 1506 includes a display 1508 for displaying information and input devices 1509 such as a mouse and a keyboard for users to input information. Both the display 1508 and the input device 15015 are connected to the central processing unit 1501 through the input and output controller 1510 connected to the system bus 1505 . The basic input/output system 1506 may also include an input output controller 1510 for receiving and processing input from a number of other devices such as a keyboard, mouse, or electronic stylus. Similarly, input output controller 1510 also provides output to a display screen, printer, or other type of output device.

Mass storage device 1507 is connected to central processing unit 1501 through a mass storage controller (not shown) connected to system bus 1505 . Mass storage device 1507 and its associated computer-readable media provide non-volatile storage for computer device 1500 . That is, mass storage device 1507 may include computer-readable media (not shown), such as hard disks or drives.

Without loss of generality, computer-readable media may comprise computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include random access memory (RAM, Random Access Memory), read-only memory (ROM, Read Only Memory), flash memory or other solid-state storage technologies, and compact discs (Compact Disc Read-Only Memory, CD-ROM) ), Digital Versatile Disc (DVD) or other optical storage, tape cartridge, tape, magnetic disk storage or other magnetic storage device. Certainly, those skilled in the art know that the computer storage medium is not limited to the above-mentioned ones. The above-mentioned system memory 1504 and mass storage device 1507 may be collectively referred to as memory.

One or more programs are stored in the memory, one or more programs are configured to be executed by one or more central processing units 1501, one or more programs include instructions for implementing the above method, and the central processing unit 1501 executes the one or more Multiple programs implement the methods provided by the above method embodiments.

According to various embodiments of the present application, computer device 1500 may also operate on a remote computer connected to a network through a network such as the Internet. That is, the computer device 1500 can be connected to the network 1512 through the network interface unit 1511 connected to the system bus 1505, or can use the network interface unit 1511 to connect to other types of networks or remote computer systems (not shown).

The memory also includes one or more programs, one or more programs are stored in the memory, and one or more programs include the steps executed by the computer device in the method provided by the embodiment of the present application.

In addition, those skilled in the art can understand that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or less components than those shown in the illustration, or combine certain some components, or a different arrangement of components. For example, electronic equipment also includes components such as radio frequency circuits, input units, sensors, servers, and power supplies, which will not be repeated here.

The present application provides a computer-readable storage medium, at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement the role assignment method provided by the above method embodiments.

The present application also provides a computer program product or computer program, the computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. The processor of the terminal reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the terminal executes the method for assigning roles in any one of the above embodiments.

The serial numbers of the above embodiments of the present application are for description only, and do not represent the advantages and disadvantages of the embodiments.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

The above are only optional embodiments of the application, and are not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the application shall be included in the protection scope of the application. Inside.

Claims (10)

1. A method for assigning roles, the method comprising:

in response to a selection operation of a first candidate role in a candidate role set, adding the first candidate role to the selected role set;

determining target roles in the candidate role sets based on the selected role sets and risk role sets, wherein objects having all roles in the risk role sets simultaneously have responsibility separation risks, and at least one risk role set exists and is a subset of the selected role sets after the target roles are added;

removing the first candidate role and the target role from the set of candidate roles;

and responding to the confirmation operation of the selected character set, and performing character allocation based on the selected character set.

2. The method of claim 1, wherein determining the target character from the set of candidate characters based on the set of selected characters and the set of risk characters comprises:

combining a second candidate role in the candidate role set with the selected role set to obtain a role set to be detected, wherein the second candidate role is different from the first candidate role;

and performing risk verification on the role set to be detected based on the risk role set, and determining the target role in the candidate role set, wherein the combination of the target role and the selected role set has a role separation risk.

3. The method of claim 2, wherein the risk verifying the set of roles to be checked based on the set of risk roles, and determining the target role in the set of candidate roles comprises:

acquiring the risk role set, and comparing the role set to be detected with the risk role set;

in response to there being a subset of the set of roles that are at risk that is the set of roles that are to be checked, determining the second candidate role in the set of roles that are to be checked as the target role.

4. The method of claim 3, wherein after comparing the suspected character set with the risk character set, the method further comprises:

in response to there being no subset of the set of at risk roles that is the set of suspected roles, removing the first candidate role from the set of candidate roles.

5. The method of any of claims 1 to 4, further comprising:

acquiring system roles in a role distribution system, and generating a function set according to business functions or business permissions, wherein the system roles contained in the function set are used for realizing corresponding business functions or business permissions;

and determining the risk role set of which the function set forms a role separation risk according to a role separation principle.

6. The method of any of claims 1-4, wherein prior to adding the first candidate character to the set of selected characters, the method further comprises:

displaying a role distribution interface, wherein the candidate role set, the selected role set and a role selection control are displayed in the role distribution interface, and the role selection control is used for adding the first candidate role in the candidate role set to the selected role set;

the adding a first candidate character in the set of candidate characters to the selected set of characters in response to a selection operation of the first candidate character comprises:

in response to a trigger operation of the first candidate role in the selected role set corresponding to the role selection control, adding the first candidate role to the selected role set;

after removing the first candidate role and the target role from the set of candidate roles, the method further comprises:

and responding to the condition that the candidate role set is an empty set, and displaying prompt information, wherein the prompt information is used for indicating that no optional role meeting the service function or the service authority exists in the candidate role set.

7. The method of claim 6, wherein the role assignment interface displays a role deletion control for deleting a selected role in the set of selected roles;

the method further comprises the following steps:

receiving a selection operation of the role deletion control, and removing the selected role from the selected role set;

re-adding the removed selected character to the set of candidate characters, and updating the set of candidate characters based on the set of selected characters after removing the selected character and the set of risk characters.

8. A character assigning apparatus, the apparatus comprising:

an adding module, configured to add a candidate role to a selected role set in response to a selection operation on a first candidate role in the candidate role set;

a first determining module, configured to determine a target role in the candidate role set based on the selected role set and a risk role set, where there is a risk of separating roles for objects having roles in the risk role set at the same time, and there is at least one risk role set that is a subset of the selected role set after the target role is added;

a first removal module to remove the first candidate role from the set of candidate roles and to remove the target role;

and the role distribution module is used for responding to the confirmation operation of the selected role set and carrying out role distribution based on the selected role set.

9. A computer device, characterized in that the terminal comprises a processor and a memory, in which at least one instruction, at least one program, a set of codes, or a set of instructions is stored, which is loaded and executed by the processor to implement the role assignment method according to any one of claims 1 to 7.

10. A computer readable storage medium having stored therein at least one instruction, at least one program, a set of codes, or a set of instructions, which is loaded and executed by a processor to implement the role assignment method according to any one of claims 1 to 7.

Images