TWI862291B - Application permission establishment method and application permission establishment system - Google Patents

Abstract

A method of establishing application permissions includes requesting a first permission; determining whether the first permission exists in a plurality of application permissions in a permission table; obtaining the first permission when the first permission exists in the plurality of application permissions in a permission table; and reviewing the first permission when the first permission does not exist in the plurality of application permissions in a permission table.

Description

Application permission establishment method and application permission establishment system

The present invention relates to an application permission establishment method and an application permission establishment system, and in particular to an automated and systematic application permission establishment method and an application permission establishment system.

With the increase in informationization and confidentiality requirements, highly confidential data is usually stored in the company's internal data center, such as order information, financial information, and procurement information. Employees belonging to different units or different positions may have different access to these highly confidential data. Therefore, based on information security issues, the data center must establish a permission mechanism to regulate the data permissions that different employees can access.

However, the establishment of data permissions in the current data center is mainly based on manual review. Generally speaking, the review committee first collects each employee's needs for data permissions, and then determines the data permissions that each employee can access. Such a complicated permission establishment method not only increases time costs, but also exposes the company to data security risks.

In this situation, how to automate and systematize the application permission establishment method and application permission establishment system and accelerate the digital transformation of the industry has become one of the goals that the industry is striving for.

One of the main purposes of the present invention is to provide an application permission establishment method and an application permission establishment system to solve the above problems.

The present invention provides a method for establishing application permissions, including requesting a first permission; determining whether the first permission exists in a plurality of application permissions in a permission list; obtaining the first permission when the first permission exists in the plurality of application permissions in the permission list; and reviewing the first permission when the first permission does not exist in the plurality of application permissions in the permission list.

The present invention provides an application permission establishment system, comprising a user interface for requesting a first permission; a storage module for storing a permission list; and a data processing module, coupled to the user interface and the storage module, for executing the following steps: determining whether the first permission exists in a plurality of application permissions in a permission list; when the first permission exists in the plurality of application permissions in the permission list, obtaining the first permission; and when the first permission does not exist in the plurality of application permissions in the permission list, reviewing the first permission through the user interface.

1: Establish system for application permissions

2, 3, 4: Process

10: User Interface

20: Storage module

30: Data processing module

50: User permission table

52: Total list of permissions

S200-S208, S300-S310, S400-S408: Steps

Figure 1 is a schematic diagram of the application permission establishment system of the first embodiment of the present invention.

Figures 2, 3, and 4 are schematic diagrams of the process of establishing application permissions in different embodiments of the present invention.

Figure 5 is a schematic diagram of the application permission establishment system processing a purchasing system permission according to an embodiment of the present invention.

Certain terms are used in this specification and subsequent patent applications to refer to specific components. A person of ordinary skill in the art should understand that hardware manufacturers may use different terms to refer to the same component. This specification and subsequent patent applications do not use differences in names as a way to distinguish components, but rather use differences in the functions of the components as the criterion for distinction. The word "including" mentioned throughout the specification and subsequent patent applications is an open term and should be interpreted as "including but not limited to". In addition, the word "coupled" here includes any direct and indirect electrical connection means. Therefore, if the text describes a first device coupled to a second device, it means that the first device can be directly electrically connected to the second device, or indirectly electrically connected to the second device through other devices or connection means.

In an embodiment, the computing device may adopt at least one of the following examples: central processor unit (CPU), graphics processor (GPU), microcontroller (MCU), application processor (AP), field programmable gate array (FPGA), application specific integrated circuit (ASIC), digital signal processor (DSP), system-on-a-chip (SOC), deep learning accelerator. However, the present invention is not limited to these examples.

Please refer to Figure 1, which is a schematic diagram of an application permission establishment system 1 of an embodiment of the present invention. The application permission establishment system 1 can be configured in a data center to collect user needs or applications for data permissions, and automatically and systematically allow users to obtain data permissions. The application permission establishment system 1 includes a user interface 10, a storage module 20, and a data processing module 30. The user requests multiple data permissions through the user interface 10. The user interface 10 can be an application programming interface (API). The user's request will be converted into the data format of the data center through the application programming interface. The conversion of the application programming interface is well known to people in this field and will not be elaborated here. It should be noted that for the sake of clarity, the following embodiments are all taken as an example of a user requesting a first permission, but are not limited to this. The storage module 20 is used to store a permission list, which records a plurality of application permissions, which are application permissions that the user has obtained or application permissions that can be obtained by default. The data processing module 30 is coupled to the user interface 10 and the storage module 20, and is used to execute an application permission establishment method to determine whether the user can obtain the first permission based on the plurality of application permissions in the permission list.

The application permission establishment method of the application permission establishment system 1 can be summarized into a process 2, as shown in Figure 2. Process 2 includes the following steps:

Step S200: Start.

Step S202: Determine whether the first permission exists in the multiple application permissions in the permission list.

Step S204: When the first permission exists in multiple application permissions in the permission list, obtain the first permission.

Step S206: When the first permission does not exist in the plurality of application permissions in the permission list, the first permission is reviewed through the user interface.

Step S208: End.

According to process 2, in step S202, when the user requests multiple data permissions through the user interface 10, the data processing module 30 determines whether the first permission exists in the multiple application permissions in the permission list. In step S204, when the first permission exists in the multiple application permissions in the permission list, that is, the first permission is an application permission that the user can obtain or has obtained, the data processing module 30 allows the user to obtain the first permission. On the contrary, in step S206, when the first permission does not exist in the multiple application permissions in the permission list, the data processing module 30 cannot allow the user to automatically obtain the first permission. Therefore, other mechanisms are needed to review whether the user can obtain the first permission. For example, when the first permission does not exist in the multiple application permissions in the permission list, the data processing module 30 sends the first permission to a review committee, which can be composed of the user's supervisor, etc. The members of the review committee can review the first permission through the user interface 10.

In one embodiment, reviewing the first permission through the user interface can be summarized as a process 3, as shown in Figure 3. Process 3 includes the following steps:

Step S300: Start.

Step S302: Determine whether the first permission exists in the multiple application permissions in the permission list. If yes, execute step S304. If not, execute step S306.

Step S304: Obtain the first authority.

Step S306: Determine whether the first permission has passed the review. If yes, execute step S304. If no, execute step S308.

Step S308: Stop obtaining the first permission.

Step S310: End.

The detailed description of steps S302 and S304 and their derivative changes can be referred to the above description, which will not be repeated here. In step S306, after receiving the user's request for the first permission, the member of the review committee reviews the first permission through the user interface 10. When the first permission does not pass the review, the data processing module 30 cannot allow the user to obtain the first permission. On the contrary, when the first permission passes the review, the data processing module 30 allows the user to obtain the first permission. It should be noted that the first permission is not included in the multiple application permissions in the permission summary table, so the data processing module 30 can add the first permission to the permission summary table. In this way, when the user requests the first permission again in the future, the permission establishment system 1 can automatically pass the request for the first permission without going through the review committee. In one embodiment, when the application permission establishment system 1 is initially established, there may not be any data permission in the permission list, so each of the multiple data permissions applied for by the user will go through step S306, and some of the multiple data permissions will be added to the permission list after passing the review of the review committee.

On the other hand, the review committee can use the application permission establishment system 1 to actively change (add, update and reduce) the permission list and the user's permission range. For example, the review committee members review a second permission among multiple application permissions in the permission list through the user interface 10. When the second permission passes the review, the permission list is maintained; when the second permission fails the review, the second permission in the permission list is deleted. In addition, if the second permission is the same as the first permission requested or obtained by the user, the first permission is stopped or revoked.

Furthermore, different users may have different permission ranges and their corresponding permission lists, and the data permissions they request may also be different. In order to more effectively manage the user's permission range, in another embodiment, the present invention can also add an automatic deletion of data permissions function so that there will not be too many data permissions in the permission list to cause information security problems. The automatic deletion of data permissions function can be summarized as a process 4, as shown in Figure 4. Process 4 includes the following steps:

Step S400: Start.

Step S402: Determine whether to delete a third permission in the permission list.

Step S404: When the third permission is not requested for a critical time, the third permission in the permission list is deleted.

Step S406: When the third permission is requested, maintain the third permission in the permission list.

Step S408: End.

For detailed description of process 4 and its derivative changes, please refer to the above description, which will not be elaborated here. It should be noted that process 4 is a different embodiment of the present invention, and those skilled in the art can make different modifications accordingly, but are not limited to this. For example, when the third permission is not requested after a critical time, the data processing module 30 deletes the third permission in the permission list and reclaims the data permission that the user has obtained that is the same as the third permission. For example, the data processing module 30 can first determine whether the third permission is a data permission that the user has obtained. If so, process 4 will not be executed. If not, process 4 will be executed.

Finally, the actual operation of the application authority establishment system 1 can be referred to FIG5. FIG5 is a schematic diagram of the application authority establishment system 1 processing a purchasing system authority according to an embodiment of the present invention. The storage module 20 stores a authority summary table 52 and a user authority table 50. The authority summary table 52 records the data authority that the user can obtain, which includes a purchase request list, an inventory list, and a work list. The user authority table 50 records the data authority that the user currently has, which includes an inventory list. In one embodiment, when a user requests data permissions for a purchase order list through the user interface 10, the data processing module 30 determines that the data permissions for the purchase order list are included in the data permissions recorded in the permission summary table 52, so the user can automatically obtain the data permissions for the purchase order list. In other words, the data processing module 30 will add the data permissions for the purchase order list to the user permission table 50. It should be noted that, as shown in FIG. 5 , the user can request to modify the user permission table 50, and the review committee can modify the permission summary table 52. In addition, the data permission range of the permission summary table 52 is greater than or equal to the data permission range of the user permission table 50. In another embodiment, the review committee can delete the data permissions of the inventory list in the permission table 52 (not shown in FIG. 5 ), and the data processing module 30 determines that the data permissions of the inventory list in the user permission table 50 no longer exist in the permission table 52, so the data processing module 30 deletes the data permissions of the inventory list in the user permission table 50 accordingly.

It should be noted that the application permission establishment system 1 is an embodiment of the present invention. A person with ordinary knowledge in the field can combine, modify or change the above-mentioned embodiments according to the spirit of the present invention, but is not limited thereto. All the above descriptions, steps, and/or processes (including recommended steps) can be implemented through hardware, software, firmware (i.e., a combination of hardware devices and computer instructions, the data in the hardware devices are read-only software data), electronic systems, or combinations of the above devices. Hardware can include analog, digital and hybrid circuits (i.e., microcircuits, microchips or silicon chips). Electronic systems can include system on chip (SoC), system in package (SiP), computer on module (CoM) and computer systems. The process steps and embodiments of the present invention may exist in the form of program codes or instructions and be stored in the storage module 20. The storage module 20 may be a computer-readable recording medium, and the storage module 20 may include a read-only memory (ROM), a flash memory (Flash Memory), a random-access memory (RAM), a subscriber identity module (SIM), a hard disk or a CD-ROM (CD-ROM/DVD-ROM/BD-ROM), but is not limited thereto. The above process and embodiments may be compiled into program codes or instructions and stored in the storage module 20. The data processing module 30 can be used to read and execute the program code or instructions stored in the storage module 20 to implement all the aforementioned steps and functions.

In summary, the application permission establishment method and application permission establishment system of the present invention can automatically and systematically process the user's data permission request and manage the user's permission scope. The review committee can review and change the user's permission scope through the application permission establishment method and application permission establishment system of the present invention. In this way, compared with the previous technology, the present invention can reduce labor costs and accelerate the company's digital transformation.

The above is only the preferred embodiment of the present invention. All equivalent changes and modifications made within the scope of the patent application of the present invention shall fall within the scope of the present invention.

2: Process

S200-S208: Steps

Claims (8)

A method for establishing application permissions includes executing the following steps with a computing device: requesting a first permission; determining whether the first permission exists in a plurality of application permissions in a permission list; obtaining the first permission when the first permission exists in the plurality of application permissions in the permission list; reviewing the first permission by a review committee when the first permission does not exist in the plurality of application permissions in the permission list; reviewing a second permission in the plurality of application permissions in the permission list by the review committee; maintaining the permission list when the second permission passes the review; and deleting the second permission in the permission list when the second permission fails the review. The method for establishing application permissions as described in claim 1 further includes: when the first permission passes the review, obtaining the first permission and adding the first permission to the plurality of application permissions in the permission list; and when the first permission fails the review, stopping obtaining the first permission. In the method for establishing application permissions as described in claim 1, the step of deleting the second permission in the permission list further includes: if the second permission is the same as the first permission, stop obtaining or reclaim the first permission. The application permission establishment method as described in claim 1 further includes: determining whether to delete a third permission in the permission list; when the third permission has not been requested for a critical time, deleting the third permission in the permission list; and when the third permission has been requested, maintaining the third permission in the permission list. An application permission establishment system includes: a user interface for requesting a first permission; a storage module for storing a permission list; and a data processing module, coupled to the user interface and the storage module, for executing the following steps: determining whether the first permission exists in a plurality of application permissions in a permission list; obtaining the first permission when the first permission exists in the plurality of application permissions in the permission list; When the first permission does not exist in the plurality of application permissions in the permission list, a review committee reviews the first permission through the user interface; the review committee reviews a second permission in the plurality of application permissions in the permission list through the user interface; when the second permission passes the review, the permission list is maintained; and when the second permission fails the review, the second permission in the permission list is deleted. The application permission establishment system as described in claim 5, wherein the data processing module further performs the following steps: when the first permission passes the review, obtain the first permission and add the first permission to the plurality of application permissions in the permission list; and when the first permission fails the review, stop obtaining the first permission. As described in claim 5, the step of deleting the second permission in the permission list further includes: if the second permission is the same as the first permission, stop obtaining or reclaim the first permission. The application permission establishment system as described in claim 5, wherein the data processing module further performs the following steps: determining whether to delete a third permission in the permission list; deleting the third permission in the permission list when the third permission has not been requested for a critical time; and maintaining the third permission in the permission list when the third permission has been requested.

Images