CN114861208A - Data authority control method and data authority control service - Google Patents
Data authority control method and data authority control service Download PDFInfo
- Publication number
- CN114861208A CN114861208A CN202210530832.9A CN202210530832A CN114861208A CN 114861208 A CN114861208 A CN 114861208A CN 202210530832 A CN202210530832 A CN 202210530832A CN 114861208 A CN114861208 A CN 114861208A
- Authority
- CN
- China
- Prior art keywords
- target
- data
- data query
- user
- query statement
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000012545 processing Methods 0.000 claims abstract description 55
- 238000004458 analytical method Methods 0.000 claims description 12
- 238000013507 mapping Methods 0.000 claims description 9
- 238000001914 filtration Methods 0.000 claims description 7
- 238000004590 computer program Methods 0.000 description 10
- 238000010586 diagram Methods 0.000 description 10
- 230000008569 process Effects 0.000 description 8
- 230000006870 function Effects 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/242—Query formulation
- G06F16/2433—Query languages
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/40—Transformation of program code
- G06F8/41—Compilation
- G06F8/42—Syntactic analysis
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- Mathematical Physics (AREA)
- Databases & Information Systems (AREA)
- Automation & Control Theory (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Storage Device Security (AREA)
Abstract
The application discloses a data authority control method and a data authority control service, and relates to the technical field of data authority control. The method of the present application comprises: receiving a data query request sent by a target client, wherein the data query request comprises an original data query statement and a unique identity corresponding to a target user; acquiring authority information corresponding to the target user according to the unique identity corresponding to the target user; performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement; sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement; and receiving the query result data fed back by the target database, and sending the query result data to the target client.
Description
Technical Field
The present application relates to the field of data right control technologies, and in particular, to a data right control method and a data right control service.
Background
The authority management generally refers to controlling that a user can access and only can access authorized resources and data according to a set security rule or a set security policy. The authority management is divided into two categories, namely, functional authority control and data authority control, wherein the data authority control means: the control user can check which data, for example, a common employee controlling the human resource department can check the personal data of partial employees in the company, and a department manager controlling the human resource department can check the personal data of all employees in the company.
At present, data authority control of a client is usually realized by adding a data authority control code in a service code of the client, that is, different data authority control codes are written according to different data authority control requirements, and then the written data authority control codes are coupled with the service code of the client, so that the data authority control of the client is realized. Because a large amount of data authority control codes need to be added in the service codes of the client, the maintenance and adjustment of the service codes of the client are not facilitated.
Disclosure of Invention
The embodiment of the application provides a data authority control method and a data authority control service, and mainly aims to realize data authority control of a client on the basis of not changing a service code of the client.
In order to solve the above technical problem, an embodiment of the present application provides the following technical solutions:
in a first aspect, the present application provides a data authority control method, which is applied to a data authority control service, and includes:
receiving a data query request sent by a target client, wherein the data query request comprises an original data query statement and a unique identity corresponding to a target user;
acquiring authority information corresponding to the target user according to the unique identity corresponding to the target user;
performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement;
sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
and receiving the query result data fed back by the target database, and sending the query result data to the target client.
Optionally, the obtaining, according to the unique identity corresponding to the target user, the authority information corresponding to the target user includes:
sending the unique identity corresponding to the target user to a user center service so that the user center service can perform query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, wherein the user center service stores a mapping relation between the unique identity corresponding to each user and the authority information;
and receiving authority information which is fed back by the user center service and corresponds to the target user.
Optionally, the performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement includes:
analyzing the original data query statement;
if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement;
adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree;
and compiling the modified abstract syntax tree to obtain the target data query statement.
Optionally, the method further includes:
if the analysis fails, acquiring a user grade corresponding to the target user according to the unique identity corresponding to the target user;
when the user level corresponding to the target user is greater than a preset level threshold, determining the original data query statement as the target data query statement;
and when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, sending error reporting information to the target client.
Optionally, after receiving the data query request sent by the target client, the method further includes:
acquiring historical data query times corresponding to the target client;
if the historical data query times are larger than the data query time threshold, sending error report information to the target client;
and if the historical data query times are less than or equal to the data query time threshold, the step of obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user is carried out.
In a second aspect, the present application further provides a data authority control service, including:
the system comprises a receiving unit, a sending unit and a processing unit, wherein the receiving unit is used for receiving a data query request sent by a target client, and the data query request comprises an original data query statement and a unique identity corresponding to a target user;
the first obtaining unit is used for obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user;
the processing unit is used for carrying out data authority control processing on the original data query statement according to the authority information so as to obtain a target data query statement;
the first sending unit is used for sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
and the second sending unit is used for receiving the query result data fed back by the target database and sending the query result data to the target client.
Optionally, the first obtaining unit includes:
the sending module is used for sending the unique identity corresponding to the target user to a user center service so that the user center service can perform query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, wherein the user center service stores a mapping relation between the unique identity corresponding to each user and the authority information;
and the receiving module is used for receiving the authority information which is fed back by the user center service and corresponds to the target user.
Optionally, the processing unit is specifically configured to parse the original data query statement; if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement; adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree; and compiling the modified abstract syntax tree to obtain the target data query statement.
Optionally, the processing unit is further configured to, if the analysis fails, obtain a user level corresponding to the target user according to the unique identity corresponding to the target user; when the user level corresponding to the target user is greater than a preset level threshold, determining the original data query statement as the target data query statement; and when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, sending error reporting information to the target client.
Optionally, the data authority control service further includes:
the second obtaining unit is used for obtaining the historical data query times corresponding to the target client after the receiving unit receives the data query request sent by the target client;
the third sending unit is used for sending error reporting information to the target client when the historical data query times are greater than a data query time threshold;
the first obtaining unit is specifically configured to, when the historical data query frequency is less than or equal to the data query frequency threshold, obtain, according to the unique identity corresponding to the target user, the authority information corresponding to the target user.
In a third aspect, an embodiment of the present application provides a storage medium, where the storage medium includes a stored program, and when the program runs, a device on which the storage medium is located is controlled to execute the data authority control method according to the first aspect.
In a fourth aspect, embodiments of the present application provide a data rights control apparatus, the apparatus comprising a storage medium; and one or more processors, the storage medium coupled with the processors, the processors configured to execute program instructions stored in the storage medium; the program instructions, when executed, perform the data right control method of the first aspect.
By means of the technical scheme, the technical scheme provided by the application at least has the following advantages:
the application provides a data authority control method and a data authority control service, and the data authority control service can obtain a data query request which is sent by a target client and carries an original data query statement and a unique identity corresponding to a target user, then obtain authority information corresponding to the target user according to the unique identity corresponding to the target user, then perform data authority control processing on the original data query statement according to the authority information corresponding to the target user so as to obtain a target data query statement, finally send the target data query statement to a target database, and perform query processing on the target database according to the target data query statement so as to obtain query result data corresponding to the target data query statement; and after the target database obtains the query result data corresponding to the target data query statement through query, feeding the query result data back to the data authority control service, and sending the query result data to the target client by the data authority control service. Because the query result data fed back to the target client by the data authority control service is obtained by the target database according to the target data query statement containing the authority information of the target user, the query result data is the data which can be viewed by the data viewing authority possessed by the target user, and the data authority control of the target client is completed on the basis of not changing the service code of the target client.
The above description is only an overview of the technical solutions of the present application, and the present application may be implemented in accordance with the content of the description so as to make the technical means of the present application more clearly understood, and the detailed description of the present application will be given below in order to make the above and other objects, features, and advantages of the present application more clearly understood.
Drawings
The above and other objects, features and advantages of exemplary embodiments of the present application will become readily apparent from the following detailed description read in conjunction with the accompanying drawings. Several embodiments of the present application are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings and in which like reference numerals refer to similar or corresponding parts and in which:
fig. 1 shows a flowchart of a data authority control method provided in an embodiment of the present application;
FIG. 2 is a flow chart of another data authority control method provided by the embodiment of the application;
FIG. 3 is a block diagram illustrating components of a data rights control service provided by an embodiment of the present application;
fig. 4 shows a block diagram of another data authority control service provided in the embodiment of the present application.
Detailed Description
Exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
It is to be noted that, unless otherwise specified, technical or scientific terms used herein shall have the ordinary meaning as understood by those skilled in the art to which this application belongs.
An embodiment of the present application provides a data authority control method, which is applied to a data authority control service, and specifically as shown in fig. 1, the method includes:
101. and receiving a data query request sent by a target client.
The data query request comprises an original data query statement and a unique identity corresponding to a target user; the original data query statement specifically includes: SQL or DSL query statements; the unique identity corresponding to the target user may be, but is not limited to: and the login account of the target user.
In this embodiment of the present application, an execution subject in each step is a data authority control service deployed in a target terminal device, where the data authority control service is independent of a target client and a target database, and the target terminal device may be, but is not limited to: servers, computers, and the like.
In the embodiment of the application, when a target user needs to query data, the target user can log in the target client through a login account of the target user, and then a data query request carrying an original data query statement and a unique identity corresponding to the target user is sent to the data authority control service through the target client.
102. And acquiring the authority information corresponding to the target user according to the unique identity corresponding to the target user.
The permission information corresponding to the target user is used for indicating the data viewing permission possessed by the target user; the method comprises the following steps that a worker adds a unique label to each data table needing data authority control in a target database in advance; the right information corresponding to the target user may include, but is not limited to: the unique label corresponding to each data table that can be viewed by the target user, the column name of the data column that can be viewed by the target user in a certain data table, the unique label corresponding to the data table, and the like.
In the embodiment of the application, after receiving and obtaining the data query request sent by the target client, the data authority control service can obtain the authority information corresponding to the target user according to the unique identity corresponding to the target user.
103. And performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement.
The original data query statement and the target data query statement are query statements written in the same language, for example, if the original data query statement is an SQL query statement, the target data query statement is also an SQL query statement, and if the original data query statement is a DSL query statement, the target data query statement is also a DSL query statement; and the target data query statement comprises authority information corresponding to the target user.
In the embodiment of the application, after acquiring the authority information corresponding to the target user, the data authority control service can perform data authority control processing on the original data query statement according to the authority information corresponding to the target user, so as to acquire the target data query statement.
104. And sending the target data query statement to a target database, receiving query result data fed back by the target database, and sending the query result data to a target client.
In the embodiment of the application, after obtaining the target data query statement, the data authority control service can send the target data query statement to the target database, and after receiving the target data query statement, the target database can perform query processing according to the target data query statement, so as to obtain query result data corresponding to the target data query statement; after the target database obtains the query result data corresponding to the target data query statement through query, the query result data are fed back to the data authority control service, and after the data authority control service receives the query result data fed back by the target database, the query result data can be sent to the target client side to complete data authority control of the target client side.
It should be noted that, because the query result data is obtained by querying the target database according to the target data query statement containing the authority information of the target user, the query result data is data that can be viewed by the data viewing authority possessed by the target user.
The embodiment of the application provides a data authority control method, after a data authority control service receives a data query request which is sent by a target client and carries an original data query statement and a unique identity corresponding to a target user, authority information corresponding to the target user is obtained according to the unique identity corresponding to the target user, data authority control processing is carried out on the original data query statement according to the authority information corresponding to the target user, so that a target data query statement is obtained, finally, the target data query statement is sent to a target database, and the target database carries out query processing according to the target data query statement, so that query result data corresponding to the target data query statement is obtained; and after the target database obtains the query result data corresponding to the target data query statement through query, feeding the query result data back to the data authority control service, and sending the query result data to the target client by the data authority control service. Because the query result data fed back to the target client by the data authority control service is obtained by the target database according to the target data query statement containing the authority information of the target user, the query result data is the data which can be viewed by the data viewing authority possessed by the target user, and the data authority control of the target client is completed on the basis of not changing the service code of the target client. To explain in more detail below, an embodiment of the present application provides another data authority control method, which is applied to a data authority control service, and specifically as shown in fig. 2, the method includes:
201. and receiving a data query request sent by a target client.
For step 201, the description of the corresponding part in fig. 1 may be referred to for receiving the data query request sent by the target client, and details of the embodiment of the present application will not be repeated here.
Further, in this embodiment of the application, after receiving and obtaining the data query request sent by the target client, the data authority control service further needs to obtain the historical data query times corresponding to the target client, where the historical data query times corresponding to the target client is the times that the target client has sent the data query request to the data authority control service in a current preset period, and the preset period may be, but is not limited to: 6 hours, 12 hours, 24 hours, etc.; when the historical data query times corresponding to the target client are larger than the data query time threshold, sending error report information to the target client without executing subsequent steps; when the historical data query frequency is less than or equal to the data query frequency threshold, step 202 is executed, so that the situation that the target user controls the target client to send a large number of data query requests to the data authority control service in a short time to influence the normal operation of the data authority control service can be prevented.
202. And acquiring the authority information corresponding to the target user according to the unique identity corresponding to the target user.
In the embodiment of the application, after receiving and obtaining the data query request sent by the target client, the data authority control service can obtain the authority information corresponding to the target user according to the unique identity corresponding to the target user.
Specifically, in this step, the staff stores the mapping relationship between the unique identity corresponding to each user and the authority information in the user center service in advance; the specific process of acquiring the authority information corresponding to the target user by the data authority control service according to the unique identity corresponding to the target user is as follows: the data authority control service sends the unique identity corresponding to the target user to the user center service, after receiving and obtaining the unique identity corresponding to the target user, the user center service inquires and processes the unique identity corresponding to the target user, so that authority information corresponding to the target user is obtained, and the authority information corresponding to the target user is fed back to the data authority control service, and at the moment, the data authority control service can receive and obtain the authority information corresponding to the target user; the user center service is independent of the data authority control service, the target client and the target database, and the user center service may be deployed in the target terminal device together with the data authority control service, and may also be deployed in other terminal devices.
203. And performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement.
In the embodiment of the application, after acquiring the authority information corresponding to the target user, the data authority control service can perform data authority control processing on the original data query statement according to the authority information corresponding to the target user, so as to acquire the target data query statement.
Specifically, in this step, the data authority control service may perform data authority control processing on the original data query statement according to the authority information in the following manner to obtain the target data query statement:
firstly, analyzing and processing an original data query statement, wherein the specific process comprises the following steps: analyzing the original data query sentence by adopting a corresponding analyzer according to the language for writing the original data query sentence; when the parsing is successful, obtaining an abstract syntax tree corresponding to the original data query statement, at this time, adding a filtering condition in the abstract syntax tree corresponding to the original data query statement according to the authority information corresponding to the target user, that is, adding the authority information corresponding to the target user to the abstract syntax tree corresponding to the original data query statement, thereby obtaining a modified abstract syntax tree, and then compiling the modified abstract syntax tree to obtain the target data query statement; when the analysis fails, the user grade corresponding to the target user needs to be obtained according to the unique identity corresponding to the target user, when the user grade corresponding to the target user is larger than a preset grade threshold value, the original data query statement is determined as the target data query statement, when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, error reporting information is sent to the target client side, and subsequent steps do not need to be executed.
It should be noted that, in the actual application process, a worker may store the mapping relationship between the unique identity and the user class corresponding to each user in the user center service in advance, or may store the mapping relationship between the unique identity and the user class corresponding to each user in the data authority control service in advance, which is not specifically limited in this embodiment of the present application.
204. And sending the target data query statement to a target database.
For step 204, sending the target data query statement to the target database, reference may be made to the description of the corresponding part in fig. 1, and details of the embodiment of the present application will not be repeated here.
205. And receiving query result data fed back by the target database, and sending the query result data to the target client.
In step 205, for receiving query result data fed back by the target database and sending the query result data to the target client, reference may be made to the description of the corresponding part in fig. 1, and details of the embodiment of the present application will not be repeated here.
In order to achieve the above object, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, where the storage medium includes a stored program, where the apparatus on which the storage medium is located is controlled to execute the above data authority control method when the program runs.
In order to achieve the above object, according to another aspect of the present application, an embodiment of the present application further provides a data right control apparatus, which includes a storage medium; and one or more processors, the storage medium coupled with the processors, the processors configured to execute program instructions stored in the storage medium; and when the program instruction runs, the data authority control method is executed.
Further, as an implementation of the method shown in fig. 1 and fig. 2, another embodiment of the present application further provides a data right control service. This embodiment corresponds to the foregoing method embodiment, and details in the foregoing method embodiment are not repeated in this embodiment for convenience of reading, but it should be clear that the data right control service in this embodiment can correspondingly implement all the contents in the foregoing method embodiment. The data right control service is applied to realize data right control of a client on the basis of not changing a service code of the client, and specifically, as shown in fig. 3, the data right control service includes:
the receiving unit 31 is configured to receive a data query request sent by a target client, where the data query request includes an original data query statement and a unique identity corresponding to a target user;
a first obtaining unit 32, configured to obtain, according to the unique identity corresponding to the target user, authority information corresponding to the target user;
the processing unit 33 is configured to perform data authority control processing on the original data query statement according to the authority information to obtain a target data query statement;
a first sending unit 34, configured to send the target data query statement to a target database, so that the target database performs query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
the second sending unit 35 is configured to receive the query result data fed back by the target database, and send the query result data to the target client.
Further, as shown in fig. 4, the first obtaining unit 32 includes:
a sending module 321, configured to send the unique identity corresponding to the target user to a user center service, so that the user center service performs query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, where the user center service stores a mapping relationship between the unique identity corresponding to each user and the authority information;
a receiving module 322, configured to receive the authority information corresponding to the target user, fed back by the user center service.
Further, as shown in fig. 4, the processing unit 33 is specifically configured to perform parsing processing on the original data query statement; if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement; adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree; and compiling the modified abstract syntax tree to obtain the target data query statement.
Further, as shown in fig. 4, the processing unit 33 is further configured to, if the analysis fails, obtain a user level corresponding to the target user according to the unique identity corresponding to the target user; when the user level corresponding to the target user is greater than a preset level threshold, determining the original data query statement as the target data query statement; and when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, sending error reporting information to the target client.
Further, as shown in fig. 4, the data right control service further includes:
a second obtaining unit 36, configured to obtain, after the receiving unit 31 receives the data query request sent by the target client, a historical data query frequency corresponding to the target client;
a third sending unit 37, configured to send error information to the target client when the historical data query frequency is greater than a data query frequency threshold;
the first obtaining unit 32 is specifically configured to, when the historical data query frequency is less than or equal to the data query frequency threshold, obtain, according to the unique identity corresponding to the target user, the authority information corresponding to the target user.
The embodiment of the application provides a data authority control method and a data authority control service, and the data authority control service can obtain a data query request which is sent by a target client and carries an original data query statement and a unique identity corresponding to a target user, acquire authority information corresponding to the target user according to the unique identity corresponding to the target user, perform data authority control processing on the original data query statement according to the authority information corresponding to the target user to obtain a target data query statement, and finally send the target data query statement to a target database, perform query processing on the target database according to the target data query statement to obtain query result data corresponding to the target data query statement; and after the target database obtains the query result data corresponding to the target data query statement through query, feeding the query result data back to the data authority control service, and sending the query result data to the target client by the data authority control service. Because the query result data fed back to the target client by the data authority control service is obtained by the target database according to the target data query statement containing the authority information of the target user, the query result data is the data which can be viewed by the data viewing authority possessed by the target user, and the data authority control of the target client is completed on the basis of not changing the service code of the target client.
The embodiment of the application provides a storage medium, which comprises a stored program, wherein when the program runs, a device where the storage medium is located is controlled to execute the data authority control method.
The storage medium may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The embodiment of the application also provides a data right control device, which comprises a storage medium; and one or more processors, the storage medium coupled with the processors, the processors configured to execute program instructions stored in the storage medium; and when the program instruction runs, the data authority control method is executed.
The embodiment of the application provides equipment, the equipment comprises a processor, a memory and a program which is stored on the memory and can run on the processor, and the following steps are realized when the processor executes the program:
receiving a data query request sent by a target client, wherein the data query request comprises an original data query statement and a unique identity corresponding to a target user;
acquiring authority information corresponding to the target user according to the unique identity corresponding to the target user;
performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement;
sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
and receiving the query result data fed back by the target database, and sending the query result data to the target client.
Further, the acquiring the authority information corresponding to the target user according to the unique identity corresponding to the target user includes:
sending the unique identity corresponding to the target user to a user center service so that the user center service can perform query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, wherein the user center service stores a mapping relation between the unique identity corresponding to each user and the authority information;
and receiving authority information which is fed back by the user center service and corresponds to the target user.
Further, the performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement includes:
analyzing the original data query statement;
if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement;
adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree;
and compiling the modified abstract syntax tree to obtain the target data query statement.
Further, the method further comprises:
if the analysis fails, acquiring a user grade corresponding to the target user according to the unique identity corresponding to the target user;
when the user level corresponding to the target user is greater than a preset level threshold, determining the original data query statement as the target data query statement;
and when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, sending error reporting information to the target client.
Further, after receiving the data query request sent by the target client, the method further includes:
acquiring historical data query times corresponding to the target client;
if the historical data query times are larger than a data query time threshold, sending error report information to the target client;
and if the historical data query times are less than or equal to the data query time threshold, the step of obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user is carried out.
The present application further provides a computer program product adapted to perform program code for initializing the following method steps when executed on a data processing device: receiving a data query request sent by a target client, wherein the data query request comprises an original data query statement and a unique identity corresponding to a target user; acquiring authority information corresponding to the target user according to the unique identity corresponding to the target user; performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement; sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement; and receiving the query result data fed back by the target database, and sending the query result data to the target client.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). The memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The above are merely examples of the present application and are not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims (10)
1. A data authority control method is applied to a data authority control service, and comprises the following steps:
receiving a data query request sent by a target client, wherein the data query request comprises an original data query statement and a unique identity corresponding to a target user;
acquiring authority information corresponding to the target user according to the unique identity corresponding to the target user;
performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement;
sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
and receiving the query result data fed back by the target database, and sending the query result data to the target client.
2. The method according to claim 1, wherein the obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user comprises:
sending the unique identity corresponding to the target user to a user center service so that the user center service can perform query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, wherein the user center service stores a mapping relation between the unique identity corresponding to each user and the authority information;
and receiving authority information which is fed back by the user center service and corresponds to the target user.
3. The method according to claim 1, wherein the performing data authority control processing on the original data query statement according to the authority information to obtain a target data query statement comprises:
analyzing the original data query statement;
if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement;
adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree;
and compiling the modified abstract syntax tree to obtain the target data query statement.
4. The method of claim 3, further comprising:
if the analysis fails, acquiring a user grade corresponding to the target user according to the unique identity corresponding to the target user;
when the user level corresponding to the target user is greater than a preset level threshold, determining the original data query statement as the target data query statement;
and when the user grade corresponding to the target user is smaller than or equal to the preset grade threshold value, sending error reporting information to the target client.
5. The method according to any one of claims 1-4, wherein after receiving the data query request sent by the target client, the method further comprises:
acquiring historical data query times corresponding to the target client;
if the historical data query times are larger than the data query time threshold, sending error report information to the target client;
and if the historical data query times are less than or equal to the data query time threshold, the step of obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user is carried out.
6. A data rights control service, comprising:
the system comprises a receiving unit, a sending unit and a processing unit, wherein the receiving unit is used for receiving a data query request sent by a target client, and the data query request comprises an original data query statement and a unique identity corresponding to a target user;
the first obtaining unit is used for obtaining the authority information corresponding to the target user according to the unique identity corresponding to the target user;
the processing unit is used for carrying out data authority control processing on the original data query statement according to the authority information so as to obtain a target data query statement;
the first sending unit is used for sending the target data query statement to a target database so that the target database can perform query processing according to the target data query statement to obtain query result data corresponding to the target data query statement;
and the second sending unit is used for receiving the query result data fed back by the target database and sending the query result data to the target client.
7. The data right control service according to claim 6, wherein the first obtaining unit includes:
the sending module is used for sending the unique identity corresponding to the target user to a user center service so that the user center service can perform query processing according to the unique identity corresponding to the target user to obtain authority information corresponding to the target user, wherein the user center service stores a mapping relation between the unique identity corresponding to each user and the authority information;
and the receiving module is used for receiving the authority information which is fed back by the user center service and corresponds to the target user.
8. The data rights control service of claim 6,
the processing unit is specifically configured to perform parsing processing on the original data query statement; if the analysis is successful, obtaining an abstract syntax tree corresponding to the original data query statement; adding a filtering condition in the abstract syntax tree according to the permission information to obtain the modified abstract syntax tree; and compiling the modified abstract syntax tree to obtain the target data query statement.
9. A storage medium, characterized in that the storage medium comprises a stored program, wherein when the program runs, a device where the storage medium is located is controlled to execute the data authority control method according to any one of claims 1 to 5.
10. A data rights control apparatus, characterized in that the apparatus comprises a storage medium; and one or more processors, the storage medium coupled with the processors, the processors configured to execute program instructions stored in the storage medium; the program instructions when executed perform the data permission control method of any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210530832.9A CN114861208A (en) | 2022-05-17 | 2022-05-17 | Data authority control method and data authority control service |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210530832.9A CN114861208A (en) | 2022-05-17 | 2022-05-17 | Data authority control method and data authority control service |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114861208A true CN114861208A (en) | 2022-08-05 |
Family
ID=82638310
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210530832.9A Pending CN114861208A (en) | 2022-05-17 | 2022-05-17 | Data authority control method and data authority control service |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114861208A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116049882A (en) * | 2023-01-11 | 2023-05-02 | 安芯网盾(北京)科技有限公司 | Data authority control method and system based on grouping |
-
2022
- 2022-05-17 CN CN202210530832.9A patent/CN114861208A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116049882A (en) * | 2023-01-11 | 2023-05-02 | 安芯网盾(北京)科技有限公司 | Data authority control method and system based on grouping |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20200344253A1 (en) | Systems and methods for data-driven infrastructure controls | |
| CN108197200B (en) | Log tracking method and device, computer equipment and storage medium | |
| CN109670297B (en) | Method and device for opening service permission, storage medium and electronic equipment | |
| CN110968560B (en) | Configuration method, device and system of log collector | |
| CN107092535B (en) | Method and apparatus for data storage of test interface | |
| CN113656245B (en) | Data inspection method and device, storage medium and processor | |
| CN110895537A (en) | Method and device for freely inquiring authority control | |
| CN111400681A (en) | Data permission processing method, device and equipment | |
| US11489844B2 (en) | On-the-fly creation of transient least privileged roles for serverless functions | |
| CN114861208A (en) | Data authority control method and data authority control service | |
| CN106878365B (en) | data synchronization method and device | |
| CN107168866B (en) | Parameter analysis method and device for configuration file | |
| US20110010754A1 (en) | Access control system, access control method, and recording medium | |
| CN112149112B (en) | Enterprise information security management method based on authority separation | |
| CN112631763A (en) | Program changing method and device of host program | |
| CN109977317B (en) | Data query method and device | |
| CN117093977A (en) | User authentication method, system, device, storage medium and electronic equipment | |
| CN111435327B (en) | Log record processing method, device and system | |
| CN110019497B (en) | Data reading method and device | |
| CN108304731B (en) | Method and system for managing enterprise data call and information processing platform | |
| US20230342226A1 (en) | Event handling based on tracing execution paths | |
| CN114944955A (en) | Access control method and access control server | |
| CN115687345A (en) | Report generation method and device, storage medium and electronic equipment | |
| CN113641702A (en) | Method and device for interactive processing with database client after statement audit | |
| CN115827589A (en) | Authority verification method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |