A method, device and computer-readable storage medium for creating a view

Abstract

The present application provides a view creation method, device and computer-readable storage medium, wherein the method includes: obtaining rule configuration information; generating a view creation statement according to the rule configuration information; calling a Hive interface to create a target view through the view creation statement; setting access rights for the target view by authorizing roles and assigning users to roles, and providing a data query interface. By setting access rights based on role levels when building Hive views, efficient access rights setting can be achieved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a view creation method, device and computer-readable storage medium. Background Art

[0002] With the growth of massive data, more and more enterprises use big data service cloud as shared basic data to provide basic data sharing and services for applications on big data service cloud. Data lake is a stream that brings together different data sources, structured data + unstructured data, stored according to the source-based model to form a complete set of data.

[0003] With the continuous construction and promotion of big data service cloud, more and more domestic and overseas branches and sub-branches are more proactive in carrying out special scene construction and data analysis and mining work on the cloud based on data lake data, digging deep into data value and promoting intelligent applications. In the bank architecture, in general, when upstream applications are included in the data lake data and open to branches, it is necessary to control the branches to only access the data within their jurisdiction.

[0004] The data in the Hive data warehouse is generally shared and used by various business departments, but some private data is not suitable for business departments and is only accessible to special departments. In this case, a range access control policy is required for users who query the data. Due to the constraints of the security control mechanism, some fields of some data are sensitive information, such as user identity fields and mobile phone number fields, which can only be displayed to the department to which the data belongs, and cannot be displayed to non-delegating departments.

[0005] There is currently no effective solution for how to implement query permission management for data in a Hive data warehouse. Summary of the invention

[0006] The purpose of the present application is to provide a view creation method, device and computer-readable storage medium, which can realize controllable setting of access rights to Hive views.

[0007] The present application provides a view creation method, device and computer-readable storage medium which are implemented as follows:

[0008] A view creation method, the method comprising:

[0009] Get rule configuration information;

[0010] Generate a view creation statement according to the rule configuration information;

[0011] Call the Hive interface and create the target view using the view creation statement;

[0012] By authorizing roles and assigning users to roles, access permissions are set for the target view and a data query interface is provided.

[0013] In one embodiment, by authorizing roles and assigning users to roles, setting access permissions for the target view includes:

[0014] Create a view database;

[0015] Create the same number of roles as view databases;

[0016] Grant database-level access permissions to roles;

[0017] Add the Hive user to the role so that the user inherits the access permissions of the role.

[0018] In one embodiment, generating a view creation statement according to the rule configuration information includes:

[0019] Connect to the metadata database of the Hive table and read the field names in the metadata database;

[0020] Combining the field name in the metadata database with the rule configuration information to generate a view creation statement;

[0021] Accordingly, the Hive interface is called to create the target view through the view creation statement, including:

[0022] Connect to the Hive cluster, call the Hive interface, and create the target view using the view creation statement.

[0023] In one embodiment, generating a view creation statement according to the rule configuration information includes:

[0024] Get the permission scope field in the rule configuration information;

[0025] Determine whether it is a shared view according to the permission range field;

[0026] In the case where it is determined that it is not a shared view, the user region mapping table is associated through a control field, wherein the scope of the results returned by the user query is controlled by the control field to be data within the region within the jurisdiction;

[0027] Connect to the Hive cluster, call the Hive interface, and create the target view using the view creation statement.

[0028] In one embodiment, generating a view creation statement according to the rule configuration information includes:

[0029] Determine whether the view library in the rule configuration information is a sensitive view library;

[0030] When it is determined that the view library in the rule configuration information is a sensitive view library, applying an encryption function to the sensitive field and outputting it as the original field;

[0031] When it is determined that the view library in the rule configuration information is not a sensitive view library, the values ​​of all fields are returned as original values;

[0032] Connect to the Hive cluster, call the Hive interface, and create the target view using the view creation statement.

[0033] In one embodiment, after setting access rights for the target view, the method further includes:

[0034] Receive requests from the configuration center for dynamic update permissions;

[0035] In response to the request for dynamically updating permissions, the access permissions set for the target view are updated.

[0036] In one implementation, obtaining rule configuration information includes:

[0037] Batch read multiple configuration rules from multiple channels;

[0038] The multiple paths include at least one of the following: a relational database, a shared file storage, and a configuration center.

[0039] In one embodiment, after setting access rights for the target view by authorizing roles and assigning users to roles, and providing a data query interface, the method further includes:

[0040] Receive the user's view query request;

[0041] generating a view query statement in response to the view query request;

[0042] Connect to the Hive cluster, call the Hive cluster interface, and execute the view query statement;

[0043] Receives query results returned by the Hive cluster. If the user has query permissions, the query results are returned. If the user does not have query permissions, a prompt message indicating that the user does not have query permissions is returned.

[0044] A view creation device, comprising:

[0045] The acquisition module is used to obtain rule configuration information;

[0046] A generation module, used to generate a view creation statement according to the rule configuration information;

[0047] A creation module is used to call the Hive interface and create a target view through the view creation statement;

[0048] The setting module is used to set access permissions for the target view by authorizing roles and assigning users to roles, and provide a data query interface.

[0049] A computer-readable storage medium having computer instructions stored thereon, wherein the instructions, when executed, implement the steps of the following method:

[0050] Get rule configuration information;

[0051] Generate a view creation statement according to the rule configuration information;

[0052] Call the Hive interface and create the target view using the view creation statement;

[0053] By authorizing roles and assigning users to roles, access permissions are set for the target view and a data query interface is provided.

[0054] The view creation method and device provided by the present application obtain rule configuration information, generate a view creation statement according to the rule configuration information; call the Hive interface, create a target view through the view creation statement; set access rights for the target view by authorizing roles and assigning users to roles, and provide a data query interface. When building a Hive view, efficient access rights setting can be achieved by setting access rights based on role levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0056] Figure 1 It is a method flow chart of an embodiment of the view creation method provided by the present application;

[0057] Figure 2 This is an architecture diagram of a system for implementing Hive data access permission control provided by this application;

[0058] Figure 3 This is a flowchart of the steps of the permission rule configuration service module provided by this application;

[0059] Figure 4 It is a step flow chart of the view query module provided by this application;

[0060] Figure 5 It is a flowchart of the steps of the view creation module provided by this application;

[0061] Figure 6 It is a hardware structure block diagram of an electronic device of a view creation method provided by the present application;

[0062] Figure 7 It is a schematic diagram of the module structure of an embodiment of the view creation module provided by the present application. DETAILED DESCRIPTION

[0063] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0064] Hive view is a query statement defined on the original table. When querying with a view, the query statement defined by the view is combined with the user's query statement. It can be imagined that Hive first executes the view and then uses the result for subsequent queries. For views, a common usage scenario is to limit the output results based on the values ​​of one or more columns. Therefore, views can be used as a security mechanism, that is, users are not given direct access to the original data table with security control requirements, but a view with limited meaning is provided to users for query.

[0065] In Hive, you can grant or revoke permissions to users and roles. In Hive, users are system user names, and permissions to databases, tables under the database, and views can be granted to users. If there are many tables and many users, granting user-level permissions will result in high operation and maintenance costs. Authorization based on role level is relatively better. A role contains multiple users, and a user can belong to different roles. Users can be placed in roles and can authorize roles at the same time.

[0066] In this example, accurate and flexible control of data access permissions is achieved by using Hive views and Hive roles. Specifically, a view creation method is provided, such as Figure 1 As shown, the following steps may be included:

[0067] Step 101: Obtain rule configuration information;

[0068] Step 102: Generate a view creation statement according to the rule configuration information;

[0069] Step 103: Call the Hive interface to create a target view using the view creation statement;

[0070] Step 104: By authorizing roles and assigning users to roles, access permissions are set for the target view, and a data query interface is provided.

[0071] In the above example, the rule configuration information is obtained, and a view creation statement is generated according to the rule configuration information; the Hive interface is called to create the target view through the view creation statement; the access rights are set for the target view by authorizing roles and assigning users to roles, and a data query interface is provided. When building Hive views, efficient access rights settings can be achieved by setting access rights based on role levels.

[0072] Considering that you can create a view database first, then create the same number of roles as the databases, and grant the roles database-level permissions. Add Hive users to the roles. Since users can inherit the permissions of the roles, users also have access rights to the views under the database. Since the original table does not grant user permissions, users cannot access the original table and can only access the views, thereby achieving the purpose of precise permission control through views. Specifically, by authorizing roles and assigning users to roles, setting access rights for the target view may include: creating a view database; creating the same number of roles as the view database; granting database-level access rights to the roles; adding Hive users to the roles so that users inherit the access rights of the roles.

[0073] In one embodiment, generating a view creation statement according to the rule configuration information may include: connecting to the metadata database of the Hive table and reading the field names in the metadata database; combining the field names in the metadata database with the rule configuration information to generate a view creation statement; correspondingly, calling the Hive interface and creating a target view through the view creation statement, including: connecting to the Hive cluster, calling the Hive interface, and creating a target view through the view creation statement. That is, using a rule-configured approach to create a view with permission control can complete a large number of tasks, reduce resources consumed by manually writing view statements, and avoid human error factors.

[0074] Specifically, when generating a view creation statement according to the rule configuration information, the authority scope field in the rule configuration information can be obtained; determine whether it is a shared view according to the authority scope field; if it is determined that it is not a shared view, associate the user region mapping table through the control field, wherein the scope of the user query return result is controlled by the control field to be the data of the region within the jurisdiction; connect to the Hive cluster, call the Hive interface, and create the target view through the view creation statement.

[0075] For example, taking the regional control view data permissions as an example, you can use current_user (system built-in function) in Hive to obtain the current user, associate the Hive table User_Zone_Ctrl (region and user mapping table) to obtain the user's region, and then associate it with the field value in the original table (for example: region number). Only query results of the original table that meet the conditions are returned, so as to control the user's access to data.

[0076] In order to realize encryption processing of sensitive fields by views, when generating a view creation statement according to the rule configuration information, it can be determined whether the view library in the rule configuration information is a sensitive view library; when it is determined that the view library in the rule configuration information is a sensitive view library, the encryption function is applied to the sensitive fields and then output as the original fields; when it is determined that the view library in the rule configuration information is not a sensitive view library, the values ​​of all fields are returned as original values; the Hive cluster is connected, the Hive interface is called, and the target view is created through the view creation statement.

[0077] For example, the view library can be divided into two categories, such as non-sensitive VIEW_DB_A and sensitive VIEW_DB_B. The values ​​of all fields in the view under the non-sensitive view library are returned in their original values, while the fields of the view under the sensitive view library, such as user ID cards, mobile phone numbers and other privacy information, need to be encrypted before being returned.

[0078] Considering the large number of tables in the Hive data warehouse, manually creating multiple views of different types for each original table is very labor-intensive and error-prone. To this end, in this example, data permission rule configuration is used, and then the view creation statement is generated according to the rule, and then the Hive interface is called to complete the view creation. For example, the configuration center can be used. When the permission rule configuration changes, the view associated with the permission rule can be dynamically refreshed, thereby reducing the cost of modifying the rule. For example, after setting access permissions for the target view, a request for dynamic update permissions from the configuration center can also be received; in response to the request for dynamic update permissions, the access permissions set for the target view are updated.

[0079] When acquiring rule configuration information, multiple configuration rules may be read in batches from multiple channels; wherein the multiple channels may include but are not limited to at least one of the following: a relational database, a shared file storage, and a configuration center.

[0080] After setting access rights for the target view by authorizing roles and assigning users to roles, and providing a data query interface, the user's view query request can be received; a view query statement can be generated in response to the view query request; the Hive cluster is connected, the Hive cluster interface is called, and the view query statement is executed; the query result returned by the Hive cluster is received, and if the user has the query permission, the query content result is returned, and if the user does not have the query permission, a prompt message of no query permission is returned. That is, the user's query request for the Hive view can be realized.

[0081] The above method is described below in conjunction with a specific embodiment. However, it should be noted that this specific embodiment is only for better illustrating the present application and does not constitute an improper limitation on the present application.

[0082] In this example, a general system and method for implementing Hive data access permission control is provided, thereby safely and flexibly solving the problem of query permissions for accessing data.

[0083] In this example, Hive views and Hive roles are used to achieve accurate and flexible control of data access permissions. First, create a view database, then create the same number of roles as databases, and grant the roles database-level permissions.

[0084] Add Hive users to roles. Since users can inherit the permissions of roles, they also have access to views in the database. Since users are not granted permissions on the original table, users cannot access the original table but can only access views, thus achieving the purpose of precise permission control through views.

[0085] In this example, we take the regional control view data permissions as an example. Specifically, we can use the current_user (system built-in function) in Hive to obtain the current user, associate the Hive table User_Zone_Ctrl (region and user mapping table) to obtain the region to which the user belongs, and then associate it with the field value in the original table (for example, region number). Only query results of the original table that meet the conditions are returned, so as to control the user's access to data.

[0086] Considering the large number of tables in the Hive data warehouse, manually creating multiple views of different types for each original table is very labor-intensive and error-prone. To this end, in this example, data permission rule configuration is used, and then the view creation statement is generated according to the rule, and then the Hive interface is called to complete the view creation. For example, the configuration center can be used to dynamically refresh the views associated with the permission rule when the permission rule configuration changes, thereby reducing the cost of modifying the rules.

[0087] like Figure 2 As shown, this example provides a system for implementing Hive data access permission control, which may include: permission rule configuration service module 201, view creation module 202, view authorization module 203, and view query module 204. Among them:

[0088] The permission rule configuration service module 201 is used to provide permission release rule configuration services and can accept multiple configuration methods.

[0089] The view creation module 202 is used to call the permission rule configuration service module 201 to obtain configuration information, generate a view statement according to the rule logic and source table field information, and then connect to the Hive cluster to create a view.

[0090] The view authorization module 203 is used to grant the view query authority to the user;

[0091] The view query module 204 is used to provide a user query interface, and after a query statement is input, the query result can be returned.

[0092] like Figure 3 As shown, it is a flowchart of the steps of the permission rule configuration service module 201, in which the module supports multiple types of data source acquisition methods, including: relational database (such as MYSQL relational database), shared file storage method (such as HDFS distributed storage), configuration center (such as Apollo configuration center). The specific steps are as follows:

[0093] Step 1: Pull rule configuration information from the relational database and read multiple configuration rules in batches at one time. The permission rule configuration is stored in a table, such as hive_view_regulation_info, and the field format can be as shown in Table 1 below.

[0094] The newly created view name can be named in the format of "view library name.view name", and the view belongs to the corresponding view library. The table name is the original table name of the view, and the fields of the view come from this table. The permission scope indicates whether the output scope of the query results needs to be controlled for this view, which can be empty. When the output scope of the results needs to be controlled, the control field name is used to associate with the configuration table of the user's scope.

[0095] Table 1

[0096] View Name View library name Table name Scope of authority Control field name A_VIEW_1 DB_VIEW_A A_TABLE_1 1 B_VIEW_1 DB_VIEW_B B_TABLE_1 2 ZONENO

[0097] The meaning of the dictionary value of the permission range can be shown in the following Table 2:

[0098] Table 2

[0099] Dictionary Values meaning 1 Shared view, full data open query 2 Limited shared views require control over the scope of user query data

[0100] Step 2: Pull rule configuration information from the shared file storage and read multiple configuration rules in batches at one time. The shared file storage uses HDFS (distributed file storage) files to save configuration content in a csv (comma-separated) format. The number of fields in each row is consistent with the table structure in the database in step 1. The advantage of this configuration information storage method is that it can save large amounts of data configuration, and the data is not easily lost, and the data reading method is reliable.

[0101] Step 3: Pull permission configuration information from the configuration center. By introducing the configuration center, the permission configuration is updated dynamically. When the configuration setting is unreasonable and needs to be modified, the configuration of the configuration center is updated, and the configuration center sends an update notification, which can eventually update the permission control rules of the view.

[0102] Step 4: Application system B connects to the configuration center and sends a request to update the permission configuration.

[0103] Step 5: Application system B connects to the shared storage system and writes new or overwrites configuration files. The configuration can be written in batches.

[0104] Step 6: Application system B connects to the relational database and inserts or updates the permission configuration table. The configuration can be written in batches.

[0105] like Figure 4 The structure diagram is shown. The solution provided in this example supports distributed multi-user concurrent operations. User A sends a request to build a view online, and user B can query the newly created view in real time. The view creation module 202 starts multiple processes to support multi-user operations.

[0106] Call the permission rule configuration service module 201 to obtain the permission configuration rules. Connect to the metadata library of the Hive table and read the field names of the original table. Combine the rules and the original table fields to generate view statements, connect to the Hive cluster, and call the Hive interface to complete the view creation. Using rule configuration to create permission-controlled views can complete large batches of tasks, reduce resources consumed by manually writing view statements, and avoid human error factors.

[0107] The permission rule configuration service module 201 can read the configuration of multiple data sources, which improves the flexibility and diversity of the configuration. In particular, the configuration center supports dynamic updates of the configuration, which can realize the real-time effectiveness of view permission updates. The view query module 204 connects to the Hive cluster and provides user query interface services. After the query view statement is entered, the statement is sent to the Hive cluster, and the returned result is returned to the user.

[0108] Specific steps may include:

[0109] Step 1: User A sends a request to create a Hive view.

[0110] Step 2: Connect to the metadata database of the Hive table and obtain the field information of the original table. For example, to create the A_VIEW_1 view, you need to first obtain all the field names of the A_TABLE_1 table. Hive table information is stored in the metadata database of the Hive table. If the table needs to refresh the view after the field name is updated, you can read the field from the metadata database of the Hive table again and update the view statement.

[0111] Step 3: After the view statements are spliced, connect to the Hive cluster, call the Hive cluster interface, and execute the create view command.

[0112] Step 4: User B calls the view query module 204 and sends a view query statement.

[0113] Step 5: The view query module 204 connects to the Hive cluster, calls the Hive cluster interface, and executes the query view command.

[0114] Step 6: The Hive cluster returns the query results. If the view does not grant permissions to the user, an error message "User B does not have query permissions for the view" is returned.

[0115] Step 7: The view query module 204 returns the query results to the user.

[0116] like Figure 5 As shown, it is a flow chart of the view creation module 203. The view creation module 203 converts the configuration rules into view definition statements, then connects to the Hive cluster, calls the view creation command, and completes the view creation function. The view creation module 203 provides a service interface to the outside world. The outside world only needs to call this interface to complete the creation of complex views. It contains important components such as view generators and view creators. In the current big data context, the number of Hive tables that need to be controlled is very large. The view creation module 203 can greatly simplify the creation of permission-controlled views. And when the permission rules change, the view creation module 203 can also obtain the latest configuration in time and complete the work of refreshing the view, so as to achieve the purpose of flexible control and dynamic adjustment of permissions.

[0117] The process of view creation by the view creation module 203 may include:

[0118] Step 1: Call the interface of the permission rule configuration service module 201 to obtain rule configuration information.

[0119] Step 2: The service process reads the rule information, loads it into memory, and parses the configuration information.

[0120] If the rule information comes from a relational database table, a simple object is created for each record, and the field values ​​are set to the corresponding object attributes.

[0121] Step 3: Read the permission scope field of the rule configuration to determine whether it is a shared view. If the value is 1, the permission scope does not need to be controlled, and go to step 5. If the value is 2, the permission scope needs to be controlled, and go to step 4.

[0122] Step 4: Associate the user region mapping table with the control field.

[0123] Taking the regional control method as an example, the view uses the regional field to control the scope of the user query return results, limiting the user to query only the data within the region under their jurisdiction. The user's region is stored in the Hive table, for example: the user region table User_Zone_Ctrl, which has two fields: user name and region. The Hive database function current_user (public function) can obtain the user name of the current query user. The view original table is associated with the user region table User_Zone_Ctrl, and the association condition is that the region field value of the original table exists in the region of the current query user. The SQL association syntax "LEFT SEMIJOIN" is used. The processing logic of this syntax is to match the condition field value of the left table with the field value of the right table. As long as the first record that meets the condition is found in the right table, the record of the left table can be returned. In this way, the records of the left table that meet the control requirements can be returned, and when there are multiple matching data in the right table, the data of the returned results will not be repeated.

[0124] The structure of the user zone table User_Zone_Ctr may be as shown in Table 3 below:

[0125] Table 3

[0126] user_name(user name) zone_num(region) USER_1 10001 USER_1 10002 USER_2 20002

[0127] Taking the original table A_VIEW_1 and the user zone table User_Zone_Ctrl as an example, the grammatical structure of the association statement can be expressed as follows:

[0128] B_VIEW_1T1 LEFT SEMI JOIN User_Zone_Ctrl T2

[0129] ON cast(T1.ZONENO as int)=cast(T2.zone_num as int)

[0130] and T2.user_name=current_user()

[0131] Step 5: Get the field names of the data table and the field comments of the table.

[0132] The table metadata information of the Hive database is stored in the relational database, and its information includes table name, field name, field comment, etc. The fields defined in the view are consistent with the fields of the original table. The view is a statement that controls the logic, and its query usage is the same as that of the original table.

[0133] Step 6: Determine whether the view library in the rule information is a sensitive information shielding type.

[0134] First, divide the view library into two categories, for example: non-sensitive class VIEW_DB_A, sensitive class VIEW_DB_B. Among them, the values ​​of all fields of the view under the non-sensitive class view library are returned in their original values, and the fields of the view under the sensitive class view library, such as the user's ID card, mobile phone number and other privacy, need to be encrypted before returning. If the view library is a non-sensitive class, go to step 8, and if the view library is a sensitive class, go to step 7.

[0135] Step 7: The field name is encrypted and then output as the original field name. Identify sensitive fields based on the field annotations, such as the ID card field CUSTOMER_NO:

[0136] UDF.Certificates(CUSTOMER_NO)AS CUSTOMER_NO.

[0137] Step 8: Join the association conditions and table fields into a view statement. For example, in the sensitive class view library, the region controls the query scope, and the final view statement is:

[0138] CREATE VIEW VIEW_DB_B.B_VIEW_1AS

[0139] SELECT T1.colum1,UDF.Certificates(CUSTOMER_NO)AS CUSTOMER_NO,....

[0140] FROM B_TABLE_1T1 LEFT SEMI JOIN User_Zone_Ctrl T2

[0141] ON T1.ZONENO=T2.ZONE_NUM AND T2.USER_NAME=current_user()

[0142] Step 9: Connect to the Hive cluster and create a view. Generate the view statement, connect to the Hive cluster, call the view creation command, and the view creation is complete.

[0143] Flowchart of view authorization module 203. The view grants the user query permission by calling the grantSelect authorization interface. In the case where there are many users who need to access the view, it is cumbersome to perform authorization for each user. Therefore, in this example, a new role is created, users are added to the role, and the view is granted to the role. Through this indirect authorization method, the user is given the permission to query the view. The control permissions are divided into several categories using the view library, such as full-business shared views, partial business access views, sensitive views, and non-sensitive views. When the query permission of the view library is granted to a role, the Hive database features this role to have query permission on all views under the view library, and all users in this role also have query permission on the view.

[0144] The steps of the view authorization module 203 may include:

[0145] Step 1: Create new user roles and create roles corresponding to the number of view libraries.

[0146] Step 2: Add a user name to the user role. Connect to the Hive cluster, call the Hive interface, and add a role.

[0147] Step 3: Grant the view library query permission to the user role. Connect to the Hive cluster, call the Hive interface, and grant the role the view library query permission.

[0148] Furthermore, view types can be divided into: shared views without rule control, shared views controlled by rules, and unshared views that require authorization. Each type is further divided into first-class views and second-class views. First-class views encrypt sensitive field information, while second-class views do not encrypt. The processing rules can be:

[0149] 1) For open shared views, the first type of view is a full display of entity table data, and the second type of view encrypts sensitive fields. The permissions of the view library have been granted to specified users. After the view is created, the specified users have the right to access it.

[0150] 2) For shared views controlled by rules, the general rule is to control access by region. You need to use the rule field of the table to associate another rule range table, that is, the table of regions under the jurisdiction of the user. You can use multiple rules and take the union of the rules, that is, any condition that is met can display data.

[0151] 3) For unshared views that require authorization, the first type of view is a full display of entity table data, and the second type of view encrypts sensitive fields. The permissions of the view library are not granted to specified users. After the view is created, users can access it only after authorization through the view authorization device.

[0152] Specifically, the view types may include but are not limited to the following:

[0153] Domestic head office non-sensitive view (bdpview), all information and all fields are not blocked;

[0154] Domestic head office sensitive view (bdpviewb), sensitive fields are shielded;

[0155] Domestic branch non-sensitive view (bdpviewx), all information and fields are not blocked. At the same time, it is necessary to determine whether it is necessary to associate User_Zone_Ctrl for regional control according to whether it is controlled by region;

[0156] Domestic branch sensitive view (bdpviewxb), at the same time, according to whether it is controlled by region, it is necessary to determine whether User_Zone_Ctrl needs to be associated for regional control;

[0157] The head office non-shared non-sensitive view (other_bdpview) contains all information and fields without masking.

[0158] Non-shared sensitive view of the head office (other_bdpviewb), sensitive fields are shielded;

[0159] For non-shared and non-sensitive views of branches (other_bdpviewx), all information and fields are not blocked. At the same time, it is necessary to determine whether User_Zone_Ctrl needs to be associated for regional control based on whether it is controlled by region.

[0160] For branch non-shared sensitive views (other_bdpviewxb), sensitive fields are shielded. At the same time, it is necessary to determine whether User_Zone_Ctrl needs to be associated for regional control based on whether it is controlled by region.

[0161] For the non-sensitive view of overseas branches (fcm_bdpviewx), all information and fields are not blocked. It is necessary to determine whether User_Zone_Ctrl needs to be associated for regional control based on whether it is controlled by region.

[0162] For the sensitive view of overseas branches (fcm_bdpviewxb), sensitive fields are shielded. It is necessary to determine whether User_Zone_Ctrl needs to be associated for regional control based on whether it is controlled by region.

[0163] Through the above solution, the security of Hive data access can be increased, fine-grained control authorization can be achieved, and the risk of information leakage can be prevented, thereby improving the accuracy and real-time performance of data access control. It can ensure that the accessed data range is accurate, and the permission rules are modified and effective online in real time. It can meet the needs of large enterprises for flexible control of permissions for massive data and provide an efficient and reliable method for query permission control.

[0164] The method embodiments provided in the above embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on an electronic device as an example, Figure 6 is a hardware structure block diagram of an electronic device of a view creation method provided by this application. Figure 6 As shown, the electronic device 10 may include one or more (only one is shown in the figure) processors 02 (the processor 02 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 04 for storing data, and a transmission module 06 for communication functions. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations are shown.

[0165] The memory 04 can be used to store software programs and modules of application software, such as program instructions / modules corresponding to the view creation method in the embodiment of the present application. The processor 02 executes various functional applications and data processing by running the software programs and modules stored in the memory 04, that is, the view creation method of the above-mentioned application is realized. The memory 04 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 04 may further include a memory remotely arranged relative to the processor 02, and these remote memories may be connected to the electronic device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0166] The transmission module 06 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 10. In one example, the transmission module 06 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 06 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0167] At the software level, the above view creation device can be as follows Figure 7 As shown, including:

[0168] The acquisition module 701 is used to acquire rule configuration information;

[0169] A generating module 702, configured to generate a view creation statement according to the rule configuration information;

[0170] A creation module 703 is used to call a Hive interface and create a target view through the view creation statement;

[0171] The setting module 704 is used to set access permissions for the target view by authorizing roles and assigning users to roles, and to provide a data query interface.

[0172] In one implementation, the setting module 704 may specifically create a view database; create roles with the same number as the view database; grant database-level access permissions to the roles; and add Hive users to the roles so that the users inherit the access permissions of the roles.

[0173] In one embodiment, the generation module 702 can specifically connect to the metadata database of the Hive table and read the field names in the metadata database; combine the field names in the metadata database with the rule configuration information to generate a view creation statement; correspondingly, the creation module 704 can specifically connect to the Hive cluster, call the Hive interface, and create the target view through the view creation statement.

[0174] In one embodiment, the generation module 702 can specifically obtain the authority scope field in the rule configuration information; determine whether it is a shared view based on the authority scope field; if it is determined that it is not a shared view, associate the user region mapping table through the control field, wherein the scope of the user query return result is controlled by the control field to be the data of the region within the jurisdiction; connect to the Hive cluster, call the Hive interface, and create the target view through the view creation statement.

[0175] In one implementation, the generation module 702 can specifically determine whether the view library in the rule configuration information is a sensitive view library; if it is determined that the view library in the rule configuration information is a sensitive view library, apply an encryption function to the sensitive field and output it as the original field; if it is determined that the view library in the rule configuration information is not a sensitive view library, return the values ​​of all fields as original values; connect to the Hive cluster, call the Hive interface, and create the target view through the view creation statement.

[0176] In one embodiment, the view creation device may further specifically receive a request from a configuration center to dynamically update permissions after setting access permissions for the target view; and update the access permissions set for the target view in response to the request to dynamically update permissions.

[0177] In one implementation, the acquisition module 701 may specifically read multiple configuration rules in batches from multiple channels; wherein the multiple channels include at least one of the following: a relational database, a shared file storage, and a configuration center.

[0178] In one embodiment, the above-mentioned view creation device can also specifically receive a user's view query request after setting access permissions for the target view by authorizing roles and assigning users to roles, and providing a data query interface; generate a view query statement in response to the view query request; connect to the Hive cluster, call the Hive cluster interface, and execute the view query statement; receive the query result returned by the Hive cluster, and return the query content result if the user has the query permission, and return a prompt message of no query permission if the user does not have the query permission.

[0179] The embodiments of the present application also provide a specific implementation of an electronic device capable of implementing all the steps in the view creation method in the above embodiments, wherein the electronic device specifically includes the following contents: a processor, a memory, a communications interface, and a bus; wherein the processor, the memory, and the communications interface communicate with each other through the bus; the processor is used to call a computer program in the memory, and when the processor executes the computer program, all the steps in the view creation method in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0180] Step 1: Get rule configuration information;

[0181] Step 2: Generate a view creation statement according to the rule configuration information;

[0182] Step 3: Call the Hive interface and create the target view using the view creation statement;

[0183] Step 4: By authorizing roles and assigning users to roles, access permissions are set for the target view and a data query interface is provided.

[0184] From the above description, it can be seen that the embodiment of the present application obtains rule configuration information, generates a view creation statement according to the rule configuration information; calls the Hive interface, creates a target view through the view creation statement; sets access rights for the target view by authorizing roles and assigning users to roles, and provides a data query interface. When building a Hive view, efficient access rights setting can be achieved by setting access rights based on role levels.

[0185] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps in the view creation method in the above embodiments. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps in the view creation method in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0186] Step 1: Get rule configuration information;

[0187] Step 2: Generate a view creation statement according to the rule configuration information;

[0188] Step 3: Call the Hive interface and create the target view using the view creation statement;

[0189] Step 4: By authorizing roles and assigning users to roles, access permissions are set for the target view and a data query interface is provided.

[0190] From the above description, it can be seen that the embodiment of the present application obtains rule configuration information, generates a view creation statement according to the rule configuration information; calls the Hive interface, creates a target view through the view creation statement; sets access rights for the target view by authorizing roles and assigning users to roles, and provides a data query interface. When building a Hive view, efficient access rights setting can be achieved by setting access rights based on role levels.

[0191] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0192] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0193] Although the present application provides method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the actual device or client product is executed, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment).

[0194] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0195] Although the present specification embodiment provides the method operation steps as described in the embodiment or flow chart, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiment is only one way in the order of execution of many steps, and does not represent a unique execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel (such as a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment) according to the method shown in the embodiment or the accompanying drawings. The term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements not only includes those elements, but also includes other elements not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements.

[0196] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0197] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0198] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0199] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0200] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0201] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0202] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0203] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0204] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0205] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0206] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0207] The above is only an example of the embodiment of the present specification and is not intended to limit the embodiment of the present specification. For those skilled in the art, the embodiment of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiment of the present specification shall be included in the scope of the claims of the embodiment of the present specification.

Claims

1. A view creation method, characterized in that: The method comprises: Get rule configuration information; Generate a view creation statement according to the rule configuration information; Call the Hive interface and create the target view using the view creation statement; By authorizing roles and assigning users to roles, access permissions are set for the target view, and a data query interface is provided; The generating of the view creation statement according to the rule configuration information includes: determining whether the view library in the rule configuration information is a sensitive view library; if it is determined that the view library in the rule configuration information is a sensitive view library, applying an encryption function to the sensitive fields and outputting them as original fields; if it is determined that the view library in the rule configuration information is not a sensitive view library, returning the values ​​of all fields as original values; connecting to the Hive cluster, calling the Hive interface, and creating the target view through the view creation statement; When the permission rule configuration changes, the view associated with the permission rule is dynamically refreshed through the configuration center; The step of setting access permissions for the target view by authorizing the role and assigning the user to the role includes: Create a view database; Create the same number of roles as view databases; Grant database-level access permissions to roles; Add the Hive user to the role so that the user inherits the access permissions of the role.

2. The method according to claim 1, characterized in that Generate a view creation statement according to the rule configuration information, including: Connect to the metadata database of the Hive table and read the field names in the metadata database; Combining the field name in the metadata database with the rule configuration information to generate a view creation statement; Accordingly, the Hive interface is called to create the target view through the view creation statement, including: Connect to the Hive cluster, call the Hive interface, and create the target view using the view creation statement.

3. The method according to claim 1, characterized in that Generate a view creation statement according to the rule configuration information, including: Get the permission scope field in the rule configuration information; Determine whether it is a shared view according to the permission range field; In the case where it is determined that it is not a shared view, the user region mapping table is associated through a control field, wherein the scope of the results returned by the user query is controlled by the control field to be data within the region within the jurisdiction; Connect to the Hive cluster, call the Hive interface, and create the target view using the view creation statement.

4. The method according to claim 1, characterized in that: After setting access permissions for the target view, also include: Receive requests from the configuration center for dynamic update permissions; In response to the request for dynamically updating permissions, the access permissions set for the target view are updated.

5. The method according to claim 1, characterized in that Get rule configuration information, including: Batch read multiple configuration rules from multiple channels; Among them, the multiple approaches include at least one of the following: a relational database, a shared file storage, and a configuration center.

6. The method according to claim 1, characterized in that After setting access rights for the target view by authorizing roles and assigning users to roles, and providing a data query interface, the following steps are also included: Receive the user's view query request; generating a view query statement in response to the view query request; Connect to the Hive cluster, call the Hive cluster interface, and execute the view query statement; Receives query results returned by the Hive cluster. If the user has query permissions, the query results are returned. If the user does not have query permissions, a prompt message indicating that the user does not have query permissions is returned.

7. A view creation device, characterized in that: include: The acquisition module is used to obtain rule configuration information; A generation module, used to generate a view creation statement according to the rule configuration information; A creation module is used to call the Hive interface and create a target view through the view creation statement; A setting module is used to set access rights for the target view by authorizing roles and assigning users to roles, and to provide a data query interface; The generating module is specifically used to determine whether the view library in the rule configuration information is a sensitive view library; if it is determined that the view library in the rule configuration information is a sensitive view library, the encryption function is applied to the sensitive field and then output as the original field; When it is determined that the view library in the rule configuration information is not a sensitive class view library, the values ​​of all fields are returned as original values; the Hive cluster is connected, the Hive interface is called, and the target view is created through the view creation statement; When the permission rule configuration changes, the view associated with the permission rule is dynamically refreshed through the configuration center; The step of setting access permissions for the target view by authorizing the role and assigning the user to the role includes: Create a view database; Create the same number of roles as view databases; Grant database-level access permissions to roles; Add the Hive user to the role so that the user inherits the access permissions of the role.

8. A computer-readable storage medium having computer instructions stored thereon, wherein the instructions, when executed, implement the steps of the method according to any one of claims 1 to 6.

Images