Data permission processing method, device and server

Abstract

Embodiments of the present application provide a data authority processing method and device and a server, wherein the method comprises: obtaining a business role list of a current user account; determining a resource policy of the current user account according to the business role list; performing AND or NOT logic operation on resource data corresponding to the resource policy of the current user account to obtain authorized resource data of the current user account. In this way, the resource policy of the current user account is determined according to the business role list of the current user account, and then the AND or NOT logic operation is performed on the resource data corresponding to the resource policy of the current user account to obtain the authorized resource data of the current user account, without the need to splice SQL statements related to data authority and without the need to change the logic of calling data in the application layer, so that the data authority authorization can be realized in a non-intrusive manner, and the authorization processing efficiency of the data authority is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a data permission processing method and device and a server. BACKGROUND

[0002] In the prior art, each system needs to be designed with permissions, and the permission design is divided into function permissions and data permissions. The data permissions refer to different ranges of data that can be seen or edited by users with different identities in a platform or information system. For example, a business manager can only see customer data of himself, but a business director can see customer data of business clerks in each region.

[0003] At present, the data permission implementation schemes mainly include the following two schemes: 1. A data permission is implemented by using SQL language, and a prerequisite condition for data that can be seen by a user is specified by using a where statement; and 2. A configuration method is used, in which a condition for data that can be seen by a user with different identities is recorded in a configuration table, and then the condition is spliced according to or and logical relations to generate a corresponding SQL statement, and the SQL statement is executed to obtain a result. The existing data permission implementation schemes are essentially SQL statement splicing permission conditions, and the result is obtained by filtering according to the permission conditions. However, the SQL statement splicing is business intrusive, and a permission query condition must be nested in an original business SQL statement. The original business interface without permission must be modified to implement the data permission, and the business intrusion has a cost, and the SQL and / or splicing is extremely troublesome. SUMMARY

[0004] To solve the above technical problems, the embodiments of the present application provide a data permission processing method, device and server.

[0005] In a first aspect, the embodiments of the present application provide a data permission processing method, and the method comprises the following steps.

[0006] Obtaining a business role list of a current user account;

[0007] Determining a resource policy of the current user account according to the business role list;

[0008] Performing an and / or-not logical operation on resource data corresponding to the resource policy of the current user account to obtain authorized resource data of the current user account.

[0009] Optionally, before the step of obtaining the business role list of the current user account, the method further comprises the following steps.

[0010] Establishing at least one role, and configuring at least one resource attribute condition for each role;

[0011] A resource policy corresponding to each resource attribute condition is configured;

[0012] At least one role is assigned to each user account, and a business role list of each user account is generated according to the role of each user account.

[0013] Optionally, the method further comprises:

[0014] A target resource policy corresponding to the role in the business role list is obtained, and the target resource policy comprises a role assertion;

[0015] It is determined whether the role assertion of each target resource policy is true;

[0016] The target resource policy with a true role assertion is taken as the resource policy of the current user account.

[0017] Optionally, the resource policy of the current user account comprises a role assertion, and the role assertion comprises a data determination statement.

[0018] The resource data corresponding to the resource policy of the current user account comprises: obtaining a target resource attribute condition corresponding to the data determination statement, the target resource attribute condition comprising a resource condition expression, and the resource condition expression comprising a resource condition key, an operator and a resource condition value.

[0019] The corresponding resource data is determined according to the resource condition key, the operator and the resource condition value.

[0020] Optionally, the resource condition key comprises a resource association relationship expression, and the resource association relationship expression associates at least two different resources through an association operator.

[0021] The corresponding resource data is determined according to the resource condition key, the operator and the resource condition value.

[0022] The resource association relationship between different resources is determined according to the resource association relationship expression.

[0023] The corresponding resource data is determined according to the resource association relationship, the operator and the resource condition value.

[0024] Optionally, the method further comprises:

[0025] The authorized resource data is filtered according to a user business condition to obtain business resource data.

[0026] In a second aspect, an embodiment of the present application provides a data permission processing device, and the device comprises:

[0027] An acquisition module is configured to acquire a service role list of a current user account.

[0028] A determination module is configured to determine a resource policy of the current user account according to the service role list.

[0029] An operation module is configured to perform AND or NOT logic operation on resource data corresponding to the resource policy of the current user account, to obtain authorized resource data of the current user account.

[0030] In a third aspect, an embodiment of the present application provides a server, including a memory and a processor, the memory is configured to store a computer program, the computer program performs the data authority processing method provided in the first aspect when the processor runs.

[0031] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, the computer program performs the data authority processing method provided in the first aspect when running on a processor.

[0032] The data authority processing method, device and server provided by the present application can acquire a service role list of a current user account, determine a resource policy of the current user account according to the service role list, and perform AND or NOT logic operation on resource data corresponding to the resource policy of the current user account, to obtain authorized resource data of the current user account. In this way, the resource policy of the current user account is determined according to the service role list of the current user account, AND or NOT logic operation is performed on resource data corresponding to the resource policy of the current user account, to obtain authorized resource data of the current user account, without the need to splice SQL statements related to data authority, or to change the logic of calling data in the application layer, so that the data authority authorization can be realized without business invasion, the content of the resource policy is rich and flexible, the resource policy can be configured or extended, various business requirements can be connected, the authorization processing steps of the data authority are simplified, and the authorization processing efficiency of the data authority is improved. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the protection scope of the present application. In the various drawings, similar components are denoted by similar reference numerals.

[0034] Figure 1 A flowchart of a data authority processing method provided by an embodiment of the present application is shown;

[0035] Figure 2 A schematic diagram of the correspondence between a role, a resource attribute condition and a resource policy is shown.

[0036] Figure 3 A flowchart of a process of selecting a resource policy is shown;

[0037] Figure 4 A structural diagram of a resource condition expression is shown;

[0038] Figure 5 A structural diagram of a data authority processing apparatus is shown. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application.

[0040] The components of the embodiments of the present application generally described and illustrated herein can be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work are within the scope of protection of the present application.

[0041] Hereinafter, the terms "include", "have", and their conjugates, used in the various embodiments of the present application, are merely intended to denote a certain characteristic, number, step, operation, element, component, or a combination thereof, and should not be construed to exclude the existence or possibility of additional one or more characteristics, numbers, steps, operations, elements, components, or combinations thereof.

[0042] In addition, the terms "first", "second", "third", and the like are used only to distinguish descriptions, and should not be understood as indicating or implying relative importance.

[0043] Unless otherwise defined, all terms used herein (including technical terms and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of the present application belong. The terms (such as those defined in a generally used dictionary) will be interpreted as having the same meaning as the contextual meaning in the relevant technical field and will not be interpreted as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of the present application.

[0044] Embodiment 1

[0045] The embodiment of the present disclosure provides a data permission processing method.

[0046] Specifically, referring to Figure 1 , the data permission processing method comprises the following steps.

[0047] In step S101, a business role list of a current user account is acquired.

[0048] In an embodiment, the data permission processing method can be applied to a server, and the server can be installed with a database. It should be noted that a complete authorization context information can be described by a permission four-tuple {R1, R2, A, C}, wherein R1 represents a role (who), R2 represents a resource (what), A represents an action (how), and C represents a condition (when), for example, on the day of March 8 (condition), female colleagues (role) can get movie tickets (resource). The data permission is mainly a permission expression of the resource (resource). In an embodiment, the role permission of the user can follow the RBAC model, and the data permission can follow the ABAC model based on the resource attribute.

[0049] In an embodiment, the corresponding business role list can be configured for the user account according to the user identity, and the user identity can be determined according to the company identity, for example, the user identity can be a company manager or a technical director. The user can determine a plurality of different roles according to the business demand, and each role needs to view the corresponding business data. When the user logs in the user account, the logged-in user account can be taken as the current user account, and the corresponding business role list of the current user account can be determined from the database.

[0050] In an embodiment, before step S101, the data permission processing method can further comprise the following steps.

[0051] At least one role is established, and at least one resource attribute condition is configured for each role;

[0052] A corresponding resource strategy is configured for each resource attribute condition;

[0053] At least one role is assigned to each user account, and a business role list of each user account is generated according to the role of each user account.

[0054] Please refer to Figure 2 , for example Figure 2As shown, role 1, role 2, and role 3 are established, resource attribute condition 1 is configured for role 1, specifically, resource attribute condition 1 is id = 1. Resource attribute condition 2 is configured for role 2, specifically, resource attribute condition 2 is id = 2. Resource attribute condition 3 is configured for role 3, specifically, resource attribute condition 3 is id = 3. Resource policy 1 is configured for resource attribute condition 1, resource policy 2 is configured for resource attribute condition 2, and resource policy 3 is configured for resource attribute condition 3. According to business needs, multiple user accounts can be registered, and at least one role can be assigned to each user account, for example, user account 1 has role 1 and role 2, and user account 2 has role 2 and role 3.

[0055] In this way, the corresponding business role list can be generated for the user account in advance, facilitating subsequent data permission management process according to the business role list.

[0056] In step S102, the resource policy of the current user account is determined according to the business role list.

[0057] In an embodiment, the correspondence between the role and the resource policy can be obtained in advance, the correspondence between the role and the resource policy is searched, and the resource policy corresponding to each role in the business role list is determined.

[0058] The resource policy includes a role assertion, the role assertion includes a condition judgment statement and a data determination statement, the condition judgment statement is used to judge whether the resource policy is effective for the user account, and the data determination statement is used to determine the resource data indicated by the resource policy.

[0059] Please refer again to Figure 2 , Figure 2 The roles include role 1, role 2, and role 3, the resource policy corresponding to role 1 is resource policy 1, the resource policy corresponding to role 2 is resource policy 2, and the resource policy corresponding to role 3 is resource policy 3. The role assertion in resource policy 1 is that if the role list contains role 1, the resource data of resource attribute condition id = 1 is returned. The role assertion in resource policy 2 is that if the role list contains role 2, the resource data of resource attribute condition id = 2 is returned. The role assertion in resource policy 3 is that if the role list contains role 3, the resource data of resource attribute condition id = 3 is returned. For example, in Figure 2 , the resource condition expression can be a resource identity, specifically, the resource identity can be represented by id = 1, id = 2, and id = 3.

[0060] It should be noted that the role assertion can also be other forms of statements, other judgment statements can be used as role assertion statements, which are not limited herein.

[0061] Please refer to Figure 3If the business role list of the current user account includes role 1 and role 3, the role assertion in resource policy 1 is true, the role assertion in resource policy 3 is true, and the current user account can only access resource data with resource identities id = 1 and id = 3.

[0062] In this way, the entire resource policy acquisition is highly efficient and simple in operation steps, without complex processes.

[0063] In an embodiment, step S102 can include the following steps:

[0064] Obtain a target resource policy corresponding to a role in the business role list, the target resource policy including a role assertion;

[0065] Determine whether the role assertion of each target resource policy is true;

[0066] The target resource policy with a true role assertion is used as the resource policy of the current user account.

[0067] For example, referring again to Figure 3 If the business role list of the current user account includes role 1 and role 3, the target resource policies are resource policy 1 and resource policy 3, it is determined whether the role assertion in resource policy 1 is true and whether the role assertion in resource policy 3 is true, and if the role assertion in resource policy 1 is true and the role assertion in resource policy 3 is true, resource policy 1 and resource policy 3 are used as the resource policy of the current user account.

[0068] In step S103, resource data corresponding to the resource policy of the current user account is subjected to logical AND, OR, and NOT operations to obtain authorized resource data of the current user account.

[0069] In this embodiment, without splicing SQL related to data authority and without changing the logic of calling data in the application layer, the business can be implemented without data authority invasion, and the condition expression of the data authority is rich, flexible, configurable, and extensible, without the need to write fixed code, greatly facilitating the connection of various business requirements.

[0070] In an embodiment, step S103 can include the following steps:

[0071] In step S103, resource data corresponding to the resource policy of the current user account is subjected to logical AND, OR, and NOT operations to obtain authorized resource data of the current user account.

[0072] For example, the resource policy of the current user account includes resource policy 1 and resource policy 3, the resource data of resource policy 1 is the data in the 1st, 3rd and 4th rows of the data table, and the resource data of resource policy 3 is the data in the 2nd, 3rd and 4th rows of the data table. After performing a logical AND operation on the data in the 1st, 3rd and 4th rows of the data table and the data in the 2nd, 3rd and 4th rows of the data table, the data in the 3rd and 4th rows of the data table is obtained as the authorized resource data.

[0073] In this way, the authorized resource data of the current user account can be quickly determined, and data permission errors can be avoided.

[0074] In an embodiment, the resource policy of the current user account includes a role assertion, and the role assertion includes a data determination statement. The acquisition of the resource data corresponding to the resource policy of the current user account can include the following steps:

[0075] According to the data determination statement, a corresponding target resource attribute condition is acquired, and the target resource attribute condition includes a resource condition expression, and the resource condition expression includes a resource condition key, an operator and a resource condition value.

[0076] According to the resource condition key, the operator and the resource condition value, corresponding resource data is determined.

[0077] Please refer to Figure 4 , the resource condition expression includes a resource condition key (key), an operation key and a resource condition value (value). The operator can be a greater than symbol, a less than symbol, an equal to symbol and the like. The resource condition expression is equivalent to what value the resource condition key is under the corresponding operator. For example, the user can only view the device with a speed greater than 100. The resource condition expression is: the rated speed of the device > 100.

[0078] For example, if the role assertion is "if the role list contains role 1, return the data of the rated speed of the device > 100", wherein "return the data of the rated speed of the device > 100" is a data determination statement, and "if the role list contains role 1" is a conditional judgment statement. According to the data determination statement "return the data of the rated speed of the device > 100", the target resource attribute condition is determined to be "the rated speed of the device > 100", and the device with a speed greater than 100 is directly acquired as the authorized resource data.

[0079] Please refer to Figure 2If the role assertion is "if the role list contains role 1, return the resource data of the resource attribute condition id=1", wherein the "return the resource data of the resource attribute condition id=1" is a data determination statement, and "if the role list contains role 1" is a conditional judgment statement. According to the data determination statement "return the resource data of the resource attribute condition id=1", the target resource attribute condition is determined as "id=1", and the resource data of id=1 is directly obtained as the authorized resource data.

[0080] In this way, the resource attribute condition can be a resource condition expression or a resource identity, which is flexible, configurable and extensible, and improves the flexibility of the resource attribute condition.

[0081] In an embodiment, the resource condition key includes a resource association expression, the resource association expression associates at least two different resources through an association operator; and determining the corresponding resource data according to the resource condition key, the operator and the resource condition value includes:

[0082] determining the resource association relationship between different resources according to the resource association expression;

[0083] determining the corresponding resource data according to the resource association relationship, the operator and the resource condition value.

[0084] It is to be supplemented that the resource condition key can support the expression of the properties related to the resource association. The resource condition key can include a resource association expression. Specifically, the resource association expression associates at least two different resources through an association operator. The association operator includes a sub-association identifier and a sub-association operator. The sub-association identifier can be ".association.", and the sub-association operator can be set as "= ". It can be simply summarized as: the property of the resource.association.resource, for example, a user can only view the device in the organization of the department 1. The device and the organization are an association relationship, and the resource association relationship can be expressed as: the name of the device.association.organization=department 1. There can be more than three resources associated, which is not limited here.

[0085] For example, if the role assertion is "if the role list contains role 1, return the data of the name of the organization associated with the device = department 1 and the rated speed of the device > 100", wherein "return the data of the name of the organization associated with the device = department 1 and the rated speed of the device > 100" is a data determination statement, and "if the role list contains role 1" is a conditional judgment statement. According to the data determination statement "return the data of the name of the organization associated with the device = department 1 and the rated speed of the device > 100", the target resource attribute condition is determined to be "the data of the device with the name of the organization associated with the device = department 1, and the rated speed of the device > 100", that is, it is equivalent to satisfying two conditions, condition 1: the name of the organization associated with the device = department 1; condition 2: the rated speed of the device > 100. Wherein "the name of the organization associated with the device = department 1" represents a resource association relationship, and the device with a speed greater than 100 in the device whose organization is department 1 is directly obtained as the authorized resource data.

[0086] In this way, the resource attribute condition can be expressed by the resource condition expression and the resource identity, in addition, the resource attribute condition not only supports the expression of the attributes of the resource itself, but also supports the expression of the attributes related to the association relationship of the resource, and is rich, flexible, configurable and extensible.

[0087] In an embodiment, the data permission processing method can further include the following steps:

[0088] According to the user business condition, the authorized resource data is filtered to obtain business resource data.

[0089] In an embodiment, the user can input a user business condition through a current user account to filter the authorized resource data, for example, the authorized resource data includes financial data 1 of department 1, financial data 2 of department 2, and financial data 3 of department 3, and if the user business condition is to view the financial data 2 of department 2, the financial data 1 and the financial data 3 are filtered from the financial data 1 of department 1, the financial data 2 of department 2, and the financial data 3 of department 3, and the financial data 2 is returned.

[0090] In this way, the authorized resource data can be filtered by the user business condition to obtain the business resource data, meet the individual needs of the user, and provide the processing speed of the business resource data.

[0091] The data permission processing method provided by the embodiment comprises the following steps: obtaining a business role list of a current user account; determining a resource policy of the current user account according to the business role list; performing AND or NOT logic operation on resource data corresponding to the resource policy of the current user account to obtain authorized resource data of the current user account. In this way, the resource policy of the current user account is determined according to the business role list of the current user account, and then the AND or NOT logic operation is performed on the resource data corresponding to the resource policy of the current user account to obtain the authorized resource data of the current user account, without the need of splicing SQL statements related to data permission or changing the logic of application layer data calling, so that the data permission authorization can be realized in a non-invasive manner, the content of the resource policy is rich and flexible, the resource policy can be configured or extended, various business requirements can be connected, the authorization processing steps of the data permission are simplified, and the authorization processing efficiency of the data permission is improved.

[0092] Embodiment 2

[0093] In addition, the data permission processing apparatus is provided.

[0094] Specifically, as shown in Figure 5 The data permission processing apparatus 500 comprises:

[0095] The obtaining module 501 is configured to obtain a business role list of a current user account.

[0096] The determining module 502 is configured to determine a resource policy of the current user account according to the business role list.

[0097] The operation module 503 is configured to perform AND or NOT logic operation on resource data corresponding to the resource policy of the current user account to obtain authorized resource data of the current user account.

[0098] In an embodiment, the data permission processing apparatus 500 further comprises:

[0099] The configuration module is configured to establish at least one role, and configure at least one resource attribute condition for each role.

[0100] Each resource attribute condition is configured with a corresponding resource policy.

[0101] Each user account is assigned at least one role, and a business role list of each user account is generated according to the role of each user account.

[0102] In an embodiment, the determining module 502 is further configured to obtain a target resource policy corresponding to a role in the business role list, wherein the target resource policy comprises a role assertion.

[0103] It is determined whether the role assertion of each target resource policy is true.

[0104] asserting the role as a true target resource policy as a resource policy of the current user account.

[0105] In an embodiment, the resource policy of the current user account comprises a role assertion, and the role assertion comprises a data determination statement.

[0106] The data authority processing apparatus 500 further comprises:

[0107] The processing module is configured to acquire a corresponding target resource attribute condition according to the data determination statement, and the target resource attribute condition comprises a resource condition expression, and the resource condition expression comprises a resource condition key, an operator and a resource condition value.

[0108] The corresponding resource data is determined according to the resource condition key, the operator and the resource condition value.

[0109] In an embodiment, the resource condition key comprises a resource association relationship expression, and the resource association relationship expression associates at least two different resources through an association operator.

[0110] The processing module is further configured to determine a resource association relationship between different resources according to the resource association relationship expression.

[0111] The corresponding resource data is determined according to the resource association relationship, the operator and the resource condition value.

[0112] In an embodiment, the operation module 503 is further configured to perform logical and operation, logical or operation and logical not operation on the resource data corresponding to the resource policy of the current user account, to obtain authorized resource data of the current user account.

[0113] In an embodiment, the data authority processing apparatus 500 further comprises:

[0114] The filtering module is configured to filter the authorized resource data according to a user business condition to obtain business resource data.

[0115] The data authority processing apparatus 500 provided in this embodiment can execute the steps of the data authority processing method provided in Embodiment 1, and thus will not be described here again to avoid repetition.

[0116] The data permission processing apparatus provided in the embodiment obtains a business role list of a current user account; determines a resource policy of the current user account according to the business role list; and performs AND or NOT logic operation on resource data corresponding to the resource policy of the current user account, to obtain authorized resource data of the current user account. In this way, the resource policy of the current user account is determined according to the business role list of the current user account, and then the AND or NOT logic operation is performed on the resource data corresponding to the resource policy of the current user account, to obtain the authorized resource data of the current user account, without the need to splice SQL statements related to data permission, or to change the logic of application layer data calling, so that the data permission authorization can be realized in a non-invasive manner, the content of the resource policy is rich and flexible, the resource policy can be configured or extended, various business requirements can be connected more conveniently, the data permission authorization processing steps are simplified, and the data permission authorization processing efficiency is improved.

[0117] Embodiment 3

[0118] The embodiment of the present disclosure provides a server, comprising a memory and a processor, the memory stores a computer program, and the computer program executes the data permission processing method provided in the embodiment 1 when running on the processor.

[0119] The server provided in the embodiment can execute the steps of the data permission processing method provided in the embodiment 1, and details are not repeated here.

[0120] Embodiment 4

[0121] In addition, the embodiment of the present disclosure provides a computer readable storage medium, which stores a computer program, and the computer program executes the data permission processing method provided in the embodiment 1 when running on the processor.

[0122] The computer readable storage medium provided in the embodiment can execute the steps of the data permission processing method provided in the embodiment 1, and details are not repeated here.

Claims

1. A data access control method, characterized in that, The method includes: Get the list of business roles for the current user account; The resource strategy for the current user account is determined based on the list of business roles. Perform AND, OR, and NOT logical operations on the resource data corresponding to the resource policy of the current user account to obtain the authorized resource data of the current user account; The resource policy of the current user account includes role assertions, which include data determination statements. The acquisition of resource data corresponding to the resource policy of the current user account includes: acquiring the corresponding target resource attribute conditions according to the data determination statements. The target resource attribute conditions include resource condition expressions, which include resource condition keys, operators, and resource condition values. The resource condition keys include resource association expressions, which associate at least two different resources through association operators. The step of determining the corresponding resource data based on the resource condition key, operator, and resource condition value includes: Determine the resource association relationships between different resources based on the resource association relationship expression; The corresponding resource data is determined based on the resource association, operators, and resource condition values.

2. The method according to claim 1, characterized in that, Before obtaining the list of business roles for the current user account, the method further includes: Create at least one role and configure at least one resource attribute condition for each role; configure the corresponding resource strategy for each resource attribute condition. Assign at least one role to each user account, and generate a list of business roles for each user account based on the roles of each user account.

3. The method according to claim 1, characterized in that, The step of determining the resource strategy for the current user account based on the business role list includes: Obtain the target resource policy corresponding to the role in the business role list, wherein the target resource policy includes role assertion; Determine whether the role assertions of each target resource strategy are true; The target resource policy for which the role assertion is true is used as the resource policy for the current user account.

4. The method according to claim 1, characterized in that, The method further includes: The authorized resource data is filtered according to the user's business conditions to obtain business resource data.

5. A data access control device, characterized in that, The device includes: The acquisition module is used to retrieve the list of business roles for the current user account; The determination module is used to determine the resource policy of the current user account based on the business role list; The calculation module is used to perform AND, OR, and NOT logical operations on the resource data corresponding to the resource policy of the current user account to obtain the authorized resource data of the current user account. The resource policy of the current user account includes role assertions, which include data determination statements. The acquisition of resource data corresponding to the resource policy of the current user account includes: acquiring the corresponding target resource attribute conditions according to the data determination statements. The target resource attribute conditions include resource condition expressions, which include resource condition keys, operators, and resource condition values. The resource condition keys include resource association expressions, which associate at least two different resources through association operators. The step of determining the corresponding resource data based on the resource condition key, operator, and resource condition value includes: Determine the resource association relationships between different resources based on the resource association relationship expression; The corresponding resource data is determined based on the resource association, operators, and resource condition values.

6. The apparatus according to claim 5, characterized in that, The device further includes: The determination module is also used to obtain the target resource policy corresponding to the role in the business role list, wherein the target resource policy includes role assertion; Determine whether the role assertions of each target resource strategy are true; The target resource policy for which the role assertion is true is used as the resource policy for the current user account.

7. A server, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that executes the data access control method according to any one of claims 1 to 4 when the processor is running.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when run on a processor, executes the data access control method according to any one of claims 1 to 4.

Images