Isolation query method and device and computer device

Abstract

The application relates to the technical field of data processing, in particular to a method and device for isolating a query and computer equipment. The method is applied to a server side, and the method comprises the following steps: receiving a query request sent by a user side, and generating an initial query instruction based on request parameters carried in the query request; determining a target business module according to a URL address in the query request, and determining whether a modification rule is configured in the target business module; the modification rule is configured in the target business module in the form of an annotation; in the case that it is determined that the modification rule is configured in the target business module, obtaining subject information with access authority from the query request based on the modification rule, generating a target filtering condition based on the subject information, adding the target filtering condition to the initial query instruction, and obtaining a target query instruction; and executing the target query instruction to obtain a query result. The method can improve the adaptability of a business system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an isolated query method, apparatus and computer equipment. Background Technology

[0002] In business systems involving multiple entities, these entities may share a single database to store their respective user information. In this scenario, data isolation is necessary for each entity's data, ensuring that users of each entity can only query data related to that specific entity from the database.

[0003] In related technologies, in order to achieve data isolation between different entities, the approach is to directly write the corresponding filtering conditions for each entity into the corresponding business code on the server side. Thus, when the server receives a query request sent by the user, the server parses the request and generates the corresponding SQL query statement based on the filtering conditions in the business code.

[0004] However, business systems that use this data isolation method require maintaining separate filtering rules for each entity in the business module code. When applying the current business system to other multi-entity application scenarios, or when modifying the entities in the current scenario, the filtering rules in the business code need to be modified again, which results in poor adaptability of the business system.

[0005] Therefore, improving the adaptability of business systems is an urgent problem to be solved. Summary of the Invention

[0006] Therefore, it is necessary to provide an isolation query method, apparatus, and computer equipment that can improve the adaptability of business systems in response to the above-mentioned technical problems.

[0007] Firstly, this application provides an isolated query method applied to a server, the method comprising:

[0008] Receive a query request sent by the user and generate an initial query instruction based on the request parameters carried in the query request;

[0009] The target business module is determined based on the URL address in the query request, and it is determined whether the target business module is configured with modification rules; the modification rules are configured in the target business module through annotations.

[0010] If it is determined that the modification rule is configured in the target business module, the subject information with access rights is obtained from the query request based on the modification rule, the target filtering conditions are generated based on the subject information, and the target filtering conditions are added to the initial query instruction to obtain the target query instruction;

[0011] Execute the target query command to obtain the query results.

[0012] In one embodiment, the method further includes:

[0013] If it is determined that the target business module has not configured the modification rule, the initial query instruction is executed to obtain the query result.

[0014] In one embodiment, the target business module includes at least two functional layers, the modification rules include sub-modification rules configured in each of the functional layers, and the step of obtaining subject information with access rights from the query request based on the modification rules and generating target filtering conditions based on the subject information includes:

[0015] Based on the sub-modification rules corresponding to each functional layer, the sub-sub-subjects corresponding to each functional layer are obtained from the query request; wherein, the subject information includes each sub-sub-subject;

[0016] The target filtering conditions are generated based on the sub-subjects corresponding to each of the functional layers.

[0017] In one embodiment, obtaining the sub-sub-principles corresponding to each functional layer from the query request based on the sub-modification rules corresponding to each functional layer includes:

[0018] For each functional layer, the sub-modification rule corresponding to the functional layer is parsed to obtain the filter field name corresponding to the functional layer, and the filter field name represents the type of the sub-subbody;

[0019] Obtain the filter value corresponding to the filter field name from the query request; the filter value represents the identity identifier of the sub-subject.

[0020] Based on the filter field name and the filter value, the sub-subject corresponding to the functional layer is generated.

[0021] In one embodiment, the method further includes:

[0022] Obtain the communication parameters between the query request and the business system, and determine the subject list based on the communication parameters; the subject list includes the identity identifier of each subject corresponding to the query request;

[0023] The filter value corresponding to the field name is determined from the list of subjects; wherein the communication parameter is a communication interface or a communication address.

[0024] In one embodiment, generating the target filtering conditions based on the sub-subjects corresponding to each of the functional layers includes:

[0025] Write the sub-body corresponding to each functional layer into the cache queue;

[0026] When it is determined that each of the functional layers configured with the modification rules has been written to the sub-sub-subject, the sub-sub-subjects in the cache queue are aggregated to obtain the target filtering conditions.

[0027] In one embodiment, adding the target filter condition to the initial query instruction to obtain the target query instruction includes:

[0028] The initial query instruction is parsed to obtain a structure tree representing the structure of the initial query instruction;

[0029] Based on the correspondence between the structure and the addition position, the target filtering conditions are added to the target position of the structure tree to obtain the target query instruction.

[0030] In one embodiment, before adding the target filter condition to the initial query instruction, the method further includes:

[0031] The initial query command is intercepted based on the created interceptor.

[0032] Secondly, this application also provides an isolation query device, the device comprising an initial instruction generation module, a modification rule determination module, a target instruction generation module, and a query module, wherein:

[0033] An initial instruction generation module is used to receive a query request sent by a user and generate an initial query instruction based on the request parameters carried in the query request.

[0034] The modification rule determination module is used to determine the target business module based on the URL address in the query request, and to determine whether the target business module is configured with modification rules; the modification rules are configured in the target business module through annotations.

[0035] The target instruction generation module is used to, when it is determined that the modification rule is configured in the target business module, obtain subject information with access rights from the query request based on the modification rule, generate target filtering conditions based on the subject information, and add the target filtering conditions to the initial query instruction to obtain the target query instruction;

[0036] The query module is used to execute the target query instruction and obtain the query result.

[0037] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the isolated query method as described in any one of the first aspects above.

[0038] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the isolated query method as described in any one of the first aspects above.

[0039] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the isolated query method as described in any one of the first aspects above.

[0040] The aforementioned isolation query method, apparatus, and computer equipment, since the modification rules only characterize the subject types that the business module requires to have access permissions, when it is determined that the target business module corresponding to the query request is configured with modification rules, determines the subject information with access permissions from the query request based on the instructions of the modification rules, generates target filter conditions based on the subject information and adds them to the initial query instruction to obtain target filter conditions, thereby enabling the target filter conditions to be subject to access permission restrictions on data in the target database, thus achieving data isolation.

[0041] Furthermore, since the modification rules in the business modules of the business system are configured via annotations, the specific filtering conditions need to be determined from the query requests based on the instructions of the modification rules. Because the types of entities requiring access permissions for each business module are fixed, when applying the current business system to other multi-entity application scenarios, or when modifying entities within the current scenario, it is only necessary to ensure that the query requests generated by the user client include the corresponding entity types; no modifications to the modification rules in each business module are required. This improves the adaptability of the business system. Moreover, since the modification rules are configured in the business modules via annotations, and corresponding parameter modifications are made in the business system's configuration file, global modification rules can be enabled and disabled throughout the business system. Therefore, it also offers sufficient convenience when applying the business system to scenarios that do not require data isolation.

[0042] The target filtering conditions are generated based on each sub-subject. This involves writing the sub-subject corresponding to each functional layer into a cache queue. Once it's confirmed that all functional layers with configured modification rules have been written into sub-subjects, the sub-subjects in the cache queue are aggregated. The statement type of the initial query instruction is determined, and each sub-subject undergoes appropriate format processing to obtain the target filtering conditions, ensuring that the target filtering conditions conform to the statement format specifications of the initial query instruction. Furthermore, when faced with complex filtering conditions, the target filtering conditions are only generated after confirming that all sub-subjects have been aggregated into the cache queue, thus ensuring the generated target filtering conditions are complete and improving the accuracy and efficiency of filtering.

[0043] In the method of this application, the initial query instruction is first parsed to obtain its structure tree. The structure tree represents the structure of the initial query instruction. For some simple initial query instructions, it only includes queries on a single data table and single-level queries; while for complex initial query instructions, it may include queries on multiple related tables and multi-level subqueries. Then, based on the structure of the initial query instruction represented by the structure, and according to the relationship between the preset structure and the addition position, corresponding target filter conditions are added to the target position of the initial query instruction. This allows for the addition of corresponding filter conditions to queries on multiple related tables and multi-level subqueries in complex query instructions, thereby achieving complete filtering.

[0044] The solution proposed in this application can determine the subject information from the subjects carried in the query request itself, and can also determine the subject information from the subjects corresponding to the communication parameters of the query request accessing the business system. This not only improves the diversity of implementation methods, but also allows the business system to start generating target filtering conditions when the query request is accessed, without waiting for the query request to be fully accessed before generating target filtering conditions, thereby improving the efficiency of filtering. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a diagram illustrating the application environment of the isolated query method in one embodiment;

[0047] Figure 2 This is a flowchart illustrating the isolation query method in one embodiment;

[0048] Figure 3This is a flowchart illustrating the process of determining target filtering conditions in one embodiment;

[0049] Figure 4 This is a flowchart illustrating the process of determining subject information in one embodiment;

[0050] Figure 5 This is a schematic diagram of the data flow path during data isolation in one embodiment;

[0051] Figure 6 Here is a structural block diagram of the query isolation device in one embodiment;

[0052] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0055] The isolated query method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, the user terminal 102 communicates with the server terminal 104 via a network. The server terminal is configured with a database to store data corresponding to each entity; the database can be integrated into the server terminal 104 or located in the cloud or on other network servers. The user terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server terminal 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0056] In one exemplary embodiment, such as Figure 2 As shown, an isolation query method is provided, which can be applied to... Figure 1 Taking the server-side as an example, the explanation includes the following steps 110-140, where:

[0057] Step 110: Receive the query request sent by the user and generate an initial query instruction based on the request parameters carried in the query request.

[0058] In this embodiment of the application, the query request is generated by the client in response to the user's operation, and the query request is sent to the server through the client.

[0059] Specifically, the query request includes a request header, request parameters, and a URL (Uniform Resource Locator) address. The fields in the request header can represent the entity identifier, which can be based on a legal person (company entity), an individual user, or other types; this embodiment does not impose specific limitations. For a user, there is at least an individual entity identifier and a legal person entity identifier. The fields in the request header can include the identifiers of various types of legal persons corresponding to the user. Request parameters refer to the conditions required for the query. For example, if the user triggers an operation to query transaction records for the past six months, then the transaction records plus the past six months constitute the request parameters. This embodiment does not specifically limit the specific type and content of the request parameters. The URL points to the business module in the business system corresponding to the request parameters.

[0060] An initial query instruction is generated based on the request parameters in the query request. This initial query instruction only queries based on the request parameters and does not involve isolation of the subject. Continuing the previous example, if the request parameters are transaction records + last six months; since the data corresponding to each subject in this embodiment is stored in the same target database, directly executing the initial query instruction generated based on these request parameters would query the transaction records of all subjects in the target database for the last six months. However, in reality, a user A1 from Company A typically only queries the historical data of that user A1. Therefore, for some sensitive business scenarios, the initial query instruction cannot be executed directly; it is necessary to further limit the scope of data that the initial query instruction can access.

[0061] Step 120: Determine the target business module based on the URL address in the query request, and determine whether the target business module has a modification rule configured; the modification rule is configured in the target business module through annotations.

[0062] For sensitive business modules within the business system, corresponding modification rules are pre-configured using annotations. Each business module comprises at least two functional layers, and within each module with configured modification rules, at least one functional layer is configured with modification rules. These annotation-based modification rules can be configured with corresponding parameters in the business system's configuration center, thereby controlling whether the global modification rules take effect. In other words, global filtering options can be configured based on the business system's central parameters, thus controlling whether the modification rules configured in each functional module within the business system are effective.

[0063] In this embodiment, when the server receives a query request, it parses the initial query instruction to obtain a structure tree representing the structure of the initial query instruction. Further, the server determines whether the global filtering function option of the business system is enabled. If the global filtering function option is enabled, the server extracts the URL address from the structure tree to determine the target business module corresponding to the query request, and then determines whether modification rules are configured in the target business module. Specifically, for some sensitive business modules in the business system, modification rules are pre-configured in the business modules using annotations. These modification rules indicate the access permissions of the query request to data, and are used to modify the initial query instruction accordingly, thereby restricting the scope of data it can query from the target database.

[0064] Step 130: If the target business module is configured with modification rules, obtain the subject information with access rights from the query request based on the modification rules, generate target filtering conditions based on the subject information, and add the target filtering conditions to the initial query command to obtain the target query command.

[0065] Since the modification rules are configured within the business modules, the access permissions to data indicated by the modification rules are the access permissions required by the business modules. Two examples illustrate the relationship between business modules and access permissions. In the first example, a user initiates a query request to inquire about liabilities. Since each user is only allowed to query their own corresponding data regarding liabilities, the modification rules configured within the liabilities business module indicate that the query command only has access permissions to the user's own data.

[0066] In the second example, for instance, User 1 purchased a fund product from Company A, and User 1 initiated a query request to inquire about the fund's returns. The returns business module allows users to query both their individual returns and the overall returns of the fund. Therefore, the modification rules configured within the returns business module indicate that the query command has access permissions to both Company A's and User 1's corresponding data.

[0067] In this embodiment, the fields corresponding to the request header in the query request include various types of entities corresponding to the user terminal, and the modification rules indicate which type of entity has access permissions. Therefore, the server obtains the entity information with access permissions from the query request based on the modification rules in the target business module. The entity information represents at least one entity with access permissions, and each entity in the entity information is determined from the various types of entities corresponding to the user terminal. The filtering conditions are a structured expression language of entities with access permissions, and the filtering conditions conform to the structural requirements of the initial query instruction. In this embodiment, the initial query instruction is an SQL statement, and correspondingly, the filtering conditions conform to the format specifications of the SQL statement. Of course, the initial query instruction can also be a statement of other types and structures. This embodiment does not impose specific limitations on this, as long as it can query the corresponding data in the database.

[0068] The system further generates target filter conditions from the subject information that has access permissions, and adds these target filter conditions to the initial query command to obtain the target query command. Compared to the initial query command, the target query command, due to the addition of target filter conditions, can specifically point to the data in the target database that requires the corresponding permissions from the business module.

[0069] Step 140: Execute the target query command to obtain the query results.

[0070] In the embodiments of this application, the server executes the target query instruction, that is, it uses the target query instruction to query the target database to obtain the query result; wherein, the query result can be directly fed back to the user terminal, or the query result can be fed back to the business module first, the business module can preprocess the query result, and then the preprocessed query result is fed back to the user terminal.

[0071] In the above-described isolation query method, since the modification rules only represent the subject types that the business module requires to have access permissions, when it is determined that the target business module corresponding to the query request has modification rules configured, the subject information with access permissions is determined from the query request based on the instructions of the modification rules, and the target filter conditions are generated based on the subject information and added to the initial query instruction to obtain the target filter conditions. This allows the target filter conditions to be subject to access permission restrictions on the data in the target database, thereby achieving data isolation.

[0072] Furthermore, since the modification rules in the business modules of the business system are configured via annotations, the specific filtering conditions need to be determined from the query requests based on the instructions of the modification rules. Because the types of entities requiring access permissions for each business module are fixed, when applying the current business system to other multi-entity application scenarios, or when modifying entities within the current scenario, it is only necessary to ensure that the query requests generated by the user client include the corresponding entity types; no modifications to the modification rules in each business module are required. This improves the adaptability of the business system. Moreover, since the modification rules are configured in the business modules via annotations, and corresponding parameter modifications are made in the business system's configuration file, global modification rules can be enabled and disabled throughout the business system. Therefore, it also provides sufficient convenience when applying the business system to scenarios that do not require data isolation, allowing for flexible configuration.

[0073] Furthermore, if no modification rules are configured within the business module, it indicates that the target business module corresponding to the query request does not have restrictions on data access permissions. For example, for public data that is distributed globally across various types of entities, the business module corresponding to the public data does not have restrictions on data access permissions, and therefore, no modification rules are configured within that business module. Thus, if it is determined that the target business module does not have modification rules configured, the initial query command can be executed directly, i.e., the initial query command is used to query the target database, thereby obtaining the corresponding query results.

[0074] In another possible implementation, although modification rules are configured within the target business module, if it is determined that the global filtering function is not enabled, it indicates that the modification rules configured within each business module will not take effect. In this case, it is also necessary to directly execute the initial query command.

[0075] Furthermore, the configuration method for the modification rules is explained as follows: the modification rules are written into the functional layer of the corresponding business module using Java annotations + Spring AOP; the DataIslation annotation is added above the Java method, which means that all database operations performed in this method and other methods it calls will be automatically filtered (add target modification rules).

[0076] Furthermore, for a business module, although it may include multiple functional layers, the business module does not involve calling all functional layers when activated by a query request / initial query instruction. Therefore, in step 120, it is determined whether modification rules are configured in the target business module, that is, whether the functional layers that need to be called are configured with modification rules in the target business module.

[0077] In one exemplary embodiment, such as Figure 3 As shown, step 130 may specifically include steps 131 and 132, wherein:

[0078] Step 131: Based on the sub-modification rules corresponding to each functional layer, obtain the sub-sub-subjects corresponding to each functional layer from the query request; wherein, the subject information includes each sub-sub-subject.

[0079] Step 132: Generate target filtering conditions based on the sub-subjects corresponding to each functional layer.

[0080] Specifically, the target business module includes at least two functional layers, and the modification rules include sub-modification rules configured in each functional layer. Specifically, each functional layer configured with modification rules corresponds to a sub-principal with access permissions. The sub-principal is one of the various types of principals corresponding to the query request; and the sub-principals corresponding to different functional layers within the same business module are different, meaning that different functional layers have different modification rules. Based on the sub-modification rules corresponding to each functional layer, a query is performed from the fields corresponding to the request header of the query request to obtain the sub-principal corresponding to each functional layer; the sub-principal corresponding to each functional layer is the principal information corresponding to the query request in the target business module.

[0081] Furthermore, target filtering conditions are generated based on each sub-subject. This involves writing the sub-subject corresponding to each functional layer into a cache queue. Once it is determined that sub-subjects have been written to each functional layer configured with modification rules, the sub-subjects in the cache queue are aggregated. The cache queue can also be a thread-local variable. When the sub-subjects are aggregated into the cache queue, the statement type of the initial query instruction is determined, and each sub-subject undergoes appropriate format processing to obtain the target filtering conditions, ensuring that the target filtering conditions conform to the statement format specifications of the initial query instruction.

[0082] In one embodiment, such as Figure 4 As shown, step 131 may specifically include steps 1311-1313, wherein:

[0083] Including step 1311, for each functional layer, parse the sub-modification rules corresponding to the functional layer to obtain the filter field name corresponding to the functional layer. The filter field name represents the type of the sub-sub-body.

[0084] This includes step 1312, obtaining the filter value corresponding to the filter field name from the query request, whereby the filter value represents the identity identifier of the sub-subject;

[0085] This includes step 1313, which generates the sub-subject corresponding to the functional layer based on the filter field name and filter value.

[0086] Specifically, the structure of the modification rule includes the filter field name + filter value; specifically, fieldNames is a string array containing one or more field names that need to be filtered; isolationValues ​​is a Class array containing implementation classes of the interface IsolationValue, which correspond one-to-one with the field names configured in fieldNames and provide filter values; ignoredTables is a string array, which can be configured here if there are tables that do not need to be filtered (representing the data range).

[0087] For each functional layer, the modification rules corresponding to that functional layer are parsed to determine the filter field name. The filter field name represents the type of the sub-principal corresponding to that functional layer. Further, based on the determined filter field name, the identity identifier of the subject corresponding to that filter field name is determined from the fields in the request header of the query request as the filter value. Then, based on the filter field name and the filter value determined based on the filter resource name, the sub-principal is generated.

[0088] In one example, the query request header fields include A-A1, B-B1, and C-C1; where A is a company-type entity, and A1 is the company's identifier; B is an individual-type entity, and B1 is the individual's identifier; and C is a group-type entity, and C1 is the group's identifier. If the corresponding filter field in a functional layer is A, then A1 is obtained as the filter value based on this filter field A; and then A+A1 is used as the sub-entity of that functional layer.

[0089] In another possible implementation, besides obtaining the various types of entities corresponding to the user from the query request, it is also possible to obtain the communication parameters between the query request and the business system, determine the entity list based on the communication parameters, and then determine the filter values ​​corresponding to the field names from the entity list; where the communication parameters are communication interfaces or communication addresses. The entity list includes the identity identifiers of each entity corresponding to the query request.

[0090] Specifically, communication interfaces for accessing the business system can be pre-assigned to each entity. For example, fixed communication parameters can be assigned to Company A, such as communication interfaces 1-100, and communication interface 50 can be assigned to individual user A1 in Company A. Then, by identifying the communication interface of the query request, the list of entities corresponding to it can be determined.

[0091] In one embodiment, before adding the target filter conditions to the initial query command, the initial query command needs to be intercepted based on the created interceptor to avoid directly executing the initial query command.

[0092] Specifically, the DataIsolationInterceptor intercepts all execution processes (methods) annotated with DataIsolation, reads the configuration information (modification rules) in the annotation, and stores it in a thread-local variable (cache) for use by Mybatis plugins.

[0093] In one embodiment, in step 130, the target filtering conditions are added to the initial query instruction to obtain the target query instruction. Specifically, this may include: parsing the initial query instruction to obtain a structure tree representing the structure of the initial query instruction; and adding the target filtering conditions to the target position of the structure tree based on the correspondence between the structure and the addition position to obtain the target query instruction.

[0094] Specifically, the structure tree represents the structure of the initial query instruction. For some simple initial query instructions, it only includes queries on a single data table and single-level queries; while for complex initial query instructions, it may include queries on multiple related tables and multi-level subqueries.

[0095] In this embodiment, the modification rule is added to the Java method using the `DataIslation` annotation. This means that all database operations performed by this method and other methods it calls will be automatically filtered (target modification rules are added). Therefore, after determining the target filtering conditions, if the initial query instruction requires querying related data tables, the target filtering conditions need to be added to the query instruction for each data table; furthermore, if the initial query instruction contains multiple levels of subqueries, the target filtering conditions need to be added to the instruction for each subquery.

[0096] Furthermore, a more detailed embodiment will be used to illustrate the implementation of each component that implements the data isolation function in the above-described isolated query method.

[0097] In one embodiment, the Mybatis plugin is used to parse the initial query command (SQL statement) and add the target filter conditions to the initial query command to obtain the target query command.

[0098] The data filtering component is a configurable, automated data filtering component with the following characteristics:

[0099] 1. Implemented based on the Mybatis plugin mechanism;

[0100] 2. The configuration uses Java annotations + Spring AOP;

[0101] 3. It can recognize various types of SQL, including but not limited to multi-table joins and subqueries;

[0102] 4. It can filter multiple fields simultaneously and can ignore certain tables in the configuration;

[0103] 5. Provides global and method-level configurations for easy control of data isolation scope;

[0104] 6. Provides a unified and easily expandable interface.

[0105] Introduction to core components:

[0106] Mybatis plugin: Parses and executes SQL statements, adds necessary conditional clauses based on configuration information; supports query, update, and delete statements; supports table joins, subqueries, and other syntax; supports mainstream databases.

[0107] Example of Mybatis plugin implementation:

[0108] @RequiredArgsConstructor

[0109] public class DataIsolationInnerInterceptor extends JsqlParserSupportimplements InnerInterceptor { ...

[0111] }

[0112] Configuration annotation: The `@DataIslation` annotation, added above a Java method, means that all database operations performed within this method and other methods it calls will be automatically filtered. Configurable options include:

[0113] fieldNames: A string array containing one or more field names to be filtered.

[0114] isolationValues: An array of Classes, each an implementation of the IsolationValue interface, corresponding one-to-one with the field names configured in fieldNames, providing filtered values.

[0115] ignoredTables: A string array that can be configured here if there are tables that do not need to be filtered.

[0116] One example of implementing configuration annotations is as follows:

[0117] @Target({ElementType.METHOD, ElementType.TYPE})

[0118] @Retention(RetentionPolicy.RUNTIME)

[0119] @Inherited

[0120] @Documented

[0121] public @interface DataIsolation {

[0122] @NotNull

[0123] String[] fieldNames();

[0124] @NotNull

[0125] Class<? extends IsolationValue> [] isolationValues();

[0126] / **

[0127] * Ignored Tables

[0128] /

[0129] String[] ignoredTables() default {};

[0130] }

[0131] Add the common-core package dependency to your Maven configuration:

[0132] <dependency>

[0133] <groupid> com.gientech.financial.platform< / groupid>

[0134] <artifactid> ts-bps-common-core< / artifactid>

[0135] < / dependency>

[0136] Add the @EnableDataIsolation annotation to the startup class of your Spring project to enable data isolation features.

[0137] Finally, simply add configuration annotations to the methods that require data filtering, as shown in the example below, where data is filtered by the legal person's primary key.

[0138] AOP interceptors:

[0139] The DataIsolationInterceptor intercepts all methods annotated with the DataIsolation annotation, reads the configuration information in the annotation, and stores it in a thread-local variable for use by Mybatis plugins.

[0140] Usage steps:

[0141] Add the common-core package dependency to your Maven configuration:

[0142] <dependency>

[0143] <groupid> com.gientech.financial.platform< / groupid>

[0144] <artifactid> ts-bps-common-core< / artifactid>

[0145] < / dependency>

[0146] To enable data isolation, add the `@EnableDataIsolation` annotation to the startup class of your Spring project. Finally, simply add the configuration annotation to the methods that require data filtering, as shown in the example below for filtering data by legal entity primary key:

[0147] @DataIsolation(fieldNames = "corporation_id", isolationValues ​​= CorporationIdIsolationValue.class)

[0148] like Figure 5 The diagram shown illustrates the data flow path during data isolation in this embodiment of the application.

[0149] User actions trigger a query request sent to the server. The server generates an initial query command (SQL statement) based on the request parameters in the query request. The Mybatis plugin parses the initial query command and queries the target business module pointed to by the initial query command. If the target business module has modification conditions configured, the plugin determines each sub-subject from the request header fields of the query request based on the modification conditions and puts them into a cache queue to generate target filter conditions. The Mybatis plugin further calls the target filter conditions in the cache queue and adds them to the initial query command to obtain the target query command, thus completing data isolation. Subsequently, when the target query command is executed, the isolated data can be queried specifically based on the filter conditions. Furthermore, when the target query command is obtained, the sub-subjects written in the cache queue are cleared.

[0150] The isolation query method provided in this application can solve the dynamic data isolation problem in complex SQL scenarios (such as multi-table joins and nested subqueries), and provides a configurable, scalable, and multi-granular automated filtering solution. At the same time, multi-tenant (principal) users do not need to configure separate filtering rules, reducing system maintenance and migration costs.

[0151] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0152] Based on the same inventive concept, this application also provides an isolation query apparatus for implementing the isolation query method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more isolation query apparatus embodiments provided below can be found in the limitations of the isolation query method described above, and will not be repeated here.

[0153] In one exemplary embodiment, such as Figure 6 As shown, an isolation query device 600 is provided, including an initial instruction generation module 601, a modification rule determination module 602, a target instruction generation module 603, and a query module 604, wherein:

[0154] The initial instruction generation module 601 is used to receive a query request sent by the user terminal and generate an initial query instruction based on the request parameters carried in the query request.

[0155] The modification rule determination module 602 is used to determine the target business module based on the URL address in the query request, and to determine whether the target business module has modification rules configured; the modification rules are configured in the target business module through annotations.

[0156] The target instruction generation module 603 is used to obtain the subject information with access rights from the query request based on the modification rules when it is determined that there are modification rules configured in the target business module, generate target filtering conditions based on the subject information, and add the target filtering conditions to the initial query instruction to obtain the target query instruction.

[0157] The query module 604 is used to execute the target query command and obtain the query results.

[0158] In one embodiment, the query module 604 is further configured to: execute an initial query instruction and obtain query results if it is determined that the target business module has not configured modification rules.

[0159] In one embodiment, the target business module includes at least two functional layers, the modification rules include sub-modification rules configured in each functional layer, and the target instruction generation module 603 is specifically used for:

[0160] Based on the sub-modification rules corresponding to each functional layer, the sub-sub-subjects corresponding to each functional layer are obtained from the query request; among them, the subject information includes each sub-sub-subject.

[0161] Based on the sub-subjects corresponding to each functional layer, generate target filtering conditions;

[0162] In one embodiment, the target instruction generation module 603 is specifically used for:

[0163] For each functional layer, the corresponding sub-modification rules are parsed to obtain the filter field name corresponding to the functional layer. The filter field name represents the type of the sub-sub-body.

[0164] Retrieve the filter value corresponding to the filter field name from the query request. The filter value represents the identity identifier of the sub-subject.

[0165] Based on the filter field name and filter value, generate the sub-subject corresponding to the functional layer.

[0166] In one embodiment, the target instruction generation module 603 is further configured to:

[0167] Obtain the communication parameters between the query request and the business system, and determine the subject list based on the communication parameters; the subject list includes the identity identifier of each subject corresponding to the query request;

[0168] Determine the filter value corresponding to the field name from the main list; where the communication parameter is the communication interface or communication address.

[0169] In one embodiment, the target instruction generation module 603 is specifically used for:

[0170] Write the sub-sub-body corresponding to each functional layer into the cache queue;

[0171] Once it is determined that all functional layers with modified rules are written to the sub-subjects, the sub-subjects in the cache queue are aggregated to obtain the target filtering conditions.

[0172] In one embodiment, the target instruction generation module 603 is specifically used for:

[0173] The initial query instruction is parsed to obtain a tree structure representing the structure of the initial query instruction;

[0174] Based on the correspondence between the structure and the addition position, the target filtering conditions are added to the target position in the structure tree to obtain the target query instruction.

[0175] In one embodiment, the isolation query device 600 further includes an interception module, which is specifically used for:

[0176] The initial query command is intercepted based on the created interceptor.

[0177] Each module in the aforementioned isolation query device 600 can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0178] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an isolated query method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0179] Those skilled in the art will understand that Figure 7The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0180] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0181] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being implemented when executed by a processor.

[0182] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of any of the methods in the above-described embodiments of the isolated query method.

[0183] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0184] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0185] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0186] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for isolating queries, characterized in that, Applied to the server side, the method includes: Receive a query request sent by the user and generate an initial query instruction based on the request parameters carried in the query request; The target business module is determined based on the URL address in the query request, and it is determined whether the target business module is configured with modification rules; the modification rules are configured in the target business module through annotations. If it is determined that the modification rule is configured in the target business module, the subject information with access rights is obtained from the query request based on the modification rule, and the target filtering conditions are generated based on the subject information. The initial query instruction is parsed to obtain a structure tree representing the structure of the initial query instruction. Based on the correspondence between the structure and the addition position, the target filtering conditions are added to the target position of the structure tree to obtain the target query instruction; the structure tree represents the structure of the initial query instruction. Execute the target query command to obtain the query results.

2. The method according to claim 1, characterized in that, The method further includes: If it is determined that the target business module has not configured the modification rule, the initial query instruction is executed to obtain the query result.

3. The method according to claim 2, characterized in that, The target business module includes at least two functional layers, and the modification rules include sub-modification rules configured in each functional layer. The step of obtaining access permission information from the query request based on the modification rules and generating target filtering conditions based on the access permission information includes: Based on the sub-modification rules corresponding to each functional layer, the sub-sub-subjects corresponding to each functional layer are obtained from the query request; wherein, the subject information includes each sub-sub-subject; The target filtering conditions are generated based on the sub-subjects corresponding to each of the functional layers.

4. The method according to claim 3, characterized in that, The step of obtaining the sub-sub-subject corresponding to each functional layer from the query request based on the sub-modification rules corresponding to each functional layer includes: For each functional layer, the sub-modification rule corresponding to the functional layer is parsed to obtain the filter field name corresponding to the functional layer, and the filter field name represents the type of the sub-subbody; Obtain the filter value corresponding to the filter field name from the query request; the filter value represents the identity identifier of the sub-subject. Based on the filter field name and the filter value, the sub-subject corresponding to the functional layer is generated.

5. The method according to claim 4, characterized in that, The method further includes: Obtain the communication parameters between the query request and the business system, and determine the subject list based on the communication parameters; the subject list includes the identity identifier of each subject corresponding to the query request; The filter value corresponding to the field name is determined from the list of subjects; wherein the communication parameter is a communication interface or a communication address.

6. The method according to any one of claims 3-5, characterized in that, The generation of the target filtering conditions based on the sub-subjects corresponding to each of the functional layers includes: Write the sub-body corresponding to each functional layer into the cache queue; When it is determined that each of the functional layers configured with the modification rules has been written to the sub-sub-subject, the sub-sub-subjects in the cache queue are aggregated to obtain the target filtering conditions.

7. The method according to claim 6, characterized in that, The cache queue is a thread-local variable.

8. The method according to claim 1, characterized in that, Before adding the target filter condition to the initial query instruction, the method further includes: The initial query command is intercepted based on the created interceptor.

9. An isolated query device, characterized in that, The device includes an initial instruction generation module, a modification rule determination module, a target instruction generation module, and a query module, wherein: An initial instruction generation module is used to receive a query request sent by a user and generate an initial query instruction based on the request parameters carried in the query request. The modification rule determination module is used to determine the target business module based on the URL address in the query request, and to determine whether the target business module is configured with modification rules; the modification rules are configured in the target business module through annotations. The target instruction generation module is used to, when it is determined that the modification rule is configured in the target business module, obtain subject information with access rights from the query request based on the modification rule, generate target filtering conditions based on the subject information; parse the initial query instruction to obtain a structure tree representing the structure of the initial query instruction, and add the target filtering conditions to the target position of the structure tree based on the correspondence between the structure and the addition position to obtain the target query instruction; the structure tree represents the structure of the initial query instruction; The query module is used to execute the target query instruction and obtain the query result.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images