Data authorization method and device, program and storage medium

Abstract

The invention discloses a data authorization method and device, a program and a storage medium. The method comprises the following steps: responding to a received data authorization application form, and generating an application number; storing the application number, the applicant information and the application authorization time period in an application form information table; determining a mechanism field name corresponding to each target data table according to each target data table and a preset mechanism information table; determining an allowable parameter set of each target data table based on respective mechanism field names and respective expected parameter sets of the plurality of target data tables; according to the application number and an allowable parameter set of each target data table, creating view data and a view name of each target data table, and storing the view data and the view name in a data authorization information table; and in response to an access request for the target data table sent by the front end, based on the access request, the application form information table and the data authorization information table, determining effective view data and a view name of the target data table, and sending the effective view data and the view name to the front end. According to the invention, the security of data authorization can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data authorization method, device, program and storage medium. BACKGROUND

[0002] Under the background of wide application of big data and multi-source heterogeneous systems, business systems such as audit, risk control and operation analysis often need to use detailed data and summary data from multiple business systems. The use of data by users in different positions and different ranks is quite different. There are needs for division according to business lines, and there are needs for division according to dimensions such as organizational levels, job responsibilities and business scenarios. In order to avoid sensitive data being viewed at will, the existing system generally limits the data access range of the user through database account permissions, role permissions in the application system, menu permissions or simple library-level and table-level access control. Some systems also add some conditional filtering or desensitization rules on the front-end page to reduce the exposure of sensitive fields and sensitive records to a certain extent.

[0003] However, such authorization methods centered on account, role or library table object often have a relatively rough granularity, and it is difficult to consider multiple dimensions such as data source, organizational affiliation, data content sensitivity and specific use scenarios at the same time. There is a mismatch between the authorization boundary and the actual data use demand. The user is often granted a data access range far beyond what is necessary for his or her job; at the same time, the configuration in the authorization process depends mainly on manual judgment and manual input, and there is a lack of unified constraints and verification mechanisms between different systems. It is easy to cause the authorization range to be out of control due to configuration omissions, field selection errors or range understanding deviations. The authorization records are also scattered, which is not conducive to subsequent consistency checking of the authorization basis and authorization range. In summary, the existing data authorization method still has deficiencies in the fine control of the authorization range, the standardization of the authorization configuration and the checkability of the authorization behavior. Overall, the security of data authorization is low. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a data authorization method, device, program and storage medium, which solves the problem of low security of the data authorization method in the prior art.

[0005] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a data authorization method, which comprises: In response to receiving a data authorization application form, generating an application number of the data authorization application form; the data authorization application form comprises applicant information, application authorization time period and respective expected parameter set for a plurality of target data tables; storing the application number, the applicant information and the application authorization time period to an application form information table; Determine the institution field name of each target data table according to the target data table and the preset institution information table; the preset institution information table stores the mapping relationship between each target data table and the institution field name; Determine the allowed parameter set of each target data table based on the institution field name of each target data table and the expected parameter set of each target data table; Create the view data and the view name of each target data table according to the application number and the allowed parameter set of each target data table, and store them in the data authorization information table; In response to the access request for the target data table sent by the front end, determine the effective view data and the view name of the target data table based on the access request, the application information table and the data authorization information table, and send them to the front end.

[0006] In the embodiment of the application, the application information table is provided with an approval state field; before the step of creating the view data and the view name of each target data table, it includes: in response to the approval pass instruction for the application number, updating the approval state corresponding to the application number in the application information table to the pass state.

[0007] In the embodiment of the application, the application information table also stores the mapping relationship between the application number, the applicant information, the application authorization time period and the approval state; the data authorization information table stores the mapping relationship between the application number, the view data and the view name; the step of determining the effective view data and the view name of the target data table based on the access request, the application information table and the data authorization information table includes: obtaining the current applicant information and the current time of the current user from the access request; determining the archived application number corresponding to the current user according to the current applicant information and the application information table; taking the archived application number whose current time is in the application authorization time period corresponding to the archived application number and whose approval state is the pass state as the effective application number; determining the effective view data and the view name according to the effective application number and the data authorization information table.

[0008] In the embodiment of the application, the expected parameter set of each target data table is provided with the table number, the expected field, the expected data range and the expected data belonging institution; the step of determining the allowed parameter set of each target data table based on the institution field name of each target data table and the expected parameter set of each target data table includes: determining the allowed data range of the corresponding target data table according to the institution field name of each target data table and the expected data range of each target data table; determining the allowed data belonging institution of the corresponding target data table according to the institution field name of each target data table and the allowed data range, the expected data range and the expected data belonging institution of each target data table; determining the allowed field of the corresponding target data table according to the expected field of each target data table.

[0009] In the embodiments of the present application, the step of determining the allowed data range of the corresponding target data table according to the agency field name of each target data table and the expected data range for each target data table comprises: determining the allowed data range of the current target data table as the total data of the current target data table in the case that the agency field name of the current target data table is empty; determining the allowed data range of the current target data table as the expected data range for the current target data table in the case that the agency field name of the current target data table is not empty.

[0010] In the embodiments of the present application, the applicant information comprises an applicant agency; the step of determining the allowed data agency of the corresponding target data table according to the agency field name and the allowed data range of each target data table, the expected data range for each target data table and the expected data agency of each target data table comprises: determining the allowed data agency of the current target data table as empty in the case that the allowed data range of the current target data table is the total data or the agency field name is empty; determining the allowed data agency of the current target data table as the expected data agency for the current target data table in the case that the allowed data range of the current target data table is agency data and the expected data agency for the current target data table is not empty; determining the allowed data agency of the current target data table as the applicant agency in the case that the allowed data range of the current target data table is agency data and the expected data agency for the current target data table is empty.

[0011] In the embodiments of the present application, the step of determining the allowed field of the corresponding target data table according to the expected field for each target data table comprises: determining the allowed field of the current target data table as the total field of the current target data table in the case that the expected field for the current target data table is empty.

[0012] A second aspect of this application provides a data authorization apparatus, comprising: a generation module, configured to generate an application number for a data authorization application form in response to receiving a data authorization application form; the data authorization application form includes applicant information, an authorization time period, and expected parameter sets for multiple target data tables; a storage module, configured to store the application number, applicant information, and authorization time period in an application form information table; a first determination module, configured to determine the organization field name of a corresponding target data table based on each target data table and a preset organization information table; the preset organization information table stores a mapping relationship between each target data table and the organization field name; a second determination module, configured to determine the allowed parameter set for each target data table based on the organization field names of the multiple target data tables and the expected parameter sets for the multiple target data tables; a creation module, configured to create view data and view name for each target data table based on the application number and the allowed parameter set for each target data table, and store them in the data authorization information table; and a sending module, configured to determine the valid view data and view name of the target data table based on the access request, the application form information table, and the data authorization information table in response to an access request for the target data table sent by a front end, and send them to the front end.

[0013] A third aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0014] A fourth aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to perform the methods described above.

[0015] Through the above technical solution, upon receiving a data authorization request, the system generates a unique application number for that request and stores it along with the applicant information and the authorization period in the application information table. This ensures that each authorization request has a clear and traceable identifier and time boundary within the system. Simultaneously, the system automatically determines the institution field name for each target data table based on its configuration in the preset institution information table. Furthermore, by combining this with the expected parameter sets for each of the multiple target data tables, the system calculates a rule-constrained set of allowed parameters for each target data table, thereby normalizing and converging the authorization request across field, data range, and institution dimensions. Further, based on the application number and the allowed parameter set for each target data table, the system... For each target data table, view data and its name that conform to the allowed parameter set constraints are created and stored in the data authorization information table. This transforms the original authorization for the underlying target data table into authorization for the controlled view data. When the front end initiates an access request for the target data table, the system then jointly determines the valid view data and view name corresponding to the target data table under the current conditions based on the access request, the application form information table, and the data authorization information table. Only the valid view data is returned to the front end. This achieves seamless control over authorization request modeling, parameter constraints, view generation, and access return under the same application number. It prevents users from bypassing authorization to directly access the target data table or obtaining data outside the authorized time period, improves the fine-grained control and unauthorized access prevention capabilities of the data access process, and thus enhances the security of data authorization.

[0016] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 A flowchart illustrating a data authorization method according to an embodiment of this application is shown schematically; Figure 2 The diagram illustrates a structural diagram of a data authorization device according to an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0019] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0020] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0021] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0022] Figure 1 A flowchart illustrating a data authorization method according to an embodiment of this application is shown schematically. Figure 1 As shown in the figure, this application provides a data authorization method, which may include the following steps.

[0023] Step 101: In response to receiving a data authorization request form, generate an application number for the data authorization request form; the data authorization request form includes applicant information, the authorization period, and the expected parameter sets for each of the multiple target data tables.

[0024] In this embodiment, the data authorization request submitted by the front end is received and processed as a complete data authorization request. The applicant information, the authorization period, and the expected parameter sets for each of the multiple target data tables contained in the data authorization request form collectively characterize the subject, time constraints, and data scope of this authorization request: the applicant information can be used to identify the user initiating this authorization and their affiliated organization; the authorization period is used to limit the start and end interval of this authorization on the timeline; and the expected parameter sets for each of the multiple target data tables are used to describe in detail the expected access configuration of each target data table involved in this authorization at the table level, field level, and data scope level. After receiving the data authorization request form, a unique application number is generated for the data authorization request form in the system, and the aforementioned applicant information, authorization period, and expected parameter sets for each of the multiple target data tables are associated with the application number, so that all subsequent storage, query, and processing related to this data authorization can be uniformly located and distinguished through the application number. The authorization requests that were originally submitted once and targeted multiple data tables are abstracted and solidified into a single data authorization request record with a unique request number. This gives the data authorization process clear request boundaries and traceability, laying the foundation for subsequent parameter standardization, view creation, and access control based on the request number.

[0025] Step 102: Store the application number, applicant information, and application authorization period in the application form information table.

[0026] Step 103: Determine the organization field name of the corresponding target data table based on each target data table and the preset organization information table; the preset organization information table stores the mapping relationship between each target data table and the organization field name.

[0027] In this embodiment, the application number, applicant information, and application authorization time period are written into the application form information table. The application form information table can serve as a collection of data records that persistently store the core information of the data authorization application in the database. Using the application number as the index field, the application subject and authorization time boundary corresponding to the same data authorization application are fixed in a structured manner, which facilitates subsequent retrieval, verification, and tracking in the same data storage. At the same time, the institution field name of the corresponding target data table is determined according to the configuration of each target data table in the preset institution information table. The preset institution information table can be understood as an institution configuration dataset that is pre-maintained for each target data table. It stores the mapping relationship between each target data table and the institution field name. The institution field name is used to identify the field name that represents the institution information in the target data table, such as the field used to store the institution number or institution identifier. Through this mapping relationship, the system can automatically determine a unique and standardized institution field for each target data table without relying on manual memory. By centrally storing the application number, applicant information, and application authorization time period in the application form information table, and combining this with a preset institution information table to determine the institution field name for each target data table, the subject information, time boundary information, and institution dimension constraint information of data authorization are clearly bound and standardized and persisted within the system. This avoids distortion of the authorization scope due to manual selection of incorrect fields or missing institution fields during subsequent processing, thereby reducing the risk of unauthorized access and misauthorization at the source and improving the security of data authorization.

[0028] Step 104: Determine the allowed parameter set for each target data table based on the organization field names of each of the multiple target data tables and the expected parameter set for each of the multiple target data tables.

[0029] In this embodiment, the organization field name of each of the multiple target data tables is used to indicate the field name used to represent organization information in each target data table. This is the metadata tag upon which the system relies when constraining data authorization at the organization dimension. The expected parameter set for each of the multiple target data tables represents the authorization request configuration proposed by the applicant for each target data table. The expected parameter set includes at least the table number, expected fields, expected data range, and the organization to which the expected data belongs. It describes the authorization requirements of the target data table from the perspectives of table identifier, field granularity, data range granularity, and organization granularity. The allowed parameter set is a set of controlled parameters calculated by the system for each target data table after comprehensively considering the organization field name and the expected parameter set. Each parameter in the allowed parameter set is the result of verifying, correcting, and shrinking the expected parameter set under predefined rule constraints. It may include the allowed data range, the organization to which the allowed data belongs, and the allowed fields, etc., and is used to characterize the actual data authorization boundaries that are allowed to take effect under the premise that the system determines it to be safe and compliant. By determining the allowed parameter set for each target data table based on its respective organization field names and expected parameter sets, the authorization parameters are no longer freely determined by the applicant. Instead, the system performs rule constraints and consistency checks based on organization fields, data ranges, and field ranges. This reduces the risk of excessively broad authorization ranges or incorrect organization ranges due to improper parameter configurations, thereby improving the security of data authorization.

[0030] Step 105: Based on the application number and the allowed parameter set for each target data table, create the view data and view name for each target data table and store them in the data authorization information table.

[0031] In this embodiment, the application number identifies a specific data authorization application, linking various target data tables under the same application as a whole within the system. The allowed parameter set for each target data table represents the authorization scope information ultimately approved by the system after rule constraints and security checks on the expected parameter set. The field parameters, data range parameters, and organizational parameters in the allowed parameter set jointly determine the record rows and field columns that can subsequently appear in the view data of that target data table. View data can be understood as a virtual dataset defined by a database view. It is a controlled subset of data formed by filtering and trimming fields and data ranges based on the target data table and its allowed parameter set. The view name uniquely identifies the view data in the database, allowing database queries to access it via the view name rather than directly through the target data table. The data authorization information table maintains the correspondence between application numbers, target data tables, and their corresponding view data and view names in persistent storage. It can use a relational table structure to record the metadata information of each target data table view under each application number. By creating view data and view names for each target data table based on the application number and the allowed parameter set for each target data table, and centrally storing the identification information related to these views in the data authorization information table, the authorization results for different target data tables are explicitly solidified into a set of distinguishable controlled view units. This allows the authorization boundaries to be accurately expressed and centrally registered at the view level, preventing subsequent access to the original data table directly by bypassing the authorization results, thereby improving the security of data authorization.

[0032] Step 106: In response to the access request for the target data table sent by the front end, determine the valid view data and view name of the target data table based on the access request, application form information table and data authorization information table, and send them to the front end.

[0033] In this embodiment, the front-end can be understood as a user or other system. An access request is a data access instruction sent to the system by the front-end when initiating a data query or analysis operation, containing information such as the target data table identifier, the current user's identity, and the request context. Upon receiving an access request for the target data table, the system first parses the target data table and current user-related information from the access request. Using the current user information as a retrieval condition, it locates the associated application number in the application form information table. Then, combining these application numbers, it queries the data authorization information table to find the view data and view name matching the target data table. Based on this, according to the authorization time period, approval status, and other constraints recorded in the application form information table, as well as the context information carried in the access request, it filters the retrieved view data to obtain the valid view data and its corresponding view name that are actually allowed to be returned under the current user identity and current time. The valid view data and view name are then returned to the front-end. By uniformly mapping front-end access requests for target data tables to access valid view data at the data access entry point, and using the authorization relationships in the access request, application form information table, and data authorization information table as constraints to filter the data that can be returned, the system avoids situations where the front-end directly bypasses the authorization mechanism to access the underlying target data table or continues to obtain data when the authorization conditions are not met, thereby improving the security of data authorization.

[0034] Through the above technical solution, upon receiving a data authorization request, the system generates a unique application number for that request and stores it along with the applicant information and the authorization period in the application information table. This ensures that each authorization request has a clear and traceable identifier and time boundary within the system. Simultaneously, the system automatically determines the institution field name for each target data table based on its configuration in the preset institution information table. Furthermore, by combining this with the expected parameter sets for each of the multiple target data tables, the system calculates a rule-constrained set of allowed parameters for each target data table, thereby normalizing and converging the authorization request across field, data range, and institution dimensions. Further, based on the application number and the allowed parameter set for each target data table, the system... For each target data table, view data and its name that conform to the allowed parameter set constraints are created and stored in the data authorization information table. This transforms the original authorization for the underlying target data table into authorization for the controlled view data. When the front end initiates an access request for the target data table, the system then jointly determines the valid view data and view name corresponding to the target data table under the current conditions based on the access request, the application form information table, and the data authorization information table. Only the valid view data is returned to the front end. This achieves seamless control over authorization request modeling, parameter constraints, view generation, and access return under the same application number. It prevents users from bypassing authorization to directly access the target data table or obtaining data outside the authorized time period, improves the fine-grained control and unauthorized access prevention capabilities of the data access process, and thus enhances the security of data authorization.

[0035] In this embodiment of the application, the application form information table has an approval status field; before the step of creating view data and view name for each target data table, the following is included: in response to an approval approval instruction for the application number, the approval status corresponding to the application number in the application form information table is updated to the approved status.

[0036] In this embodiment, the approval status field in the application form information table records the current processing result of each data authorization application in the approval process. This can include different values ​​such as pending approval, approved, or rejected. The approval approval instruction can be issued by a user with approval authority and converted into an approval operation request for the application number through the business system. Upon receiving an approval approval instruction corresponding to a specific application number, the system uses that application number as an index to locate the corresponding data authorization application record in the application form information table and updates the approval status field of that record to "approved." This explicitly marks the data authorization application as approved and ready to take effect at the data storage level. By updating the approval status of the application number in the application form information table to "approved" before creating the view data and view name for each target data table, explicit process gate control of data authorization applications is achieved at the approval status field level. This ensures that only applications that have been approved and marked as "approved" by the system can enter the subsequent processing path, preventing unapproved or failed applications from being mistakenly considered valid authorization requests. This reduces the possibility of unauthorized and unauthorized authorizations from the source of the process, thereby improving the security of data authorization.

[0037] In this embodiment, the application form information table also stores the mapping relationship between application number, applicant information, application authorization time period, and approval status; the data authorization information table stores the mapping relationship between application number, view data, and view name; the steps of determining the valid view data and view name of the target data table based on the access request, the application form information table, and the data authorization information table include: obtaining the current applicant information and current time of the current user from the access request; determining the archived application number corresponding to the current user according to the current applicant information and the application form information table; taking the archived application number whose current time is within the application authorization time period corresponding to the archived application number and whose approval status is "approved" as the valid application number; and determining the valid view data and view name according to the valid application number and the data authorization information table.

[0038] In this embodiment, the application form information table stores the mapping relationship between application number, applicant information, application authorization time period, and approval status, enabling each data authorization application to establish a one-to-one index association with the corresponding applicant subject, authorization time boundary, and approval result. The data authorization information table stores the mapping relationship between application number, view data, and view name, allowing view data and view names generated under the same application number to be uniformly collected. After receiving an access request, the system extracts the current applicant information and current time corresponding to the current user from the access request, matches the current applicant information with the applicant information in the application form information table, and thus determines the archived application number that the user has already archived in the system and is associated with their identity. Subsequently, the system filters these archived application numbers according to the relationship between the current time and the application authorization time period and the approval status, determining only the archived application numbers whose current time falls within the application authorization time period and whose approval status is "approved" as valid application numbers, and using the valid application number as the search key to query the corresponding view data and view name in the data authorization information table, thereby obtaining the valid view data and view name that the target data table is actually allowed to use under the current user and current time conditions. By utilizing the mapping relationship established in the application form information table and the data authorization information table, valid application numbers are first filtered out according to applicant information and time conditions. Then, the view data and view name that can be returned are limited accordingly. In the access request processing stage, joint verification of user identity, authorization time and authorization result is realized, which avoids data access requests without valid authorization numbers from directly falling on view data or even underlying data tables, thereby improving the security of data authorization.

[0039] In this embodiment, each target data table has a set of expected parameters, including a table number, expected fields, expected data range, and the organization to which the expected data belongs. The step of determining the allowed parameter set for each target data table based on its respective organization field name and expected parameter set includes: determining the allowed data range of the corresponding target data table based on its organization field name and expected data range; determining the organization to which the allowed data belongs based on its organization field name, allowed data range, expected data range, and the organization to which the expected data belongs; and determining the allowed fields of the corresponding target data table based on its expected fields.

[0040] In this embodiment, the expected parameter set for each target data table describes the authorization request made by the applicant at the table level. The table number uniquely identifies the target data table, the expected fields indicate the set of fields the applicant wishes to access in that target data table, the expected data range describes whether the applicant wishes to access all data in the target data table or a different data range such as institutional data, and the expected data's affiliated institution expresses the institution information of the data to be accessed at the institutional dimension. The institution field names for each of the multiple target data tables specify the fields in each target data table that serve as institutional identifiers, providing a clear field basis for the system when pruning data by institutional dimension. The allowed parameter set is a set of authorization parameters that can be actually adopted, generated by the system for each target data table after integrating the institution field names and the expected parameter set. The allowed data range in the allowed parameter set is the final authorized data range of the target data table determined after considering the existence of the institution field names and the values ​​of the expected data range. The allowed data's affiliated institution is the actual authorized institutional range of the target data table determined after considering factors such as the institution field names, allowed data range, and the expected data's affiliated institution. The allowed fields are the field range obtained by filtering the expected fields in conjunction with the set of legal fields in the target data table. By determining the allowed data range based on the organization field name and expected data range of each target data table, and then determining the organization to which the allowed data belongs based on the organization field name, allowed data range, expected data range, and the organization to which the expected data belongs, and combining the expected fields to determine the allowed fields, the system performs rule-based constraints and consistency checks on the user-submitted expected parameter set. This converges potentially unreasonable or unauthorized expected configurations into an allowed parameter set that conforms to the organization field constraints and field legality. This ensures that the authorization boundary of each target data table is clearly defined at the parameter level, preventing uncontrolled expected parameters from directly participating in subsequent data access control logic, thereby improving the security of data authorization from the authorization parameter generation stage.

[0041] In this embodiment of the application, the step of determining the allowed data range of the corresponding target data table based on the organization field name of each target data table and the expected data range for each target data table includes: if the organization field name of the current target data table is empty, the allowed data range of the current target data table is determined to be all the data of the current target data table; if the organization field name of the current target data table is not empty, the expected data range for the current target data table is taken as the allowed data range of the current target data table.

[0042] In this embodiment, the organization field name and the expected data range of each target data table are used together as the basis for judgment to calculate the allowed data range corresponding to the target data table. The current target data table is used to indicate a specific target data table being processed, and all data in the current target data table represents the complete data set of the target data table without any organization or range filtering. Specifically, when the organization field name of the current target data table is empty, the system believes that the target data table does not have the basic conditions for data segmentation by organization dimension. Therefore, the allowed data range of the current target data table is directly determined as all data in the current target data table, so that the table can only be used in the form of full table data in subsequent authorization scenarios. When the organization field name of the current target data table is not empty, it means that the target data table has been configured with a field that can be used for organization differentiation. In this case, the system directly uses the expected data range of the current target data table as the allowed data range of the current target data table, thereby preserving the applicant's authorization intention in the data range dimension and using it as the final authorization boundary of the target data table at the data range level. By using the above rules, when calculating the allowed data range, target data tables with and without organization fields are explicitly distinguished. This limits tables that do not support organization partitioning to the entire data range, while tables that support organization partitioning strictly follow the expected data range. This avoids tables without organization fields being misjudged as being authorized by organization or mixed-use situations at the data range level, thereby improving the standardization and security of data authorization configuration.

[0043] In this embodiment of the application, the applicant information includes the applicant's affiliated organization. The step of determining the allowed data belonging to the corresponding target data table based on the organization field name and allowed data range of each target data table, the expected data range for each target data table, and the organization to which the expected data belongs includes: if the allowed data range of the current target data table is all data, or the organization field name is empty, determine that the allowed data belonging to the current target data table is empty; if the allowed data range of the current target data table is organization data, and the expected data belonging to the current target data table is not empty, take the expected data belonging to the current target data table as the allowed data belonging to the current target data table; if the allowed data range of the current target data table is organization data, and the expected data belonging to the current target data table is empty, take the applicant's affiliated organization as the allowed data belonging to the current target data table.

[0044] In this embodiment of the application, the applicant's affiliated organization in the applicant information is used to identify the organizational affiliation of the applicant who initiated the data authorization application within the organizational structure, providing a basic identifier for subsequently limiting the data's affiliated organization at the organizational level. The organization field name of each target data table is used to indicate the field name used to record the affiliated organization of the data in the target data table. The allowed data range and the desired data range are used to represent the data range of the current target data table determined by the system after calculation by the preceding rules and the data range request made by the applicant on the current target data table, respectively. The desired data affiliated organization is used to represent the affiliated organization of the data that the applicant hopes to access on the current target data table, while the allowed data affiliated organization is used to represent the organizational level restriction of the current target data table that the system finally recognizes and permits after considering the information such as the organization field name, the allowed data range, and the desired data affiliated organization. Specifically, taking the current target data table as the processing object, if the allowed data range of the current target data table is all data, or if the organization field name of the current target data table is empty, the system determines that the allowed data to belong to the organization of the current target data table is empty, that is, no additional filtering conditions for the organization dimension are added to the target data table; if the allowed data range of the current target data table is organization data, and the organization to which the expected data belongs in the current target data table is not empty, the system directly confirms the organization to which the expected data belongs as the allowed data to belong in the current target data table; if the allowed data range of the current target data table is organization data, and the organization to which the expected data belongs in the current target data table is empty, the system then takes the applicant's organization as the allowed data to belong in the current target data table. By deriving the allowed data belonging to the current target data table step by step based on the organization field name, allowed data range, expected data range, and the organization to which the expected data belongs, the values ​​of the data belonging to the organization are standardized and filled with defaults at the organization dimension. This avoids incorrectly imposing organization constraints on target data tables that do not have an organization field, and also prevents the formation of an unconstrained state due to the omission of the expected data belonging to the organization in the organization data scenario. Thus, the authorization boundary of each target data table in terms of organization scope is clearly defined, laying the foundation for subsequent implementation of precise data access control at the organization dimension.

[0045] In this embodiment of the application, the step of determining the allowed fields of the corresponding target data table based on the expected fields for each target data table includes: if the expected fields for the current target data table are empty, taking all fields of the current target data table as the allowed fields of the current target data table.

[0046] In this embodiment, the desired field for each target data table represents the set of fields that the applicant wishes to be authorized to access in that target data table. This can be any subset of all fields in the current target data table. All fields in the current target data table represent the complete set of fields registered in the metadata or table structure, representing the upper limit of fields that the system can identify and manage. Allowed fields represent the range of authoritative fields ultimately confirmed for the current target data table after rule processing by the system, specifically reflecting the authorization boundary of the target data table at the field level. Specifically, if the desired field for the current target data table is empty, the system uses all fields of the current target data table as allowed fields. That is, if the applicant does not explicitly restrict the field range, the system defaults to full coverage authorization of all existing fields in the table, thus avoiding the situation where the field range is incorrectly reduced to zero or field configuration is missing due to the unfilled desired field. By automatically backtracking to all fields of the current target data table based on whether the expected field is empty, the above-mentioned method ensures the integrity and availability of the authorization configuration at the field level. This allows the system to generate well-defined and reasonably configured field authorization results even when field information is missing, avoiding data access anomalies caused by incorrect field configuration. This helps to ensure the stability and controllability of the data authorization process.

[0047] Through the above technical solution, the system generates a unique application number upon receiving a data authorization application and stores the application number, applicant information, and authorization time period in the application information table. Simultaneously, it determines the institution field name for each target data table based on a pre-set institution information table. Furthermore, it standardizes the expected parameter set (expected fields, expected data range, and the institution to which the expected data belongs) into an allowed parameter set (allowed data range, allowed institutions to which the allowed data belongs), thereby constraining and verifying the field range, data range, and institution range of the target data tables at the parameter level. After approving and controlling the data authorization application corresponding to the application number through the approval status field, the system creates controlled view data and view names based on the application number and the allowed parameter set for each target data table, and establishes the application number and view in the data authorization information table. The mapping relationship between data and view names solidifies the authorization results into view-level authorization units divided by application form and table. During the access phase, the system further filters valid application numbers based on the access request, application form information table, and data authorization information table, using the mapping relationship between application number, applicant information, application authorization time period, and approval status. Based on this, it determines the valid view data and view name of the target data table under the current user and current time conditions, allowing the front end to access only through valid view data, avoiding bypassing authorization to directly access the underlying target data table. In this way, a consistent authorization chain is formed in all stages of application, approval, parameter specification, view generation, and access control, ensuring that the authorization boundaries are precisely defined in terms of organization, time, and field dimensions, and that the authorization process is traceable and auditable, thereby improving the overall security of data authorization.

[0048] Figure 2 A schematic diagram illustrating a data authorization device according to an embodiment of this application is provided. Figure 2As shown in the illustration, this application also provides a data authorization device, which may include: a generation module 210, configured to generate an application number for a data authorization application form in response to receiving a data authorization application form; the data authorization application form includes applicant information, an application authorization time period, and expected parameter sets for each of multiple target data tables; a storage module 220, configured to store the application number, applicant information, and application authorization time period in an application form information table; and a first determination module 230, configured to determine the institution field name of the corresponding target data table based on each target data table and a preset institution information table; the preset institution information table stores each target data table and its institution field. The mapping relationship of names; the second determining module 240, used to determine the allowed parameter set of each target data table based on the organization field names of each of the multiple target data tables and the expected parameter set for each of the multiple target data tables; the creating module 250, used to create view data and view name of each target data table according to the application number and the allowed parameter set of each target data table, and store them in the data authorization information table; the sending module 260, used to respond to the access request for the target data table sent by the front end, determine the valid view data and view name of the target data table based on the access request, the application form information table and the data authorization information table, and send them to the front end.

[0049] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0050] This application also provides a machine-readable storage medium storing instructions that cause a machine to perform the above-described method.

[0051] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0052] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0053] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0054] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0055] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0056] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0057] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0058] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0059] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data authorization method, characterized by, The method comprises: in response to receiving a data authorization application form, generating an application number of the data authorization application form; the data authorization application form comprises applicant information, application authorization time period and respective expected parameter set for each target data table; storing the application number, the applicant information and the application authorization time period to an application form information table; determining the institution field name of the corresponding target data table according to each target data table and a preset institution information table; the preset institution information table stores the mapping relationship between each target data table and the institution field name; determining the allowed parameter set of each target data table based on the respective institution field name of the plurality of target data tables and the respective expected parameter set for the plurality of target data tables; creating the view data and the view name of each target data table according to the application number and the allowed parameter set of each target data table, and storing them into a data authorization information table; in response to the access request for the target data table sent by the front end, determining the effective view data and the view name of the target data table based on the access request, the application form information table and the data authorization information table, and sending them to the front end.

2. The method of claim 1, wherein, The application form information table is provided with an approval state field; Before the step of creating the view data and the view name of each target data table, it comprises: in response to the approval pass instruction for the application number, updating the approval state corresponding to the application number in the application form information table to the pass state.

3. The method of claim 2, wherein, The application form information table also stores the mapping relationship between the application number, the applicant information, the application authorization time period and the approval state; the data authorization information table stores the mapping relationship between the application number, the view data and the view name; The step of determining the effective view data and the view name of the target data table based on the access request, the application form information table and the data authorization information table comprises: obtaining the current applicant information and the current time of the current user from the access request; determining the archived application number corresponding to the current user according to the current applicant information and the application form information table; taking the archived application number as the effective application number, which is within the application authorization time period corresponding to the archived application number and whose approval state corresponding to the archived application number is the pass state; determining the effective view data and the view name according to the effective application number and the data authorization information table.

4. The method according to any one of claims 1 to 3, characterized in that, The expected parameter set for each target data table is provided with a table number, an expected field, an expected data range and an expected data belonging institution; The step of determining the allowed parameter set of each target data table based on the respective institution field name of the plurality of target data tables and the respective expected parameter set for the plurality of target data tables comprises: determining the allowed data range of the corresponding target data table according to the institution field name of each target data table and the expected data range for each target data table; determining, according to the agency field name of each target data table and the allowed data range, the allowed data range of the corresponding target data table according to the expected data range of each target data table and the expected data agency of each target data table; determining, according to the expected field of each target data table, the allowed field of the corresponding target data table.

5. The method of claim 4, wherein, The step of determining, according to the agency field name of each target data table and the allowed data range, the allowed data range of the corresponding target data table according to the expected data range of each target data table and the expected data agency of each target data table comprises: in the case that the agency field name of the current target data table is empty, determining that the allowed data range of the current target data table is the whole data of the current target data table; in the case that the agency field name of the current target data table is not empty, taking the expected data range of the current target data table as the allowed data range of the current target data table.

6. The method of claim 4, wherein, The applicant information comprises an agency of the applicant; The step of determining, according to the agency field name of each target data table and the allowed data range, the allowed data range of the corresponding target data table according to the expected data range of each target data table and the expected data agency of each target data table comprises: in the case that the allowed data range of the current target data table is the whole data, or the agency field name is empty, determining that the allowed data agency of the current target data table is empty; in the case that the allowed data range of the current target data table is agency data, and the expected data agency of the current target data table is not empty, taking the expected data agency of the current target data table as the allowed data agency of the current target data table; in the case that the allowed data range of the current target data table is agency data, and the expected data agency of the current target data table is empty, taking the agency of the applicant as the allowed data agency of the current target data table.

7. The method of claim 4, wherein, The step of determining, according to the expected field of each target data table, the allowed field of the corresponding target data table comprises: in the case that the expected field of the current target data table is empty, taking the whole field of the current target data table as the allowed field of the current target data table.

8. A data authorization apparatus characterized by comprising: comprise: generating, in response to receiving a data authorization application form, an application number of the data authorization application form; the data authorization application form comprises applicant information, an application authorization time period and an expected parameter set of each of a plurality of target data tables; storing, to an application form information table, the application number, the applicant information and the application authorization time period; determining, according to each target data table and a preset agency information table, an agency field name of the corresponding target data table; the preset agency information table stores a mapping relationship between each target data table and an agency field name; determining, based on the agency field name of each of the plurality of target data tables and the expected parameter set of each of the plurality of target data tables, an allowed parameter set of each of the plurality of target data tables; A creating module is configured to create view data and a view name of each target data table according to the application number and the allowed parameter set of each target data table, and store the view data and the view name into a data authorization information table; A sending module is configured to, in response to an access request for the target data table sent by a front end, determine valid view data and a view name of the target data table based on the access request, the application information table and the data authorization information table, and send the valid view data and the view name to the front end.

9. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium has instructions stored thereon for causing a machine to perform the method according to any one of claims 1 to 7. The machine-readable storage medium has instructions stored thereon for causing a machine to perform the method according to any one of claims 1 to 7.

Images