Distributed database data access method and related equipment

Abstract

The invention provides a distributed database data access method and related equipment, and relates to the technical field of computers. The method comprises the following steps: acquiring a data access request initiated by a user, wherein the data access request is a request based on an SQL statement; analyzing the SQL statement to obtain a to-be-accessed data table; determining a permission label of the to-be-accessed data table, wherein the permission label comprises at least one of a table permission label, a column permission label and a row permission label; performing permission verification on the user based on the permission label of the to-be-accessed data table; and if the permission verification is passed, executing the SQL statement to query the distributed database to obtain a data access result, and returning the data access result to the user. The authority control granularity can be refined, an authority strategy does not need to be independently configured for the data table, and the operation and maintenance difficulty is reduced.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a distributed database data access method, a distributed database data access device, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] For distributed databases with separate storage and computation, a distributed Structured Query Language (SQL) agent is often used as the computation service layer to provide user access and database services.

[0003] In related technologies, distributed databases typically employ role-based access control, using standard SQL statements to manage permissions. However, this permission management method suffers from problems such as coarse-grained management, poor real-time performance, and low security.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a distributed database data access method and related equipment, which at least to some extent overcomes the problems of coarse management granularity, poor real-time performance, and low security in related technologies for distributed database data access.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a distributed database data access method is provided, comprising: obtaining a data access request initiated by a user, the data access request being a request based on a structured query statement (SQL); parsing the SQL statement to obtain a data table to be accessed; determining the permission tags of the data table to be accessed, the permission tags including at least one of table permission tags, column permission tags, and row permission tags; performing permission verification on the user based on the permission tags of the data table to be accessed; if the permission verification passes, executing the SQL statement to query the distributed database, obtaining a data access result, and returning the data access result to the user.

[0008] In one embodiment of this disclosure, the permission tag includes a table permission tag; wherein, the permission verification of the user based on the permission tag of the data table to be accessed includes: if the data table to be accessed has declared tag-based permission control, then querying whether the user has access rights to the table permission tag; if not, then determining that the permission verification has failed and refusing to execute the SQL statement; if yes, then determining that the table access permission verification has passed.

[0009] In one embodiment of this disclosure, the permission label further includes a column permission label; wherein, the method further includes: if the table access permission verification passes, then traversing the columns in the data table to be accessed; determining whether the column permission label of the current column and the user label of the user satisfy the security policy; if they satisfy, then determining that the column access permission verification passes and allowing the user to access the current column; if they do not satisfy, then determining that the column access permission verification fails and denying the user access to the current column.

[0010] In one embodiment of this disclosure, the permission tag further includes row permission tags; wherein, the method further includes: if the table access permission verification passes, obtaining the security policy of the data table to be accessed, and querying whether the user has the access permission of the security policy; if so, querying the set of row permission tags less than or equal to the user's user tags, and determining the number of row permission tags that the user can access; rewriting the SQL statement according to the number of row permission tags that the user can access, to obtain the rewritten SQL statement; querying the distributed database based on the rewritten SQL statement to obtain the data access result.

[0011] In one embodiment of this disclosure, the method further includes: creating a security tag component, a security policy, security tags, and a data table, wherein the security tags include user tags and permission tags; and granting tag permissions to users based on the data table, wherein the data table to be accessed is at least one of the data tables.

[0012] In one embodiment of this disclosure, the method further includes storing metadata associated with the security tag in the distributed key-value storage system.

[0013] In one embodiment of this disclosure, different database cluster information corresponds to the first-level directory of the distributed key-value storage system, and user permission information under the same database cluster is divided into multiple nodes, with each node storing corresponding metadata associated with the security tag.

[0014] In one embodiment of this disclosure, the method further includes: when the application starts, obtaining the user's user permission information from the distributed key-value storage system; when a change in the user permission information in the distributed key-value storage system is detected, obtaining the changed user permission information; and / or when a change in the user permission information along a path in the distributed key-value storage system is detected, synchronizing the changed user permission information to the remaining paths in the distributed key-value storage system.

[0015] According to another aspect of this disclosure, a distributed database data access device is also provided, comprising: a request acquisition module, configured to acquire a data access request initiated by a user, wherein the data access request is a request based on a structured query statement (SQL); a statement parsing module, configured to parse the SQL statement to obtain a data table to be accessed; a permission determination module, configured to determine the permission tags of the data table to be accessed, wherein the permission tags include at least one of table permission tags, column permission tags, and row permission tags; a permission verification module, configured to verify the user's permissions based on the permission tags of the data table to be accessed; and a statement execution module, configured to execute the SQL statement to query the distributed database if the permission verification passes, obtain a data access result, and return the data access result to the user.

[0016] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-described distributed database data access method by executing the executable instructions.

[0017] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the above-described distributed database data access method.

[0018] According to another aspect of this disclosure, a computer program product is provided, the computer program product comprising a computer program or computer instructions, the computer program or computer instructions being loaded and executed by a processor to enable a computer to implement the above-described distributed database data access method.

[0019] In this embodiment, a user-initiated data access request is obtained, which is a request based on an SQL statement. The SQL statement is parsed to obtain the data table to be accessed. The permission tags of the data table to be accessed are determined, and the permission tags include at least one of table permission tags, column permission tags, and row permission tags. The user's permissions are verified based on the permission tags of the data table to be accessed. If the permission verification passes, the SQL statement is executed to query the distributed database, obtain the data access result, and return the data access result to the user. This disclosure can provide a more efficient, reliable, and secure permission management method for distributed databases. By using tag-based access control, row-level permission control is achieved, refining the granularity of permission control. There is no need to configure permission policies separately for data tables, reducing the difficulty of operation and maintenance.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0022] Figure 1 This diagram illustrates a flowchart of a distributed database data access method provided in an embodiment of this disclosure.

[0023] Figure 2 This illustration shows a flowchart of another distributed database data access method provided in an embodiment of the present disclosure.

[0024] Figure 3 This diagram illustrates a flowchart of another distributed database data access method provided in an embodiment of this disclosure.

[0025] Figure 4 This diagram illustrates a flowchart of another distributed database data access method provided in an embodiment of the present disclosure.

[0026] Figure 5 This illustration shows an example flowchart of a distributed database data method provided in an embodiment of this disclosure.

[0027] Figure 6 This diagram illustrates a flowchart of a distributed database data method provided in an embodiment of this disclosure.

[0028] Figure 7A and 7B The following is a flowchart illustrating a second example of a distributed database data method provided in this disclosure.

[0029] Figure 8 This diagram illustrates the structure of a distributed database data access device provided in an embodiment of the present disclosure.

[0030] Figure 9 A structural block diagram of an electronic device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0031] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0032] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0033] To enable those skilled in the art to better understand the technical solutions of this disclosure, the following detailed description is provided in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0034] In related technologies, distributed databases adopt role-based access control and implement permission management through standard SQL syntax. The permission management level can include database level, table level, column level, etc. The database level is used to control users' global operations on the database, the table level restricts users' operation permissions on specific tables, and the column level is used for fine-grained control of field access.

[0035] Permission management can dynamically configure permissions using the GRANT or REVOKE statements, supports role inheritance, stores permission metadata in system tables, and relies on distributed transactions to ensure multi-node synchronization.

[0036] However, role-based access control is a static permission model, which is disconnected from data attributes and has the following main problems: 1. Row-level control is missing, and column-level permissions cannot control the dynamic process of different rows in the same column (e.g., for a mobile phone number column, users can only view the mobile phone numbers of employees in their own department). The permission system cannot perceive the data content, which can easily lead to the exposure of the entire data table.

[0037] 2. Coupling of read and write permissions: In related technologies, GRANT SELECT and UPDATE statements result in a writable range that is greater than or equal to the readable range, which poses a risk that users can modify invisible data, violating the principle of least privilege, such as modifying the order amount for which no user has viewing permission.

[0038] 3. Security policies are difficult to reuse. Each data table needs to be configured with a security policy independently, which leads to complex operation and maintenance and is prone to errors.

[0039] To at least partially solve the aforementioned technical problems, this disclosure involves: acquiring user-initiated data access requests, which are based on SQL statements; parsing the SQL statements to obtain the data table to be accessed; determining the permission tags of the data table to be accessed, which include at least one of table permission tags, column permission tags, and row permission tags; verifying user permissions based on the permission tags of the data table to be accessed; if the permission verification passes, executing the SQL statement to query the distributed database, obtaining the data access result, and returning the data access result to the user. This disclosure can provide a more efficient, reliable, and secure permission management method for distributed databases. Through tag-based access control, row-level permission control is achieved, refining the granularity of permission control, eliminating the need to configure permission policies separately for data tables, and reducing the difficulty of operation and maintenance.

[0040] It should be noted that, unless otherwise specified, the embodiments of the present invention and the technical features thereof can be combined with each other.

[0041] The following detailed description of this exemplary implementation method is provided in conjunction with the accompanying drawings and embodiments.

[0042] First, this disclosure provides a distributed database data access method, which can be executed by any electronic device with computing capabilities. The distributed database data access method provided in this disclosure can also be executed by a distributed database system.

[0043] Figure 1 This diagram illustrates a flowchart of a distributed database data access method provided in an embodiment of this disclosure, such as... Figure 1 As shown in the embodiments of this disclosure, the distributed database data access method mainly includes the following steps: S102. Obtain the data access request initiated by the user. The data access request is a request based on Structured Query Language (SQL).

[0044] In one embodiment, a data access request is a user-initiated request to access data from a distributed database. The data access request may include an identity identifier, an operation target, and an operation behavior. The identity identifier is used to locate the entity accessing the distributed database, i.e., the user's identity information; the operation target is used to locate the resource in the distributed database to be accessed; and the operation behavior defines the specific behavior type of the data access request, which may include query operations (SELECT), write operations (such as INSERT, UPDATE, and DELETE), etc.

[0045] Users can initiate data access requests to the distributed database system through applications installed on their terminal devices, and the distributed database system will then receive these data access requests.

[0046] S104. Parse the SQL statement to obtain the data table to be accessed.

[0047] In one embodiment, after receiving a data access request based on an SQL statement, the distributed database converts the standard SQL statement into an Abstract Syntax Tree (AST) and further parses its semantics to obtain the data table to be accessed. The AST can transform the SQL statement-based data access request into parsable and traversable structured data. The root node of the AST represents the data access request, the first-level leaf nodes correspond to identity nodes, operation target nodes, and operation behavior nodes, and the second-level leaf nodes represent the specific elements under the corresponding first-level leaf nodes, as well as security labels, security policies, etc.

[0048] The data table to be accessed is the data table stored in the distributed database that the user wishes to access. The data table to be accessed may include multiple column fields and multiple row fields. The column information mentioned above refers to the information corresponding to the column fields to be accessed. In one feasible implementation, the data table to be accessed can also be a sharded table.

[0049] It should be noted that the parsed data table to be accessed can be one or more. When multiple data tables are parsed, user permissions can be verified separately for each table. Each data table to be accessed can include one column or multiple columns, and column permissions can be verified separately for each user. Each data table to be accessed can include multiple rows, and row permissions can be verified separately for each user.

[0050] S106. Determine the permission labels of the data table to be accessed. The permission labels include at least one of the following: table permission label, column permission label, and row permission label.

[0051] In one embodiment, permission tags for the data table to be accessed can be extracted from the AST.

[0052] Table permission tags are security identifiers associated with table objects in a distributed database, and apply only to the table. Column permission tags are security identifiers associated with columns in a table, and apply only to the corresponding column. Row permission tags are security identifiers associated with rows in a table, and apply only to the corresponding row.

[0053] It should be noted that in a sharded table scenario, the table permission tags need to be synchronized to all data nodes where the shards reside.

[0054] S108. Perform permission verification on the user based on the permission tags of the data table to be accessed.

[0055] In one embodiment, user permissions can be verified by checking whether the permission tags of the data table to be accessed and the user tags corresponding to the user meet the pre-configured security policy.

[0056] S110. If the permission verification passes, execute the SQL statement to query the distributed database, obtain the data access result, and return the data access result to the user.

[0057] When the permission label and user label of the data table to be accessed meet the pre-configured security policy, the user's permission verification is deemed successful, allowing the user to access the data table to be accessed. An execution plan is generated based on the SQL statement, the execution engine processes the execution plan to obtain the data access result, and the data access result is returned to the user.

[0058] When the permission label and user label of the data table to be accessed do not meet the pre-configured security policy, the user's permission verification is deemed to have failed, the user is denied access to the data table to be accessed, and the SQL statement is not executed.

[0059] In this embodiment, a user-initiated data access request is obtained, which is a request based on an SQL statement. The SQL statement is parsed to obtain the data table to be accessed. The permission tags of the data table to be accessed are determined, and the permission tags include at least one of table permission tags, column permission tags, and row permission tags. The user's permissions are verified based on the permission tags of the data table to be accessed. If the permission verification passes, the SQL statement is executed to query the distributed database, obtain the data access result, and return the data access result to the user. This disclosure can provide a more efficient, reliable, and secure permission management method for distributed databases. By using tag-based access control, row-level permission control is achieved, refining the granularity of permission control. There is no need to configure permission policies separately for data tables, reducing the difficulty of operation and maintenance.

[0060] In one embodiment, the distributed database data access method disclosed herein further includes: creating a security tag component, a security policy, security tags, and a data table; and granting tag permissions to users based on the data table.

[0061] Security tags are attribute labels attached to data resources or users, used to mark the security level, scope, and access restrictions of data. Security tags can include permission tags and user tags. In distributed databases, security tags are the smallest unit for identifying data sensitivity and matching user permissions. Data resources can include data, tables, rows, columns, shards, etc., within the distributed database. Users can include user account information, user identifiers, user roles, etc. For example, in a distributed scenario, user tags serve as user identification; user tags can be "manager," "regular employee," etc.

[0062] By comparing permission tags with user tags, it is possible to determine whether a user has permission to access a data table or a specific row or column of data within a data table. This eliminates the need to modify the data structure, and permission differentiation can be achieved through security tags, thus adapting to the elastic scaling requirements of distributed databases.

[0063] A security policy is a rule engine for matching security tags. It defines the logical rules for determining whether a user has access permissions based on security tags. Security policies can include level matching policies, attribution matching policies, combined matching policies, exception policies, etc.

[0064] For the level matching strategy, when a user's tag level is greater than or equal to their permission tag level, the user is determined to have access to the resource. For example, if the permission tag levels for resources are divided into top secret, confidential, internal, and normal levels, a user with a confidential tag level can access resources at the confidential, internal, and normal levels, while a user with an internal tag level cannot access resources at the confidential and top secret levels.

[0065] For the attribution matching strategy, when a user's tag type matches a permission tag, it is determined that the user has access rights to the resource. For example, a user tagged as "R&D Department" is allowed to access resources tagged as "R&D Department," but is not allowed to access resources tagged as "Finance Department."

[0066] For combined matching strategies, a user is deemed to have access to a resource only if their user tag simultaneously meets the conditions of multiple permission tags. For example, a user tag may need to meet both a level-based matching strategy and an affiliation-based matching strategy to be allowed access to the corresponding resource.

[0067] For exception policies, rule exemptions apply to emergency authorization. For example, a user with a regular tag can access a resource labeled "confidential" through an exception policy.

[0068] The security policy component is a modular set of functions in a distributed database that implements security label management and security policy execution. It transforms security labels and policies from concepts into practical security controls. The security policy component is used for label metadata management, label binding, policy parsing, permission verification, and label synchronization. For example, the security policy component can be implemented using triggers, hook functions, and other methods.

[0069] A data table is a file used to store data in a distributed database. A data table can include multiple columns, multiple rows, etc.

[0070] When creating a data table, you can configure access permission tags. Access permission tags can include, but are not limited to, table access permission tags, column access permission tags, and row access permission tags. You can configure them according to your actual needs. This disclosure does not make any specific restrictions on them.

[0071] In one embodiment, the creation of security tag components, security policies, security tags, and data tables can be achieved through SQL statements, as well as granting tag permissions to users based on the data tables.

[0072] Security label components can be created using the standard SQL statement `CREATE SECURITY LABEL COMPONENT`. For example, the SQL statement `CREATE SECURITY LABEL COMPONENT component-name {ARRAY|SET|TREE}string-constant` creates a security label component named `component-name`. Here, `{ARRAY|SET|TREE}` represents the structure type of the security label component, determining the relational logic of the label values. `ARRAY` indicates that the label values ​​are an ordered array, `SET` indicates that the label values ​​are an unordered set, and `TREE` indicates that the label values ​​are a tree-like hierarchical structure. `string-constant` represents the structure definition string for the label values; different structure types correspond to different relational rules.

[0073] Security policies can be created using the standard SQL statement `CREATE SECURITY POLICY`, and then bound to security label components. For example, in the SQL statement `CREATE SECURITY POLICY policy-name COMPONENTS component-list`, `policy-name` represents the name of the security policy, and `component-list` represents the list of security label components to which the security policy is bound.

[0074] Security labels can be created using the standard SQL statement `CREATE SECURITY LABEL`. For example, the SQL statement `CREATE SECURITY LABEL policy_name.label_name '(component1_value):(component2_value):...:(componentN_value)'` binds the security policy name and label combination to multiple component label values. This clarifies the specific components that the security label under the security policy needs to be associated with, thus forming a policy-label-component value association. This allows for precise matching of label conditions at the component level during permission verification.

[0075] You can create a data table using the standard SQL statement `CREATE TABLE`, and declare table permission labels, column permission labels, row permission labels, etc. For example, you can declare column permission labels using the following SQL statement: CREATE TABLE table_name ( column1 datatype, column2 datatype, ..., _security_label varchar(255) – Column permission label ) SECURITYLABEL column1(label_name1), column2(label_name2), ... USING policy_name; In the newly created table table_name, the column permission label for column1 is label_name1, the column permission label for column2 is label_name2, and the security policy is policy_name.

[0076] Security labels can be granted to users using the standard SQL statement in the GRANT SECURITY LABEL. For example: GRANT SECURITY LABEL policy_name.label_name TO 'username'@'host' FOR [READ|WRITE]; The above SQL statement is used to grant read and write tag permissions to the user whose username is "host".

[0077] In practical implementation, the system can use the parsing capabilities of standard SQL statements and the Goyacc tool to generate an efficient syntax parser based on predefined SQL syntax rules. This allows the system to convert user-inputted SQL statements into an abstract syntax tree, ensuring that the system can accurately understand and process complex permission management operations.

[0078] In this embodiment, by creating a security tag component, security policy, security tag, and data table, and granting tag permissions to users based on the data table, component-level data access control can be achieved. This enables fine-grained data access in the distributed database, ensures consensus of permissions across all nodes in a distributed scenario, avoids permission leakage between shards, reduces operation and maintenance costs, and supports dynamic adjustments.

[0079] Figure 2 This diagram illustrates another distributed database data access method provided by an embodiment of the present disclosure. Figure 2 As shown, in one embodiment, the permission label includes a table permission label; wherein, the above-mentioned S108 performs permission verification on the user based on the permission label of the data table to be accessed, including: S202. If the data table to be accessed has declared tag-based access control, then query whether the user has access rights to the table's permission tags. S204. If not, the permission verification is deemed to have failed, and the SQL statement is refused to be executed. S206. If yes, then the table access permission check is passed.

[0080] In one embodiment, the data table to be accessed can have its tag-based access control declared during the creation of the data table, or the tag-based access control of the data table to be accessed can be modified during the use of the data table.

[0081] When the table to be accessed does not declare tag-based access control, it indicates that the table is accessible to users. The corresponding execution plan is generated based on the SQL statement, and the execution engine executes the data access. The permission verification continues for the next table to be accessed until all the parsed tables have completed the permission verification.

[0082] When the data table to be accessed has declared tag-based access control, it is necessary to determine whether the user has the permission to access the data table. This can be done by querying the AST to determine the user's user tag, and by comparing the user tag with the table permission tag, it can be determined whether the user has the access permission to the data table to be accessed.

[0083] It should be noted that tag permissions can be granted to users through a security administrator.

[0084] When a user does not have access rights to the table's permission tags, the permission verification is deemed to have failed, the system refuses to execute the SQL statement, and continues to verify the permissions of the next table to be accessed, until all tables to be accessed have completed the permission verification.

[0085] When a user has access rights to the table's permission tags, the permission verification is considered successful. At this point, the permission verification continues for the next table to be accessed, until all tables to be accessed have completed the permission verification.

[0086] It should be noted that if no column permission labels or row permission labels are configured for the data table to be accessed, permission verification will continue for the next data table to be accessed; if column permission labels or row permission labels are configured for the data table to be accessed, column permission verification or row permission verification will continue for that data table.

[0087] In this embodiment, by implementing tag-based access control on the data table to be accessed, tags, users, and table resources are associated to achieve fine-grained verification at the component level. Only users with access permission tags matching the table can access the data table to be accessed, avoiding the risk of full table visibility upon authorization. Access control for multiple data tables to be accessed can be adapted by binding different tags, thereby improving the reusability of security policies. By modifying the values ​​of the table access permission tags, the access permissions of the table can be modified, making permission adjustments more flexible.

[0088] Figure 3 This diagram illustrates a flowchart of yet another distributed database data access method provided in an embodiment of this disclosure. Figure 3 As shown, in one embodiment, the permission label further includes a column permission label; wherein, the method further includes: S302. If the access permission check of the table is passed, then traverse the columns of the data table to be accessed. S304. Determine whether the column permission label of the current column and the user's user label meet the security policy. S306. If satisfied, the column access permission check is deemed successful, and the user is allowed to access the current column. S308. If not satisfied, the column access permission check is deemed to have failed, and the user is denied access to the current column.

[0089] In one embodiment, when the data table to be accessed declares table permission labels and column permission labels, after the table access permission verification passes, column access permission verification continues to be performed column by column based on the column permission labels.

[0090] If the current column does not have a column permission label configured, continue to perform column permission validation on the next column.

[0091] When the current column is configured with a column permission label, the column permission label and the user label are compared. If all the conditions configured in the security policy are met, the column access permission verification is deemed to have passed, and the user is allowed to access the current column. If at least one condition configured in the security policy is not met, the column access permission verification is deemed to have failed, and the user is denied access to the column.

[0092] After the current column completes the column access permission check, the next column is checked. If all columns in the data table to be accessed have completed the column access permission check, an execution plan is generated, and the engine is confident in performing the data access.

[0093] Security strategies include comparison order, comparison inclusion relationship, and judgment conditions for comparing at least one of the tree nodes containing each other.

[0094] For example, user A is granted the "department manager" label and can view the salary column in the employee table, while user B does not have the "department manager" label. When user B queries the salary column, the query is automatically blocked, thus achieving dynamic data anonymization based on security levels.

[0095] In this embodiment of the disclosure, by configuring column permission tags on the data table to be accessed, fine-grained security access control can be implemented on specific columns or column fields in the data table. By binding security tags to different users, access permissions for users to column data can be dynamically restricted.

[0096] Figure 4 This diagram illustrates a flowchart of another distributed database data access method provided in an embodiment of this disclosure. Figure 4 As shown, in one embodiment, the permission label further includes a row permission label; wherein, the method further includes: S402. If the access permission check of the judgment table passes, obtain the security policy of the data table to be accessed and query whether the user has the access permission of the security policy. S404. If so, query the set of row permission tags that are less than or equal to the user's tags, and determine the number of row permission tags that the user can access. S406. Based on the number of row permission tags that the user can access, rewrite the SQL statement to obtain the rewritten SQL statement; S408. Query the distributed database based on the rewritten SQL statement to obtain the data access results.

[0097] The AST can be queried to determine whether a user has the access permissions required by the security policy. By checking the user tag granted to the user, it can be checked whether there are row permission tags with lower permissions than the user tag. If so, row permission tags with lower permissions than the user tag are filtered out to form a row permission tag set. The number of row permission tags that a user can access is the number of row permission tags corresponding to the row permission tags in the row permission tag set.

[0098] For example, the permissions corresponding to labels 1, 2, 3, and 4 decrease sequentially. When a user is granted label 2, the set of accessible row permission labels is {label 2, label 3, and label 4}, and the number of accessible row permission labels is 3. When a user is granted label 4, the set of accessible row permission labels is {label 4}, and the number of accessible row permission labels is 1. When a user is not granted any of the above labels, the set of accessible row permission labels is empty, the user does not have the access permissions of the security policy, and the execution of SQL statements is refused.

[0099] In S406, when the number of row permission labels that a user can access is 1, add Where_security_label=? to the original SQL statement as the rewritten SQL statement.

[0100] When the number of row permission labels that a user can access is greater than 1, add Where_security_label in (?,?) to the original SQL statement.

[0101] In one embodiment, before obtaining the security policy of the data table to be accessed and querying whether the user has the access permissions according to the security policy, it is determined whether it is one of Insert, Update, Select, and Delete; if not, it is returned directly; if so, the data table and columns to be accessed in the AST are parsed. Each data table to be accessed is processed in a loop.

[0102] After obtaining the rewritten SQL statement, the value of the security label _security_label in Insert and Update is validated to confirm that the label value of _security_label is valid and that the label granted to the user is greater than or equal to the label value of _security_label.

[0103] In this embodiment, row-level data tag-based access control dynamically restricts user access to specific data rows by binding corresponding row permission tags to each row in the data table. The system matches row permission tags with user tags; when an unauthorized user queries, rows that do not meet the tag conditions are automatically filtered, achieving fine-grained control over data row visibility.

[0104] In one embodiment, the distributed database data access method provided in this disclosure further includes: storing metadata associated with security tags in a distributed key-value storage system. For example, the distributed key-value storage system can be ETCD, which is a distributed key-value pair store used for configuration management, service discovery, and distributed coordination in the distributed database, thereby achieving high availability and strong consistency of permission data. ETCD uses the Raft protocol to achieve distributed consistency, ensuring the reliability and real-time performance of permission data in a distributed environment.

[0105] In one embodiment, different database cluster information corresponds to the first-level directory of the distributed key-value storage system, and user permission information under the same database cluster is divided into multiple nodes, with each node storing the corresponding metadata associated with the security label.

[0106] In practical implementation, a distributed key-value storage system can adopt a three-tier directory structure. The first tier directory contains database cluster information, also known as the cluster directory. The data in this first-tier directory is the metadata of all security tags within a single database cluster, isolating permission data across different database clusters and preventing data contamination. The second tier directory is the node directory. The data in this second-tier directory consists of the security tag components and associated data managed by a single permission node within the same database cluster, thus separating permission data within the database cluster and achieving load balancing and fault isolation. The data in the third tier, the target directory, contains specific security tag metadata, such as security tags, security tag components, and security policies. Structured storage is used to store the metadata associated with security tags, facilitating accurate querying and updates.

[0107] In one embodiment, the method further includes: when the application starts, obtaining user permission information from the distributed key-value storage system; when a change in user permission information in the distributed key-value storage system is detected, obtaining the changed user permission information; and / or when a change in user permission information along a path in the distributed key-value storage system is detected, synchronizing the changed user permission information to the remaining paths in the distributed key-value storage system.

[0108] When the application starts, it pulls the latest transfer user permission information from the distributed key-value store system to ensure that accurate data is loaded during initialization.

[0109] During application use, a monitoring mechanism is used to monitor ETCD in real time. When user permission information in ETCD changes, the application immediately detects the change and retrieves the updated user permission information from ETCD, thereby ensuring the real-time nature and consistency of user permission information. This not only improves the system's flexibility and ensures the efficiency and reliability of permission management, but also significantly enhances the system's flexibility and responsiveness by using the Watch mechanism to support real-time notification of dynamic permission changes.

[0110] For different user permission information, a listening mechanism is used to monitor different paths in ETCD in real time. When the user permission information of a certain path changes, the changed user permission information is pulled and synchronized to other paths to ensure that permission changes can be accurately and timely synchronized to the relevant modules.

[0111] In this disclosure, ETCD uses the Raft consensus algorithm, which, through election mechanisms and log replication, ensures that the system can still operate normally even if some nodes fail, effectively avoiding single points of failure and achieving higher reliability. It ensures that all clients can read the latest user permission data at any time, providing a reliable consistency guarantee for permission management. ETCD focuses more on performance optimization, can handle high-concurrency read and write requests, meets the performance requirements of large-scale distributed systems, supports multi-node deployment, can scale horizontally to adapt to the ever-growing system size, and can be configured with password access control to prevent unauthorized users from accessing the system.

[0112] To deepen the understanding of this publicly available distributed database data access method, the following section, in conjunction with the appendix, provides further details. Figures 5-6 ,as well as Figure 7A and 7B To explain, among other things, Figure 5 This describes the overall process of data access in a distributed database. Figure 6 The process for performing table permission checks and column permission checks, Figure 7A and Figure 7B This describes the process for performing table permission checks and row permission checks.

[0113] like Figure 5 As shown, distributed database data access methods include: S502: The user initiates a data access request to the distributed database through the client.

[0114] S504. Handling Connections: The distributed database establishes a connection with the client and receives data access requests, which are based on SQL statements.

[0115] S506, SQL parsing: The distributed database parses SQL statements, converts them into an abstract syntax tree (AST), further parses the semantics, obtains the data table to be accessed, and determines the permission tags of the data table to be accessed.

[0116] S508, Permission Verification: Verify user permissions based on the permission tags of the data table to be accessed, and obtain the permission verification result.

[0117] S510. Generate an execution plan based on the permission verification results.

[0118] S512. The execution engine executes the above execution plan, obtains the data access results, and returns them to the client.

[0119] like Figure 6 As shown, when performing table permission checks and column permission checks, the above S508 includes: S601. Determine whether the operation in the data access request is the target operation. If not, the verification passes and S510 is executed. If yes, S602 is executed. The target operation can be at least one of Insert, Update, Select, and Delete. S602. Parse the data tables and columns to be accessed in the AST. There can be one or more data tables to be accessed. S603, process each data table to be accessed in a loop; S604. Determine whether the data table to be accessed is based on tag-based access control. If yes, execute S605; otherwise, execute S613. S605. Obtain the security policy of the data table to be accessed; S606. Check if the user has access permissions to the table permission tags. If yes, execute S607; otherwise, execute S616. S607. Traverse all columns in the data table to be accessed; S608. Determine whether the current column is configured with tag-based access control. If yes, execute S609; otherwise, execute S615. S609. Determine whether the column permission label and user label of the current column meet the security policy. If yes, execute S610; otherwise, execute S616. S610, Allow access to this column; S611. Determine if there are more columns. If yes, return to S607; otherwise, execute S612. S612, Verification passed, return to S510; S613, Continue to the next data table to be accessed; S614. There are more data tables to be accessed. If yes, return to S603; otherwise, execute S612. S615, Continue to the next column, return to S607; S616, Access to this column is denied.

[0120] In S608, a security administrator can grant tag permissions to users.

[0121] In S609, security policy rules can include comparison order, comparison of containment relationships, comparison of tree node containment, etc. It should be noted that access to a column is only allowed when all conditions are met; otherwise, access is denied.

[0122] like Figure 7A As shown, when performing table permission verification and row permission verification, the above S508 includes: S701. Determine whether the operation in the data access request is the target operation. If not, the verification passes and S510 is executed. If yes, S702 is executed. The target operation can be at least one of Insert, Update, Select, and Delete. S702. Parse the data tables and columns to be accessed in the AST. There can be one or more data tables to be accessed. S703, process each data table to be accessed in a loop; S704. Determine whether the data table to be accessed is based on tag-based access control. If yes, execute S705; otherwise, execute S708. S705. Obtain the security policy of the data table to be accessed; S706. Check if the user has access permissions to the table permission tags. If yes, execute S707; otherwise, execute S710. S707, Query the set of row permission tags that are less than or equal to the current user; S708, Continue to the next data table to be accessed; S709. There are more data tables to be accessed. If yes, return to S705; otherwise, end and return to S510. S710, Access Denied.

[0123] like Figure 7B As shown, the method also includes a row permission verification operation, specifically S707 above: S711, Obtain the row permission tags that the user can access; S712. Determine if the user has the required number of row permission tags. If yes, proceed to S713; otherwise, end. S713. Determine if the number of accessible row permission tags is greater than 1. If not, execute S714; if yes, execute S715. S714. Rewrite the SQL statement by adding Where_security_label=? to get the rewritten SQL statement; S715. Rewrite the SQL statement by adding Where_security_label in (?,?) to get the rewritten SQL statement; S716. Verify the validity of the security_label in the rewritten SQL statement using Insert and Update methods. S717, Push down to execute the rewritten SQL statement for filtering, bringing the tag filtering conditions to the storage layer for execution.

[0124] Based on the same inventive concept, this disclosure also provides a distributed database data access device, as shown in the following embodiments. Since the principle by which this device solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

[0125] Figure 8 This diagram illustrates the structure of a distributed database data access device provided in an embodiment of this disclosure. Figure 8 As shown, the distributed database data access device of this disclosure embodiment is applied to a target node. The device includes a request acquisition module 810, a statement parsing module 820, a permission determination module 830, a permission verification module 840, and a statement execution module 850.

[0126] Among them, the request acquisition module 810 is used to acquire data access requests initiated by users. The data access requests are requests based on structured query statements (SQL statements). The statement parsing module 820 is used to parse SQL statements to obtain the data table to be accessed; The permission determination module 830 is used to determine the permission label of the data table to be accessed. The permission label includes at least one of the following: table permission label, column permission label, and row permission label. The permission verification module 840 is used to verify user permissions based on the permission tags of the data table to be accessed. The statement execution module 850 is used to execute SQL statements to query the distributed database if the permission verification is successful, obtain the data access results, and return the data access results to the user.

[0127] It should be noted that the request acquisition module 810, statement parsing module 820, permission determination module 830, permission verification module 840, and statement execution module 850 correspond to S102 to S110 in the method embodiment. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above method embodiment. It should also be noted that these modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

[0128] In one embodiment, the permission label includes a table permission label; the permission verification module 840 is used to query whether the user has access to the table permission label if the data table to be accessed has declared label-based permission control; if not, the permission verification is determined to have failed and the SQL statement is refused to be executed; if yes, the table access permission verification is determined to have passed.

[0129] In one embodiment, the permission label further includes a column permission label; the permission verification module 840 is used to traverse the columns in the data table to be accessed if the table access permission verification passes, and determine whether the column permission label of the current column and the user's user label meet the security policy; the statement execution module 850 is used to determine that the column access permission verification passes if the verification is satisfied, and allow the user to access the current column; if the verification is not satisfied, determine that the column access permission verification fails, and refuse the user to access the current column.

[0130] In one embodiment, the permission tag further includes a row permission tag; the permission verification module 840 is used to obtain the security policy of the data table to be accessed if the table access permission verification is passed, and query whether the user has the access permission of the security policy; if so, query the set of row permission tags less than or equal to the user's user tag to determine the number of row permission tags that the user can access; rewrite the SQL statement according to the number of row permission tags that the user can access to obtain the rewritten SQL statement; the statement execution module 850 is used to query the distributed database based on the rewritten SQL statement to obtain the data access result.

[0131] In one embodiment, the apparatus further includes a creation module (not shown in the figures) for creating a security tag component, a security policy, security tags, and a data table; and granting tag permissions to users based on the data table.

[0132] In one embodiment, the apparatus further includes a data storage module (not shown in the figures) for storing security tags to a distributed key-value storage system.

[0133] In one embodiment, different database cluster information corresponds to the first-level directory of the distributed key-value storage system, and user permission information under the same database cluster is divided into multiple nodes, with each node storing the corresponding metadata associated with the security label.

[0134] In one embodiment, the device further includes a data reading module (not shown in the figures), which is used to obtain user permission information from the distributed key-value storage system when the application starts; obtain the changed user permission information when a change in user permission information is detected in the distributed key-value storage system; and / or synchronize the changed user permission information to the remaining paths in the distributed key-value storage system when a change in user permission information along a path in the distributed key-value storage system is detected.

[0135] In this embodiment, a user-initiated data access request is obtained, which is a request based on an SQL statement. The SQL statement is parsed to obtain the data table to be accessed. The permission tags of the data table to be accessed are determined, and the permission tags include at least one of table permission tags, column permission tags, and row permission tags. The user's permissions are verified based on the permission tags of the data table to be accessed. If the permission verification passes, the SQL statement is executed to query the distributed database, obtain the data access result, and return the data access result to the user. This disclosure can provide a more efficient, reliable, and secure permission management method for distributed databases. By using tag-based access control, row-level permission control is achieved, refining the granularity of permission control. There is no need to configure permission policies separately for data tables, reducing the difficulty of operation and maintenance.

[0136] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0137] The following reference Figure 9 To describe an electronic device 900 according to this embodiment of the present invention. Figure 9 The electronic device 900 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0138] In one embodiment, the electronic device 900 includes a processor and a memory for storing executable instructions of the processor, the processor being configured to perform the distributed database data access method of the above embodiments by executing the executable instructions.

[0139] like Figure 9As shown, the electronic device 900 is manifested in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including storage unit 920 and processing unit 910).

[0140] The storage unit 920 stores program code, which can be executed by the processing unit 910 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 910 can perform actions such as... Figure 1 The process shown involves: obtaining a user-initiated data access request, which is a request based on a structured query statement (SQL); parsing the SQL statement to obtain the data table to be accessed; determining the permission tags of the data table to be accessed, which include at least one of table permission tags, column permission tags, and row permission tags; verifying the user's permissions based on the permission tags of the data table to be accessed; if the permission verification passes, executing the SQL statement to query the distributed database, obtaining the data access result, and returning the data access result to the user.

[0141] Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and / or cache memory 9202, and may further include read-only memory (ROM) 9203.

[0142] Storage unit 920 may also include a program / utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0143] Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0144] Electronic device 900 can also communicate with one or more external devices 940 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with the system, and / or with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 950. Furthermore, the system can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 910. Figure 9 As shown, network adapter 910 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although... Figure 9 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0145] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0146] The computer-readable storage medium of this disclosure embodiment stores a computer program thereon, which, when executed by a processor, implements the distributed database data access method of the above embodiment.

[0147] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. In some possible implementations, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, performs the steps described in the foregoing "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0148] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0149] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0150] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0151] In practice, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0152] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0153] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0154] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0155] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A distributed database data access method, characterized in that, include: Obtain data access requests initiated by users, wherein the data access requests are requests based on structured query statements (SQL statements); The SQL statement is parsed to obtain the data table to be accessed; Determine the permission label of the data table to be accessed, wherein the permission label includes at least one of table permission label, column permission label, and row permission label; The user's permissions are verified based on the permission tags of the data table to be accessed; If the permission verification passes, the SQL statement is executed to query the distributed database, obtain the data access result, and return the data access result to the user.

2. The method according to claim 1, characterized in that, The permission tags include table permission tags; The step of verifying the user's permissions based on the permission tags of the data table to be accessed includes: If the data table to be accessed has declared tag-based access control, then query whether the user has access rights to the table's permission tags; If not, the permission verification is deemed to have failed, and the execution of the SQL statement is refused. If so, the table access permission check is considered successful.

3. The method according to claim 2, characterized in that, The permission labels also include column permission labels; The method further includes: If the table access permission check passes, then iterate through the columns of the data table to be accessed; Determine whether the column permission label of the current column and the user label of the user satisfy the security policy; If the condition is met, the column access permission check is deemed to have passed, and the user is allowed to access the current column. If the condition is not met, the column access permission check is deemed to have failed, and the user is denied access to the current column.

4. The method according to claim 2 or 3, characterized in that, The permission labels also include row permission labels; The method further includes: If the access permission check of the judgment table passes, the security policy of the data table to be accessed is obtained, and the user is queried to see if he / she has the access permission of the security policy. If so, query the set of row permission tags that are less than or equal to the user's tags to determine the number of row permission tags that the user can access; Based on the number of row permission tags that the user can access, rewrite the SQL statement to obtain the rewritten SQL statement; The data access result is obtained by querying the distributed database based on the rewritten SQL statement.

5. The method according to claim 1, characterized in that, The method further includes: Create a security tag component, security policy, security tags, and data table, wherein the security tags include user tags and permission tags; Based on the data table, tag permissions are granted to users.

6. The method according to claim 5, characterized in that, The method further includes: The metadata associated with the security tag is stored in a distributed key-value store system.

7. The method according to claim 6, characterized in that, Different database cluster information corresponds to the first-level directory of the distributed key-value storage system. User permission information under the same database cluster is divided into multiple nodes, and each node stores the corresponding metadata associated with the security tag.

8. The method according to claim 7, characterized in that, The method further includes: When the application starts, it retrieves the user's permission information from the distributed key-value storage system; When a change in user permission information is detected in the distributed key-value storage system, the changed user permission information is obtained; and / or When a change in user permission information is detected along a path in the distributed key-value storage system, the changed user permission information is synchronized to the remaining paths in the distributed key-value storage system.

9. A distributed database data access device, characterized in that, include: The request acquisition module is used to acquire data access requests initiated by users, wherein the data access requests are requests based on structured query statements (SQL statements). The statement parsing module is used to parse the SQL statement to obtain the data table to be accessed; The permission determination module is used to determine the permission label of the data table to be accessed, wherein the permission label includes at least one of table permission label, column permission label, and row permission label; The permission verification module is used to verify the user's permissions based on the permission tags of the data table to be accessed; The statement execution module is used to execute the SQL statement to query the distributed database if the permission verification passes, obtain the data access result, and return the data access result to the user.

10. An electronic device, characterized in that, include: processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the distributed database data access method as described in any one of claims 1-8 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the distributed database data access method as described in any one of claims 1-8.

12. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which are loaded and executed by a processor to enable the computer to implement the distributed database data access method as described in any one of claims 1-8.

Images