Data management and access method, device, electronic device and readable storage medium

Abstract

The disclosed embodiments disclose a data management and access method, apparatus, electronic device, and readable storage medium. The data management method includes establishing tags corresponding to preset objects in data, authorizing users permitted to use the tags, and, upon receiving a data access request using the tags from an authorized user, providing the authorized user with the content of the preset objects corresponding to the tags. This technical solution enables establishing tags corresponding to preset objects and authorizing users based on the tags, refining the granularity of data management and improving the security and flexibility of data management.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data management and access method, device, electronic device, and readable storage medium. Background Art

[0002] In today's big data environment, data volumes are rapidly increasing, and users' demand for data access is also increasing. On the one hand, data sharing helps improve data utilization and avoid duplication of effort. For example, data sharing among researchers promotes disciplinary development, data sharing between enterprises promotes industry advancement, and data sharing between interdisciplinary fields promotes breakthroughs in various fields. On the other hand, data is often closely related to personal privacy, industry secrets, and even national security. The leakage of this data often has a serious impact on social stability, posing a significant challenge to data management and use. Summary of the Invention

[0003] In order to solve the problems in the related art, the embodiments of the present disclosure provide a data management and access method, device, electronic device and readable storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a data management method.

[0005] Specifically, the data management method includes:

[0006] Establish labels corresponding to preset objects in the data;

[0007] Authorizing users who are allowed to use the tags;

[0008] When a data access request using the tag is received from an authorized user, the content of the preset object corresponding to the tag is provided to the authorized user.

[0009] In combination with the first aspect, in a first implementation of the first aspect of the present disclosure, the establishing of a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or

[0010] The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data; and / or

[0011] The data management method further includes: receiving an application from a user to use the tag; or receiving an application from a user in another user set to use the tag.

[0012] In combination with the first implementation of the first aspect, in a second implementation of the first aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generated the data, and the data management method further includes:

[0013] converting the private tag into a public tag, wherein the public tag is visible to the set of other users; or

[0014] The private tag is converted into a public tag, and the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, the selected subordinate user sets of the user set that generated the data, and the sibling user sets that belong to the same upper level as the user set that generated the data.

[0015] In combination with the first aspect, in a third implementation of the first aspect of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources;

[0016] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0017] The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

[0018] In combination with the first aspect, in a fourth implementation of the first aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0019] determining the records to which the authorized user is permitted to access;

[0020] The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

[0021] In combination with the first aspect, in a fifth implementation of the first aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0022] If the label is a sensitive label, determine a corresponding desensitization rule;

[0023] Processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data;

[0024] Provide the first desensitized data to the authorized user.

[0025] In combination with the first aspect, in a sixth implementation of the first aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0026] determining the records to which the authorized user is permitted to access;

[0027] If the label is a sensitive label, determine a corresponding desensitization rule;

[0028] Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data;

[0029] Provide the second desensitized data to the authorized user.

[0030] In combination with the fourth implementation manner or the sixth implementation manner of the first aspect, in a seventh implementation manner of the first aspect of the present disclosure, determining the records that the authorized user is allowed to access includes:

[0031] Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

[0032] The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

[0033] In combination with the fifth implementation manner or the sixth implementation manner of the first aspect, in an eighth implementation manner of the first aspect of the present disclosure, determining the corresponding desensitization rule includes:

[0034] Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or

[0035] In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

[0036] In combination with the first aspect, in a ninth implementation of the first aspect of the present disclosure, the data includes a physical table; and / or

[0037] The content of the preset object is a proper subset of the content of the physical table; and / or

[0038] The preset object is a field. In a second aspect, an embodiment of the present disclosure provides a data access method.

[0039] Specifically, the data access method includes:

[0040] Display labels corresponding to pre-set objects in the data;

[0041] After the user obtains authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

[0042] Receive the content of the preset object corresponding to the tag.

[0043] In combination with the second aspect, in a first implementation manner of the second aspect of the present disclosure, the user does not belong to the set of users that generate the data.

[0044] In conjunction with the second aspect, in a second implementation of the second aspect of the present disclosure, the tag corresponds to a plurality of fields, and the plurality of fields have the same attribute and belong to different data resources;

[0045] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0046] The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

[0047] In combination with the second aspect, in a third implementation of the second aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0048] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0049] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0050] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0051] In combination with the third implementation manner of the second aspect, in a fourth implementation manner of the second aspect of the present disclosure, the records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user;

[0052] The desensitization rule is determined according to the level of the tag and / or the attribute value of the authorized user.

[0053] In combination with the second aspect, in a fifth implementation of the second aspect of the present disclosure, the data includes a physical table; and / or

[0054] The content of the preset object is a proper subset of the content of the physical table; and / or

[0055] The preset object is a field.

[0056] In combination with the second aspect, in a sixth implementation of the second aspect of the present disclosure, the data access method further includes:

[0057] Send the user's application to use the tag.

[0058] In a third aspect, an embodiment of the present disclosure provides a data management device.

[0059] Specifically, the data management device includes:

[0060] An establishing module, configured to establish a label corresponding to a preset object in the data;

[0061] an authorization module, configured to authorize a user who is allowed to use the tag;

[0062] The providing module is configured to provide the content of the preset object corresponding to the tag to the authorized user when receiving a data access request using the tag from the authorized user.

[0063] In conjunction with the third aspect, in a first implementation of the third aspect of the present disclosure, the establishing of a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or

[0064] The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data; and / or

[0065] The data management device further includes: an application receiving module configured to receive an application from a user to use the tag; or receive an application from a user in another user set to use the tag.

[0066] In combination with the first implementation of the third aspect, in a second implementation of the third aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generated the data, and the apparatus further includes a conversion module configured to:

[0067] converting the private tag into a public tag, wherein the public tag is visible to the set of other users; or

[0068] The private tag is converted into a public tag, and the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, the selected subordinate user sets of the user set that generated the data, and the sibling user sets that belong to the same upper level as the user set that generated the data.

[0069] In conjunction with the third aspect, in a third implementation of the third aspect of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources;

[0070] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0071] The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

[0072] In combination with the third aspect, in a fourth implementation of the third aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0073] determining the records to which the authorized user is permitted to access;

[0074] The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

[0075] In conjunction with the third aspect, in a fifth implementation of the third aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0076] If the label is a sensitive label, determine a corresponding desensitization rule;

[0077] Processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data;

[0078] Provide the first desensitized data to the authorized user.

[0079] In combination with the third aspect, in a sixth implementation of the third aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0080] determining the records to which the authorized user is permitted to access;

[0081] If the label is a sensitive label, determine a corresponding desensitization rule;

[0082] Processing, according to the desensitization rule, the content of the field corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data;

[0083] Provide the second desensitized data to the authorized user.

[0084] In combination with the fourth implementation manner or the sixth implementation manner of the third aspect, in a seventh implementation manner of the third aspect of the present disclosure, determining the records that the authorized user is allowed to access includes:

[0085] Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

[0086] The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

[0087] In combination with the fifth implementation or the sixth implementation of the third aspect, in an eighth implementation of the third aspect of the present disclosure, determining the corresponding desensitization rule includes:

[0088] Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or

[0089] In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

[0090] In combination with the third aspect, in a ninth implementation of the third aspect of the present disclosure, the data includes a physical table; and / or

[0091] The content of the preset object is a proper subset of the content of the physical table; and / or

[0092] The preset object is a field.

[0093] In a fourth aspect, an embodiment of the present disclosure provides a data access device.

[0094] Specifically, the data access device includes:

[0095] A display module, configured to display labels corresponding to preset objects in the data;

[0096] A first sending module is configured to send a data access request for the authorized user to use the tag after the user obtains authorization to use the tag and becomes an authorized user;

[0097] The receiving module is configured to receive the content of the preset object corresponding to the tag.

[0098] In combination with the fourth aspect, in a first implementation manner of the fourth aspect of the present disclosure, the user does not belong to the set of users that generate the data.

[0099] In conjunction with the fourth aspect, in a second implementation of the fourth aspect of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources;

[0100] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0101] The receiving the content of the preset object corresponding to the tag includes receiving the content of a field corresponding to the tag in the specific data resource.

[0102] In conjunction with the fourth aspect, in a third implementation of the fourth aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0103] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0104] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0105] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0106] In combination with the third implementation manner of the fourth aspect, in a fourth implementation manner of the fourth aspect of the present disclosure, the records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user;

[0107] The desensitization rule for the authorized user is determined according to the level of the tag and / or the attribute value of the authorized user.

[0108] In combination with the fourth aspect, in a fifth implementation of the fourth aspect of the present disclosure, the data includes a physical table; and / or

[0109] The content of the preset object is a proper subset of the content of the physical table; and / or

[0110] The preset object is a field.

[0111] In combination with the fourth aspect, in a sixth implementation of the fourth aspect of the present disclosure, the data access device further includes:

[0112] The second sending module is configured to send the user's application for using the tag.

[0113] In a fifth aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the following method steps:

[0114] Establish labels corresponding to preset objects in the data;

[0115] Authorizing users who are allowed to use the tags;

[0116] When a data access request using the tag is received from an authorized user, the content of the preset object corresponding to the tag is provided to the authorized user.

[0117] In conjunction with the fifth aspect, in a first implementation of the fifth aspect of the present disclosure, the establishing of a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or

[0118] The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data; and / or

[0119] The one or more computer instructions are further executed by the processor to implement the following method steps: receiving a user's application for using the tag; or receiving an application for using the tag from a user in another user set.

[0120] In conjunction with the first implementation of the fifth aspect, in a second implementation of the fifth aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generated the data, and the one or more computer instructions are executed by the processor to implement the following method steps:

[0121] converting the private tag into a public tag, wherein the public tag is visible to the set of other users; or

[0122] The private tag is converted into a public tag, and the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, the selected subordinate user sets of the user set that generated the data, and the sibling user sets that belong to the same upper level as the user set that generated the data.

[0123] In conjunction with the fifth aspect, in a third implementation of the fifth aspect of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources;

[0124] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0125] The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

[0126] In conjunction with the fifth aspect, in a fourth implementation of the fifth aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0127] determining the records to which the authorized user is permitted to access;

[0128] The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

[0129] In conjunction with the fifth aspect, in a fifth implementation of the fifth aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0130] If the label is a sensitive label, determining a corresponding desensitization rule, and processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data;

[0131] Provide the first desensitized data to the authorized user.

[0132] In conjunction with the fifth aspect, in a sixth implementation of the fifth aspect of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0133] determining the records to which the authorized user is permitted to access;

[0134] If the label is a sensitive label, determine a corresponding desensitization rule;

[0135] Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data;

[0136] Provide the second desensitized data to the authorized user.

[0137] In combination with the fourth implementation manner or the sixth implementation manner of the fifth aspect, in a seventh implementation manner of the fifth aspect of the present disclosure, determining the records that the authorized user is allowed to access includes:

[0138] Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

[0139] The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

[0140] In combination with the fifth implementation or the sixth implementation of the fifth aspect, in an eighth implementation of the fifth aspect of the present disclosure, determining the corresponding desensitization rule includes:

[0141] Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or

[0142] In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

[0143] In combination with the fifth aspect, in a ninth implementation of the fifth aspect of the present disclosure, the data includes a physical table; and / or

[0144] The content of the preset object is a proper subset of the content of the physical table; and / or

[0145] The preset object is a field.

[0146] In a sixth aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the following method steps:

[0147] Display labels corresponding to pre-set objects in the data;

[0148] After the user obtains authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

[0149] Receive the content of the preset object corresponding to the tag.

[0150] In combination with the sixth aspect, in a first implementation manner of the sixth aspect of the present disclosure, the user does not belong to the set of users that generate the data.

[0151] In conjunction with the sixth aspect, in a second implementation of the sixth aspect of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources;

[0152] The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource;

[0153] The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

[0154] In conjunction with the sixth aspect, in a third implementation of the sixth aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0155] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0156] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0157] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0158] In combination with the third implementation manner of the sixth aspect, in a fourth implementation manner of the sixth aspect of the present disclosure, the records that the authorized user is allowed to access are determined based on an attribute value of the authorized user, or based on a category of the tag and an attribute value of the authorized user;

[0159] The desensitization rule is determined according to the level of the tag and / or the attribute value of the authorized user.

[0160] In combination with the sixth aspect, in a fifth implementation of the sixth aspect of the present disclosure, the data includes a physical table; and / or

[0161] The content of the preset object is a proper subset of the content of the physical table; and / or

[0162] The preset object is a field.

[0163] In conjunction with the sixth aspect, in a sixth implementation of the sixth aspect of the present disclosure, the one or more computer instructions are further executed by the processor to implement the following method steps:

[0164] Sending the user's application to use the tag.

[0165] In the seventh aspect, an embodiment of the present disclosure provides a readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method as described in any one of the first aspect and the first to ninth implementations of the first aspect is implemented.

[0166] In an eighth aspect, an embodiment of the present disclosure provides a readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method described in any one of the second aspect and the first to fifth implementations of the second aspect is implemented.

[0167] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0168] According to the technical solution provided by the embodiments of the present disclosure, it is possible to establish tags corresponding to preset objects and authorize users based on the tags, so that users can obtain authorization at the granularity level of preset objects, thereby improving the security and flexibility of data management by refining the granularity level of data management.

[0169] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0170] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the drawings:

[0171] Figure 1A A flowchart showing a data management method according to an embodiment of the present disclosure is shown;

[0172] Figure 1B shows an example of data according to an embodiment of the present disclosure;

[0173] Figure 2A The process of establishing, publishing and revoking a tag according to an embodiment of the present disclosure is shown;

[0174] Figure 2B A flowchart showing application and use of tags according to an embodiment of the present disclosure is shown;

[0175] Figure 2C A schematic diagram showing sharing of preset objects between two user sets G1 and G2 through tags according to an embodiment of the present disclosure is shown;

[0176] Figure 3 A schematic diagram of a user interface for applying for use of tags across data resources according to an embodiment of the present disclosure is shown;

[0177] Figure 4A A flowchart illustrating providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown;

[0178] Figure 4B A schematic diagram illustrating further controlling records that users are allowed to access based on implementing preset object access control through tags according to an embodiment of the present disclosure;

[0179] Figure 5A A flowchart illustrating providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown;

[0180] Figures 5B-5D A schematic diagram showing desensitization of the content of a preset object using pseudonymization, masking, and hashing respectively;

[0181] Figure 6 A schematic diagram showing a process of setting desensitization rules according to an embodiment of the present disclosure is shown;

[0182] Figure 7 A flowchart illustrating providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown;

[0183] Figure 8 A flow chart showing a data access method according to an embodiment of the present disclosure;

[0184] Figure 9 A structural block diagram of a data management device according to an embodiment of the present disclosure is shown;

[0185] Figure 10 A structural block diagram of a data access device according to an embodiment of the present disclosure is shown;

[0186] Figure 11 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0187] Figure 12 A schematic structural diagram of a computer system suitable for implementing the data management method and / or data access method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0188] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0189] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, actions, components, parts, or combinations thereof exist or are added.

[0190] It should also be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0191] An embodiment of the present disclosure provides a data management method, which includes establishing a tag corresponding to a preset object in the data, authorizing users who are allowed to use the tag, and when receiving a data access request using the tag from an authorized user, providing the authorized user with the content of the preset object corresponding to the tag.

[0192] The embodiments of the present disclosure can authorize users based on tags corresponding to preset objects, realize data management at the granularity of preset objects, facilitate users to access the preset objects they need, and prohibit users from accessing preset objects for which they are not authorized, thereby improving the security and flexibility of data management.

[0193] Figure 1A A flow chart of a data management method according to an embodiment of the present disclosure is shown.

[0194] like Figure 1A As shown, the data management method includes the following steps S101-S103.

[0195] In step S101 , a tag corresponding to a preset object in the data is created.

[0196] In step S102, the user who is allowed to use the tag is authorized.

[0197] In step S103, when a data access request using the tag is received from an authorized user, the content of the preset object corresponding to the tag is provided to the authorized user.

[0198] According to an embodiment of the present disclosure, the data includes a physical table. According to an embodiment of the present disclosure, the content of the preset object is a proper subset of the content of the physical table.

[0199] According to embodiments of the present disclosure, the content of the preset object being a proper subset of the content of the physical table means that the content of the physical table includes the entire content of the preset object, but the content of the preset object is not equal to the content of the physical table. For example, assuming that the physical table includes M rows and N columns of content, where M and N are both positive integers, the content of the preset object can be the content of m rows and n columns in the physical table, where m is any positive integer not greater than M and n is any integer not greater than N. However, the content of the preset object cannot be the entire content of the physical table, that is, m = M and n = N cannot both hold.

[0200] According to the embodiment of the present disclosure, the preset object is a field, wherein the field is column data. Next, the present disclosure will be further explained and illustrated by taking the preset object as a field as an example.

[0201] Figure 1BAn example of data according to an embodiment of the present disclosure is shown.

[0202] Those skilled in the art will appreciate that although Figure 1B The data is described by taking a physical table with three rows and four columns as an example, but the embodiments of the present disclosure are not limited thereto and can also be applied to physical tables with other numbers of rows and columns, or with other data including preset objects.

[0203] like Figure 1B As shown, the data (e.g., physical table Data_s1) includes records R1-R3 and fields C1-C4. According to an embodiment of the present disclosure, four tags c1, c2, c3, and c4 corresponding to fields C1-C4 can be established, where tag c1 corresponds to field C1, tag c2 corresponds to field C2, tag c3 corresponds to field C3, and tag c4 corresponds to field C4. According to an embodiment of the present disclosure, corresponding tags can also be established for only some of the fields instead of all four fields.

[0204] The user who is allowed to use any one or more of the tags c1-c4 can be authorized. For example, the user who is allowed to use tag c1 can be authorized to become the authorized user of tag c1. After obtaining the authorization to use tag c1 and becoming the authorized user, the authorized user can use tag c1 to access the content of field C1 of the data, such as Figure 1B As shown in the shaded portion in the middle. For example, information related to the tag c1 may be included in the data access request, and the field corresponding to the tag c1 may be accessed based on the information. According to an embodiment of the present disclosure, the information related to the tag c1 is, for example, a combination of any one or more of the following: a data resource name or storage location, a field name or storage location, a link to a data resource and / or field, etc., and the present disclosure does not specifically limit this. According to an embodiment of the present disclosure, the establishment of a tag corresponding to the preset object includes generating a corresponding tag for the preset object based on an instruction of a user of the user set that generates the data.

[0205] According to an embodiment of the present disclosure, the physical table Data_s1 can be generated by the user set G1. Accordingly, the user set G1 has management authority over the physical table Data_s1. Users in the user set G1 can respectively generate one or more labels corresponding to any one or more fields C1-C4 in the physical table Data_s1.

[0206] According to an embodiment of the present disclosure, the establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data.

[0207] According to embodiments of the present disclosure, a label can be newly generated for a preset object or an existing label, and a correspondence can be established between the preset object and the label. For example, after generating the physical table Data_s1, user set G1 can generate a new label c1 for field C1, or establish a correspondence between an existing label c1 and field C1 so that label c1 corresponds to field C1.

[0208] According to an embodiment of the present disclosure, the data management method further includes: receiving an application from a user to use the tag, or receiving an application from a user in another user set to use the tag.

[0209] According to an embodiment of the present disclosure, a user may apply to use any one or more of the tags c1 - c4 , for example, apply to use the tag c1 . Figure 2A The process of creating, publishing, and revoking a tag according to an embodiment of the present disclosure is shown.

[0210] According to an embodiment of the present disclosure, the label is initially a private label that is visible only to the user set that generated the data, and the data management method further includes converting the private label into a public label, and the public label is visible to the other user sets. For example, user U1 in the user set G1 establishes a label for a preset object in the data. The label is initially a private label that is visible only to the user set G1 that generated the data. User U1 applies to the administrator of the user set G1 to disclose the private label. After the disclosure application is approved by the administrator, the private label is converted into a public label, and is thus visible to other user sets. Alternatively, according to an embodiment of the present disclosure, the disclosure scope of the public label may not be visible to all other user sets, but may be set to any one or more of the following: all subordinate user sets of the user set that generated the data, selected subordinate user sets of the user set that generated the data, and sibling user sets that belong to the same superior as the user set that generated the data.

[0211] According to an embodiment of the present disclosure, when user U1 no longer wishes to make a public tag public, user U1 can request to the administrator of user set G1 to withdraw the public tag. Once the withdrawal request is approved by the administrator, the public tag is converted to a private tag, making it invisible to other user sets and preventing other user sets from using the tag to access the corresponding preset object.

[0212] According to an embodiment of the present disclosure, if a tag is created by an administrator of the user set G1, the administrator can decide whether to disclose the tag, and omit the above-mentioned process of applying for disclosure, approving disclosure, applying for withdrawal, and approving withdrawal.

[0213] According to an embodiment of the present disclosure, receiving a user's application to use the tag includes receiving an application to use the tag from a user in another user set different from the user set G1. For example, receiving an application to use the tag from a user in another user set that can see the tag, while users in a user set that cannot see the tag cannot apply to use the tag. For example, a user in another user set G2 different from the user set G1 can apply to use the tag established by the user set G1.

[0214] Figure 2B A flowchart of applying for and using tags according to an embodiment of the present disclosure is shown.

[0215] like Figure 2B As shown, user U2 in user set G2 selects a tag in the public tag library, and then submits an application for use of the selected tag, generates an application form / approval form and records it in the personal center of user U2. If the application for use is approved, user U2 obtains authorization to use the tag, and can then use the tag to access the content of the corresponding preset object. If the application for use is not approved, "application failed" is recorded in the personal center, and user U2 cannot use the tag to access the content of the corresponding preset object. According to an embodiment of the present disclosure, after user U2 obtains authorization to use the tag, other members of user set G2 also obtain authorization to use the tag and receive a tag authorization notification, realizing one person's application and authorization for the entire group, which simplifies user operations.

[0216] Figure 2C A schematic diagram is shown of sharing preset objects between two user sets G1 and G2 through tags according to an embodiment of the present disclosure.

[0217] like Figure 2C As shown, user set G1 creates tags for preset objects corresponding to the data it generates. These tags are initially private tags visible only to users in user set G1. After approval by the administrator of user set G1, the private tags become public tags and are visible to other user sets. Users in user set G2 can apply to use the public tags. Once authorized, the tags are added to the authorized tag library of user set G2, and user set G2 can use the tags to access the corresponding preset objects.

[0218] On the other hand, user set G2 creates tags for predefined objects corresponding to the data it generates. These tags are initially private tags, visible only to users in user set G2. After approval by the administrator of user set G2, private tags become public tags and are visible to other user sets. Users in user set G1 can apply to use public tags. Once authorized, the tags are added to user set G1's authorized tag library, allowing user set G1 to use these tags to access the corresponding predefined objects.

[0219] According to an embodiment of the present disclosure, one of the labels may correspond to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources, such as belonging to different physical tables, and the physical tables may be different physical tables of the same data resource type, or different physical tables of different data resource types. According to an embodiment of the present disclosure, the data resource may be any resource type, such as a big data computing service (MaxCompute), a relational database service (RDS), an analytical database service (ADS), etc., and the present disclosure does not make specific limitations on this. For example, the label c1 may correspond to the field C1 in the physical table Data_s1, the field C1' in the physical table Data_s2, and the field C1" in the physical table Data_s3. Field C1, field C1', and field C1" have the same attributes, such as the same physical or logical meaning. For example, field C1, field C1', and field C1" are all "height" or "affiliated community".

[0220] According to an embodiment of the present disclosure, the application for use of the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource. Providing the content of the preset object corresponding to the tag to the authorized user includes providing the content of the preset object corresponding to the tag in the specific data resource to the authorized user. For example, user U2 in user set G2 can specify any one or more data resources when applying to use the tag, or apply for authorization for all data resources for the tag, thereby implementing tag usage authorization across data resources. This eliminates the need for users to repeatedly apply for authorization for data with the same attributes but stored in different data resources, simplifying user operations and improving the flexibility and convenience of data management and access. Accordingly, user U2 can indicate the data resource they wish to access when using the tag to access the content of the preset object. If user U2 has only applied for tag usage authorization for one data resource, they do not need to indicate the data resource they wish to access when using the tag to access the content of the preset object. In this case, user U2 is assumed to access the data resource for which they have been authorized.

[0221] Figure 3 A schematic diagram of a user interface for applying for use of tags across data resources according to an embodiment of the present disclosure is shown.

[0222] like Figure 3 As shown, label c1 can correspond to field C1 in physical table Data_s1, field C1' in physical table Data_s2, and field C1'' in physical table Data_s3. When user U2 applies for use of label c1, he can select the data resource to be used. Figure 3 In the example, user U2 selects data resources Data_s1 and Data_s2. Thus, after obtaining authorization, user U2 can use tag c1 to access the corresponding fields C1 and C1' in the digital resources Data_s1 and Data_s2, but cannot use tag c1 to access the corresponding field C1" in the digital resource Data_s3.

[0223] After user U2 obtains authorization to use tag c1 to access digital resources Data_s1 and Data_s2, the user may include an indication of the data resource to be accessed in the data access request, for example, indicating access to the corresponding field of tag c1 in the data resource Data_s1 in the data access request.

[0224] Or, if user U2 is Figure 3 In the interface shown, only the application for using the data resource Data_s1 is made. Therefore, it is not necessary to indicate accessing the data resource Data_s1 in the data access request. In this case, it is assumed that the user U2 wants to access the data resource Data_s1.

[0225] According to an embodiment of the present disclosure, data (e.g., a physical table) includes at least one record, and the record includes at least one preset object (e.g., a field), wherein the record is row data. Figure 1B The physical table Data_s1 includes records R1-R3, and each record includes fields C1-C4.

[0226] Figure 4A A flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown.

[0227] like Figure 4A As shown, according to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes steps S201 and S202.

[0228] In step S201, the records that the authorized user is allowed to access are determined.

[0229] In step S202, the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access is provided to the authorized user.

[0230] According to the embodiments of the present disclosure, based on the implementation of preset object access control through tags, control over records that users are allowed to access is further implemented.

[0231] Figure 4B A schematic diagram is shown of further controlling records that users are allowed to access based on implementing preset object access control through tags according to an embodiment of the present disclosure.

[0232] For example, for Figure 1B In the physical table Data_s1 shown in the figure, user U2 is authorized to access the data in field C1 by using tag c1. However, user U2's permission only allows access to records R1 and R2, but not to record R3. Therefore, when receiving a data access request from user U2 using tag c1, the content of field C1 corresponding to tag c1 in records R1 and R2 is provided to user U2, as shown in the following example: Figure 4B Shown in the shaded area.

[0233] On the basis of implementing preset object access control through tags, the records that users are allowed to access are controlled. The embodiment of the present disclosure further refines data management and realizes more flexible and targeted data management.

[0234] According to an embodiment of the present disclosure, determining the records that the authorized user is allowed to access includes determining the records that the authorized user is allowed to access based on attribute values of the authorized user.

[0235] According to an embodiment of the present disclosure, the attribute value of the authorized user may include any one or more of the following: user set, administrative division, data source mark, tax authority code, work number, department code, etc., and the present disclosure does not make specific limitations on this.

[0236] According to an embodiment of the present disclosure, the records that the authorized user is allowed to access can be determined based on the attribute value of the authorized user. For example, if the attribute value of the authorized user determines that it is a user of Province A, the authorized user can view the records of Province A, but cannot view the records of other provinces.

[0237] According to an embodiment of the present disclosure, determining the records that the authorized user is allowed to access includes determining the records that the authorized user is allowed to access based on the category of the tag and the attribute value of the authorized user.

[0238] According to an embodiment of the present disclosure, tags can be divided into multiple categories, and for the same authorized user, the access rights of different categories can be different. For example, tags can be divided into "unrestricted tags", "Class I restricted tags", and "Class II restricted tags" with increasing degrees of record access restriction. If the tag is an unrestricted tag, the authorized user is allowed to view all records of the preset object corresponding to the tag. If the tag is a Class I restricted tag, users in City A, Province A can view all records of Province A, but cannot view records of other provinces. If the tag is a Class II restricted tag, users in City A, Province A can only view records of City A, Province A, but cannot view records of other cities in Province A, nor can they view records of other provinces.

[0239] According to an embodiment of the present disclosure, for a restricted tag, its record access rights can be defined first, such as "Allow users in this province and city to view", "Allow users in this province to view", "Allow users of tax authorities in this province to view", and so on. Then, for the record access rights of the tag, the user attribute value used to determine the authority is determined. For example, for the access right of "Allow users in this province and city to view", the user attribute value used to determine the authority is the province and city to which it belongs. For the access right of "Allow users in this province to view", the user attribute value used to determine the authority is the province to which it belongs. For the access right of "Allow users of tax authorities in this province to view", the user attribute value used to determine the authority is the province to which it belongs and the unit to which it belongs.

[0240] According to an embodiment of the present disclosure, the user attribute value used to determine permissions may have a corresponding preset object in the data resource (e.g., a physical table) where the label corresponds to the preset object, or may not have a corresponding preset object in the data resource where the label corresponds to the preset object. When the user attribute value used to determine permissions does not have a corresponding preset object in the data resource where the label corresponds to the preset object, it is necessary to associate the data resource where the label corresponds to the preset object with another data resource, wherein the user attribute value used to determine permissions has a corresponding preset object in the other data resource. Then, the associated data resource can be used to determine the records that the user is allowed to access. For example, Table 1 contains the preset objects "Company Name", "Tax Information", and "Company Number", and Table 2 contains the preset objects "Company Number" and "Province". If the preset object to be accessed is "Tax Information" and the user attribute value used to determine permissions is its province, then Table 1 and Table 2 need to be associated through "Company Number", and the preset object "Province" in Table 2 is used to determine the company number that the user is allowed to access, and then the company number is used to determine the records in Table 1 that are allowed to be accessed.

[0241] When setting record access permissions, you can generate filter conditions by selecting tags in the data resource or manually adding them. Filter conditions can include one or more conditions. Using user attribute values and filter conditions, you can determine which records a user is allowed to access. For example, for the access permission "Allow users in this province and city to view," the filter condition includes the province and city to which the record belongs. This filter condition can be generated by selecting the tags "Province" and "City." When a user in Province A, City A, accesses data using this filter condition, the records that the user is allowed to access are those in Province A, City A. Alternatively, for the access permission "Allow users in this province's tax authorities to view," you can manually add the filter conditions "Province" (this condition can also be added by selecting tags) and "Unit." When a user in Province A's tax authorities accesses data using this filter condition, the records that the user is allowed to access are those in Province A.

[0242] Figure 5A A flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown.

[0243] like Figure 5A As shown, according to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes steps S301 to S303.

[0244] In step S301, if the label is a sensitive label, a corresponding desensitization rule is determined.

[0245] In step S302, the content of the preset object corresponding to the tag is processed according to the desensitization rule to obtain first desensitized data.

[0246] In step S303, the first desensitized data is provided to the authorized user.

[0247] According to an embodiment of the present disclosure, if the label is a non-sensitive label, the content of the preset object corresponding to the label will not be desensitized; if the label is a sensitive label, the content of the preset object corresponding to the label will be desensitized according to the desensitization rules and then provided to the user.

[0248] According to the embodiments of the present disclosure, the desensitization rules can be set according to actual needs, such as including pseudonyms, masking, hashing, custom rules, etc., and the present disclosure does not make specific limitations on this.

[0249] Figures 5B-5D A schematic diagram is shown of desensitizing the content of a preset object using pseudonymization, masking, and hashing respectively.

[0250] Assume that the original data of field C1 of records R1-R3 are the company names "Cat Food Company", "Dog Clothing Company", and "Rabbit Toy Company". Figure 5B As shown in the figure, the contents of the field C1 after pseudonym masking can be "Company A", "Company B" and "Company C" respectively. Figure 5C As shown, the contents of the masked and desensitized field C1 can be "** Food Company", "** Clothing Company", and "** Stationery Company" respectively.

[0251] According to an embodiment of the present disclosure, hashing includes processing the content of a preset object corresponding to the tag according to a hash function. The hash function can map the content of the preset object of any length into a shorter and fixed value (hash value). Since the hash function is a one-way cryptographic system, that is, an irreversible mapping from plaintext to ciphertext, there is only an encryption process but no decryption process, so the content of the preset object can be effectively desensitized. Figure 5C As shown, the content of the hashed field C1 is three hash values, and the hash values are provided to the user instead of the original data of the field.

[0252] According to the embodiments of the present disclosure, by desensitizing sensitive data, it is possible to achieve "available but invisible" of sensitive data, so that sensitive preset objects can be used by more users, applications and scenarios. While ensuring the security of sensitive data, the amount of data available to users is significantly increased, thereby improving data utilization efficiency.

[0253] According to an embodiment of the present disclosure, determining the corresponding desensitization rule includes determining the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user.

[0254] According to an embodiment of the present disclosure, the desensitization rules for authorized users can be determined based on the level of the label. For example, labels can be divided into multiple levels with different sensitivity, and the desensitization rules for different levels can be different. For example, if the label is a level 1 label, masking desensitization processing is performed, if the label is a level 2 label, pseudonym desensitization is performed, and if the label is a level 3 label, hashing desensitization processing is performed.

[0255] According to an embodiment of the present disclosure, the desensitization rules for authorized users can be determined based on the attribute values of the authorized users. For example, desensitization may not be performed on users belonging to the whitelist user set, while desensitization may be performed on other users.

[0256] According to embodiments of the present disclosure, desensitization rules for authorized users can be determined based on the tag level and the attribute value of the authorized user. For example, if the tag is a first-level tag, no desensitization is performed on high-level users, while ordinary users are masked and desensitized. If the tag is a second-level tag, masked and desensitized are performed on high-level users, while ordinary users are hashed and desensitized, and so on.

[0257] Figure 6 A schematic diagram of a process for setting desensitization rules according to an embodiment of the present disclosure is shown.

[0258] like Figure 6 It is shown that according to an embodiment of the present disclosure, when setting desensitization rules, multiple sensitivity levels can be defined, such as level 1, level 2, level 3, and so on. Multiple desensitization rules can also be defined, such as pseudonym desensitization, masked desensitization, hashed desensitization, and so on. For a sensitive label, it can be first defined as a level 1, level 2, or level 3 sensitive label, and then the desensitization rule corresponding to the label can be selected, such as pseudonym desensitization for level 1 labels, masked desensitization for level 2 labels, hashed desensitization for level 3 labels, and so on. A whitelist user set can also be set for the sensitive label, and desensitization processing will not be performed on users in the whitelist user set.

[0259] According to the embodiments of the present disclosure, a preset desensitization template can be applied to tags. For example, if a masking template is applied to the tag "name," the preset object content "Maomao Clothing Company" can be desensitized to "** Clothing Company." The desensitization rules and methods of the desensitization template are pre-set and can be used directly, eliminating the need to re-set desensitization rules and write desensitization methods.

[0260] According to the embodiments of the present disclosure, by adopting corresponding desensitization rules for labels of different levels, differentiated data encryption for different user sets or users can be achieved at the preset object granularity level, thereby improving the flexibility and security of data management.

[0261] Figure 7 A flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure is shown.

[0262] like Figure 7 As shown, according to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes steps S401 to S404.

[0263] In step S401, the records that the authorized user is allowed to access are determined;

[0264] In step S402, if the label is a sensitive label, a corresponding desensitization rule is determined;

[0265] In step S403, the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access is processed according to the desensitization rule to obtain second desensitized data;

[0266] In step S404, the second desensitized data is provided to the authorized user.

[0267] refer to Figure 4B , assuming that user U2 uses label c1 to access field C1, user U2's permission is to allow access to record R1 and record R2, and user U2's desensitization rule is pseudonym desensitization, then user U2 is provided with the pseudonym-desensitized content of field C1 of records R1 and R2, for example Figure 5B "Company A" and "Company B" are shown.

[0268] According to the embodiments of the present disclosure, on the basis of realizing data access control at a preset object granularity through tags, further record access rights and desensitization control are performed, and the combination of control means is more diversified and flexible, adapting to the needs of more applications and scenarios.

[0269] Figure 8 A flow chart of a data access method according to an embodiment of the present disclosure is shown.

[0270] like Figure 8 As shown, the data access method includes steps S501-S503.

[0271] In step S501, labels corresponding to preset objects in the data are displayed;

[0272] In step S502, after the user obtains authorization to use the tag and becomes an authorized user, the authorized user sends a data access request using the tag;

[0273] In step S503, the content of the preset object corresponding to the tag is received.

[0274] According to an embodiment of the present disclosure, the data includes a physical table.

[0275] According to an embodiment of the present disclosure, the content of the preset object is a proper subset of the content of the physical table.

[0276] According to an embodiment of the present disclosure, the preset object is a field.

[0277] According to an embodiment of the present disclosure, the data access method further includes sending a user's application for using the tag.

[0278] According to an embodiment of the present disclosure, the user does not belong to the set of users that generate the data.

[0279] Refer to the above Figure 2C As described above, the public tags of user set G1 are visible to user U2 of user set G2. User U2 can submit an application to use a public tag (for example, tag c1). After obtaining authorization, user U2 can send a data access request using tag c1 and receive the content of the field corresponding to tag c1.

[0280] According to an embodiment of the present disclosure, the tag corresponds to a plurality of preset objects, and the plurality of preset objects have the same attributes and belong to different data resources.

[0281] According to an embodiment of the present disclosure, the application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource.

[0282] Refer to the above Figure 3 The description of label c1 can correspond to field C1 in physical table Data_s1, field C1' in physical table Data_s2, and field C1' in physical table Data_s3. When user U2 applies for the use of label c1, he can select the data resource to be used. Figure 3 In the example, user U2 selects data resources Data_s1 and Data_s2. Thus, after obtaining authorization, user U2 can use tag c1 to access the corresponding fields C1 and C1' in the digital resources Data_s1 and Data_s2, but cannot use tag c1 to access the corresponding field C1" in the digital resource Data_s3.

[0283] After user U2 obtains authorization to use tag c1 to access digital resources Data_s1 and Data_s2, the user may include an indication of the data resource to be accessed in the data access request, for example, indicating access to the corresponding field of tag c1 in the data resource Data_s1 in the data access request.

[0284] Or, if user U2 is Figure 3 In the interface shown, only the application for using the data resource Data_s1 is made. Therefore, it is not necessary to indicate accessing the data resource Data_s1 in the data access request. In this case, it is assumed that the user U2 wants to access the data resource Data_s1.

[0285] According to an embodiment of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

[0286] According to an embodiment of the present disclosure, receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0287] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0288] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0289] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0290] According to an embodiment of the present disclosure, the records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user.

[0291] According to an embodiment of the present disclosure, the desensitization rule of the authorized user is determined according to the level of the tag and / or the attribute value of the authorized user.

[0292] According to an embodiment of the present disclosure, when an authorized user uses an authorization tag to access data, the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access can be provided based on the attribute value of the authorized user, or based on the tag category and the attribute value of the authorized user. Accordingly, the authorized user can receive the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access. On the basis of implementing preset object access control through tags, the records that the user is allowed to access are controlled. The embodiment of the present disclosure achieves further refinement of data management and access, and realizes more flexible and targeted data management.

[0293] According to an embodiment of the present disclosure, for sensitive labels, when an authorized user uses an authorized label to access data, the desensitization rule of the authorized user can be determined according to the level of the label and / or the attribute value of the authorized user, and the first desensitized data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule is provided. Correspondingly, the authorized user can receive the first desensitized data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule. According to an embodiment of the present disclosure, by desensitizing sensitive data, it is possible to achieve "available but invisible" sensitive data, so that sensitive preset objects can be used by more users, applications and scenarios, while ensuring the security of sensitive data, significantly increasing the amount of data available to users and improving data utilization efficiency. According to an embodiment of the present disclosure, by adopting corresponding desensitization rules for labels of different levels, differentiated data encryption for different user sets or users can be achieved at the preset object granularity level, thereby improving the flexibility and security of data management and access.

[0294] According to an embodiment of the present disclosure, when an authorized user uses an authorization tag to access data, the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access can be determined based on the attribute value of the authorized user, or based on the tag category and the attribute value of the authorized user, and for sensitive labels, the desensitization rule of the authorized user can be determined based on the level of the tag and / or the attribute value of the authorized user. Then, a second desensitized data obtained by processing the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access according to the desensitization rule can be provided. According to an embodiment of the present disclosure, on the basis of realizing data access control at the granularity of preset objects through tags, record access rights and desensitization control are further performed, and the combination of control means is more diversified and flexible, adapting to the needs of more applications and scenarios.

[0295] Figure 9 FIG. 6 is a block diagram showing a data management device 600 according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0296] like Figure 9 As shown, the data management device 600 includes an establishment module 601 , an authorization module 602 and a provision module 603 .

[0297] The establishment module 601 is configured to establish a label corresponding to a preset object in the data;

[0298] The authorization module 602 is configured to authorize the user who is allowed to use the tag;

[0299] The providing module 603 is configured to provide the content of the preset object corresponding to the tag to the authorized user when receiving a data access request using the tag from the authorized user. According to an embodiment of the present disclosure, the establishing of the tag corresponding to the preset object includes generating a corresponding tag for the preset object according to an instruction of a user who generates the user set of data; and / or

[0300] The data management apparatus further includes an application receiving module 604 , which is configured to receive an application from a user to use the tag; or receive an application from a user in another user set to use the tag.

[0301] According to an embodiment of the present disclosure, the tag is initially a private tag visible only to a set of users who generate the data. The apparatus further includes a conversion module 605 .

[0302] The conversion module 605 is configured to: convert the private tag into a public tag, and the public tag is visible to the other user sets; or convert the private tag into a public tag, and the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, the selected subordinate user set of the user set that generated the data, and the sibling user set that belongs to the same superior as the user set that generated the data.

[0303] According to an embodiment of the present disclosure, the tag corresponds to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources;

[0304] The data access request includes an indication of a specific data resource to be accessed;

[0305] The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

[0306] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0307] determining the records to which the authorized user is permitted to access;

[0308] The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

[0309] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0310] If the label is a sensitive label, determine a corresponding desensitization rule;

[0311] Processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data;

[0312] Provide the first desensitized data to the authorized user.

[0313] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0314] determining the records to which the authorized user is permitted to access;

[0315] If the label is a sensitive label, determine a corresponding desensitization rule;

[0316] Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data;

[0317] Provide the second desensitized data to the authorized user.

[0318] According to an embodiment of the present disclosure, determining the records that the authorized user is allowed to access includes:

[0319] Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

[0320] The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

[0321] According to an embodiment of the present disclosure, determining the corresponding desensitization rule includes:

[0322] Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or

[0323] In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

[0324] According to an embodiment of the present disclosure, the data includes a physical table; and / or

[0325] The content of the preset object is a proper subset of the content of the physical table; and / or

[0326] The preset object is a field.

[0327] Figure 10 FIG. 7 is a block diagram showing a data access device 700 according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0328] like Figure 10 As shown, the data access device 700 includes a display module 701 , a first sending module 702 and a receiving module 703 .

[0329] The display module 701 is configured to display labels corresponding to preset objects in the data;

[0330] The first sending module 702 is configured to send a data access request for the authorized user to use the tag after the user obtains authorization to use the tag and becomes an authorized user;

[0331] The receiving module 703 is configured to receive the content of the preset object corresponding to the tag.

[0332] According to an embodiment of the present disclosure, the user does not belong to the set of users that generate the data.

[0333] According to an embodiment of the present disclosure, the tag corresponds to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources;

[0334] The data access request includes an indication of a specific data resource to be accessed;

[0335] The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

[0336] According to an embodiment of the present disclosure, receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0337] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0338] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0339] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0340] According to an embodiment of the present disclosure, the records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user;

[0341] The desensitization rule for the authorized user is determined according to the level of the tag and / or the attribute value of the authorized user.

[0342] According to an embodiment of the present disclosure, the data includes a physical table; and / or

[0343] The content of the preset object is a proper subset of the content of the physical table; and / or

[0344] The preset object is a field.

[0345] According to an embodiment of the present disclosure, the data access apparatus further includes a second sending module 704 , and the second sending module 704 is configured to send a user's application for using the tag.

[0346] Figure 11 FIG. 8 is a structural block diagram of an electronic device 800 according to an embodiment of the present disclosure.

[0347] like Figure 11 As shown, the electronic device 800 includes a memory 801 and a processor 802. The memory 801 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 802 to implement the following method steps:

[0348] Establish labels corresponding to preset objects in the data;

[0349] Authorizing users who are allowed to use the tags;

[0350] When a data access request using the tag is received from an authorized user, the content of the preset object corresponding to the tag is provided to the authorized user.

[0351] According to an embodiment of the present disclosure, the establishing of a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or

[0352] The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data; and / or

[0353] The one or more computer instructions are further executed by the processor 802 to implement the following method steps:

[0354] An application for using the tag is received from a user; or an application for using the tag is received from a user in another user set.

[0355] According to an embodiment of the present disclosure, the tag is initially a private tag visible only to the set of users who generated the data. The one or more computer instructions are further executed by the processor 802 to implement the following method steps:

[0356] converting the private tag into a public tag, wherein the public tag is visible to the set of other users; or

[0357] The private tag is converted into a public tag, and the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, the selected subordinate user sets of the user set that generated the data, and the sibling user sets that belong to the same upper level as the user set that generated the data.

[0358] According to an embodiment of the present disclosure, the tag corresponds to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources;

[0359] The data access request includes an indication of a specific data resource to be accessed;

[0360] The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

[0361] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0362] determining the records to which the authorized user is permitted to access;

[0363] The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

[0364] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0365] If the label is a sensitive label, determine a corresponding desensitization rule;

[0366] Processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data;

[0367] Provide the first desensitized data to the authorized user.

[0368] According to an embodiment of the present disclosure, providing the content of the preset object corresponding to the tag to the authorized user includes:

[0369] determining the records to which the authorized user is permitted to access;

[0370] If the label is a sensitive label, determine a corresponding desensitization rule;

[0371] Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data;

[0372] Provide the second desensitized data to the authorized user.

[0373] According to an embodiment of the present disclosure, determining the records that the authorized user is allowed to access includes:

[0374] Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

[0375] The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

[0376] According to an embodiment of the present disclosure, determining the corresponding desensitization rule includes:

[0377] Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or

[0378] In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

[0379] According to an embodiment of the present disclosure, the data includes a physical table; and / or

[0380] The content of the preset object is a proper subset of the content of the physical table; and / or

[0381] The preset object is a field.

[0382] According to an embodiment of the present disclosure, the one or more computer instructions are executed by the processor 802 to implement the following method steps:

[0383] Display labels corresponding to pre-set objects in the data;

[0384] After the user obtains authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

[0385] Receive the content of the preset object corresponding to the tag.

[0386] According to an embodiment of the present disclosure, the user does not belong to the set of users that generate the data.

[0387] According to an embodiment of the present disclosure, the tag corresponds to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources;

[0388] The data access request includes an indication of a specific data resource to be accessed;

[0389] The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

[0390] According to an embodiment of the present disclosure, receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

[0391] the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access;

[0392] First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule;

[0393] The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

[0394] According to an embodiment of the present disclosure, the records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user;

[0395] The desensitization rule is determined according to the level of the tag and / or the attribute value of the authorized user.

[0396] According to an embodiment of the present disclosure, the data includes a physical table; and / or

[0397] The content of the preset object is a proper subset of the content of the physical table; and / or

[0398] The preset object is a field.

[0399] According to an embodiment of the present disclosure, the one or more computer instructions are executed by the processor 802 to implement the following method steps:

[0400] Sending the user's application to use the tag.

[0401] Figure 12 A schematic structural diagram of a computer system 900 suitable for implementing the data management method and / or data access method according to an embodiment of the present disclosure is shown.

[0402] like Figure 12As shown, the computer system 900 includes a central processing unit (CPU) 901, which can execute various processes in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage unit 909 into a random access memory (RAM) 903. Various programs and data required for the operation of the system 900 are also stored in the RAM 903. The CPU 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0403] The following components are connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, and the like; an output section 907 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 908 including a hard disk and the like; and a communication section 909 including a network interface card such as a LAN card or a modem. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 910 as needed, so that computer programs read therefrom can be installed into the storage section 908 as needed.

[0404] In particular, according to embodiments of the present disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a readable medium thereof, the computer program comprising program code for executing the above-described data management and / or access methods. In such embodiments, the computer program can be downloaded and installed from a network via the communication portion 909 and / or installed from the removable medium 911.

[0405] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the diagram or block diagram can represent a module, program segment or part of the code, and the module, program segment or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, as well as the combination of boxes in the block diagram and / or flow chart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0406] The units or modules involved in the embodiments described in this disclosure may be implemented by software or programmable hardware. The units or modules described may also be provided in a processor, and the names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0407] As another aspect, the present disclosure further provides a readable storage medium. This readable storage medium may be included in the electronic device or computer system described in the above embodiments, or may be a standalone readable storage medium not incorporated into the device. The readable storage medium stores one or more programs, which are used by one or more processors to execute the methods described in the present disclosure.

[0408] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A data management method, characterized in that: include: Creating, according to a user instruction of a user set that generates the data, a tag corresponding to a preset object in the data, wherein the tag is initially a private tag visible only to the user set that generates the data; Convert the private tag into a public tag, which is visible to other user sets; or set the disclosure scope of the public tag to any one or more of the following: all subordinate user sets of the user set that generated the data, selected subordinate user sets of the user set that generated the data, and sibling user sets that belong to the same upper level as the user set that generated the data; receiving an application for using the tag from a user set within a disclosure scope of the public tag; Authorizing users who are allowed to use the tags; When receiving a data access request using the tag from an authorized user, providing the content of the preset object corresponding to the tag to the authorized user; The data management method further includes: The public tags are converted into private tags that are not visible to a set of users other than a set of users who generated the data.

2. The data management method according to claim 1, wherein: The establishing of the label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data.

3. The data management method according to claim 2, wherein: The tags correspond to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources; The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource; The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

4. The data management method according to claim 1, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: determining the records to which the authorized user is permitted to access; The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

5. The data management method according to claim 1, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: If the label is a sensitive label, determining a corresponding desensitization rule, and processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data; Provide the first desensitized data to the authorized user.

6. The data management method according to claim 1, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: determining the records to which the authorized user is permitted to access; If the label is a sensitive label, determine a corresponding desensitization rule; Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data; Provide the second desensitized data to the authorized user.

7. The data management method according to claim 4 or 6, characterized in that: The determining of the records that the authorized user is allowed to access includes: Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

8. The data management method according to claim 5 or 6, characterized in that: Determining the corresponding desensitization rule includes: Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

9. The data management method according to claim 1, wherein: The data includes a physical table; and / or The content of the preset object is a proper subset of the content of the physical table; and / or The preset object is a field.

10. A data access method, characterized in that: include: Displaying tags corresponding to preset objects in the data, where the tags are public tags converted from private tags, and are visible to other user sets. Alternatively, the public scope of the public tags is set to any one or more of the following: all subordinate user sets of the user set that generated the data, selected subordinate user sets of the user set that generated the data, and sibling user sets that belong to the same parent level as the user set that generated the data. Private tags are visible only to the user set that generated the data. Sending the user's application for using the tag; After the user obtains authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag; The content of the preset object corresponding to the tag is received; wherein the public tag can be converted into a private tag, and the private tag is not visible to a user set other than a user set that generates the data.

11. The data access method according to claim 10, wherein: The user does not belong to the set of users that generated the data.

12. The data access method according to claim 10, wherein: The tags correspond to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources; The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource; The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

13. The data access method according to claim 10, wherein: The receiving the content of the preset object corresponding to the tag includes receiving any one of the following: the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access; First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule; The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

14. The data access method according to claim 13, wherein: The records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user; The desensitization rule is determined according to the level of the tag and / or the attribute value of the authorized user.

15. The data access method according to claim 10, wherein: The data includes a physical table; and / or The content of the preset object is a proper subset of the content of the physical table; and / or The preset object is a field.

16. A data management device, characterized in that: include: an establishing module configured to establish a tag corresponding to a preset object in the data according to a user instruction of the user set that generates the data, wherein the tag is initially a private tag visible only to the user set that generates the data; a conversion module configured to convert the private tag into a public tag, wherein the public tag is visible to other user sets; or the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, a selected subordinate user set of the user set that generated the data, and a sibling user set that belongs to the same upper level as the user set that generated the data; an application receiving module configured to receive an application for using the tag from a user set within a disclosure range of the public tag; an authorization module, configured to authorize a user who is allowed to use the tag; a providing module configured to, upon receiving a data access request using the tag from an authorized user, provide the content of the preset object corresponding to the tag to the authorized user; The conversion module is further configured to convert the public tag into a private tag, where the private tag is invisible to a set of users other than a set of users who generate the data.

17. The data management device according to claim 16, wherein: The establishing of the label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user of the user set that generates the data; and / or The establishing of the label corresponding to the preset object includes establishing a correspondence between the preset object and the corresponding label according to an instruction of a user of the user set that generates the data.

18. The data management device according to claim 16, wherein: The tags correspond to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources; The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource; The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource.

19. The data management device according to claim 16, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: determining the records to which the authorized user is permitted to access; The authorized user is provided with content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

20. The data management device according to claim 16, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: If the label is a sensitive label, determine a corresponding desensitization rule; Processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitized data; Provide the first desensitized data to the authorized user.

21. The data management device according to claim 16, wherein: The providing the content of the preset object corresponding to the tag to the authorized user includes: determining the records to which the authorized user is permitted to access; If the label is a sensitive label, determine a corresponding desensitization rule; Processing, according to the desensitization rule, the content of the preset object corresponding to the label in the record that the authorized user is allowed to access, to obtain second desensitized data; Provide the second desensitized data to the authorized user.

22. The data management device according to claim 19 or 21, characterized in that: The determining of the records that the authorized user is allowed to access includes: Determining the records that the authorized user is allowed to access based on the attribute value of the authorized user; or The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

23. The data management device according to claim 19 or 21, characterized in that: Determining the corresponding desensitization rule includes: Determine the corresponding desensitization rule according to the level of the tag and / or the attribute value of the authorized user; and / or In the case where the authorized user belongs to the whitelist user set, no desensitization processing is performed.

24. The data management device according to claim 16, wherein: The data includes a physical table; and / or The content of the preset object is a proper subset of the content of the physical table; and / or The preset object is a field.

25. A data access device, characterized in that: include: A display module is configured to display a tag corresponding to a preset object in the data, wherein the tag is a public tag converted from a private tag, and the public tag is visible to other user sets, or the disclosure scope of the public tag is set to any one or more of the following: all subordinate user sets of the user set that generated the data, selected subordinate user sets of the user set that generated the data, and sibling user sets belonging to the same upper level as the user set that generated the data; the private tag is visible only to the user set that generated the data; a second sending module, configured to send a user's application for using the tag; A first sending module is configured to send a data access request for the authorized user to use the tag after the user obtains authorization to use the tag and becomes an authorized user; A receiving module is configured to receive the content of the preset object corresponding to the tag; wherein the public tag can be converted into a private tag, and the private tag is invisible to a user set other than the user set that generates the data.

26. The data access device according to claim 25, characterized in that: The user does not belong to the set of users that generated the data.

27. The data access device according to claim 25, wherein: The tags correspond to a plurality of preset objects, the plurality of preset objects having the same attributes and belonging to different data resources; The application for using the tag includes an indication of a specific data resource among the different data resources and / or the data access request includes an indication of the specific data resource; The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

28. The data access device according to claim 25, characterized in that The receiving the content of the preset object corresponding to the tag includes receiving any one of the following: the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access; First desensitized data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule; The second desensitized data is obtained by processing the content of the preset object corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule.

29. The data access device according to claim 28, wherein: The records that the authorized user is allowed to access are determined based on the attribute value of the authorized user, or based on the category of the tag and the attribute value of the authorized user; The desensitization rule for the authorized user is determined according to the level of the tag and / or the attribute value of the authorized user.

30. The data access device according to claim 25, characterized in that ； The data includes a physical table; and / or The content of the preset object is a proper subset of the content of the physical table; and / or The preset object is a field.

31. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described in any one of claims 1 to 15.

32. A readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method steps described in any one of claims 1 to 15 are implemented.

33. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method steps according to any one of claims 1 to 15 are implemented.

Images