Data management method, electronic device and computer program product

Abstract

Embodiments of the present disclosure relate to methods, devices, and computer program products for data management. The method includes: at a first node of a plurality of nodes for collaboratively processing data, receiving a request to perform a target operation at the first node from a second node of the plurality of nodes; obtaining the authority of the second node from a third node of the plurality of nodes; determining a threshold authority for performing the target operation based on the type of the target operation; and performing the target operation based on determining that the authority of the second node is higher than the threshold authority. Based on such a method, the security of data can be improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computers, and more particularly, to a method, an electronic device, and a computer program product for data management. Background Art

[0002] In recent years, with the development of computer technology, decentralized multi-node architecture has been increasingly applied in various fields (e.g., the Internet of Things). By processing data at multiple nodes (e.g., edge servers), the pressure of cloud computing and storage can be reduced, thereby improving the efficiency of the system. However, such a multi-node architecture lacks an effective permission management mechanism, which makes data management more risky, which is not desirable. Summary of the invention

[0003] Embodiments of the present disclosure provide a solution for data management.

[0004] According to a first aspect of the present disclosure, a method for data management is provided. The method includes: receiving, at a first node of a plurality of nodes for collaboratively processing data, a request to perform a target operation at the first node from a second node of the plurality of nodes; obtaining the authority of the second node from a third node of the plurality of nodes; determining a threshold authority for performing the target operation based on the type of the target operation; and performing the target operation based on determining that the authority of the second node is higher than the threshold authority.

[0005] According to a second aspect of the present disclosure, an electronic device is provided. The device includes: at least one processing unit; at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, cause the device to perform an action, the action including: at a first node of a plurality of nodes for collaboratively processing data, receiving a request to perform a target operation at the first node from a second node of the plurality of nodes; obtaining the authority of the second node from a third node of the plurality of nodes; based on the type of the target operation, determining a threshold authority for performing the target operation; and performing the target operation according to determining that the authority of the second node is higher than the threshold authority.

[0006] In a third aspect of the present disclosure, a computer program product is provided. The computer program product is stored in a non-transitory computer storage medium and includes machine executable instructions, which, when executed in a device, cause the device to perform any step of the method described in the first aspect of the present disclosure.

[0007] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the present disclosure, nor is it intended to limit the scope of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0009] Figure 1 A schematic diagram illustrating an example environment in which embodiments of the present disclosure can be implemented;

[0010] Figure 2 A schematic diagram illustrating an example process of data management according to an embodiment of the present disclosure;

[0011] Figure 3 A flowchart illustrating an example process of determining permissions according to an embodiment of the present disclosure is illustrated;

[0012] Figure 4 illustrates an example distributed hash table system according to an embodiment of the present disclosure; and

[0013] Figure 5 A schematic block diagram of an example device that may be used to implement embodiments of the present disclosure is illustrated. DETAILED DESCRIPTION

[0014] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0015] As used herein, the term "including" and its variations mean open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "based at least in part on". The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0016] As discussed above, in the traditional decentralized multi-node processing architecture, there is a lack of management mechanism for node permissions. In this case, some nodes may maliciously tamper with the data maintained in the multi-nodes after being attacked, which will bring unexpected risks to users.

[0017] According to an embodiment of the present disclosure, a data management scheme is provided. In the scheme, when a request to perform a target operation from a second node is received at a first node of multiple nodes for collaboratively processing data, the authority of the second node is obtained from a third node among the multiple nodes. Subsequently, based on the type of the target operation, the threshold authority corresponding to the target operation is determined. The target operation is performed only when the authority of the second node is higher than the threshold authority. Based on this approach, an embodiment of the present disclosure provides a permission management mechanism between multiple nodes to prevent malicious data operations from being performed, thereby improving the security of data.

[0018] The embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. Figure 1 1 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 As shown, environment 100 includes cloud storage 110, decentralized multi-node architecture 120, and multiple clients 130-1 and 130-2 (hereinafter also individually or collectively referred to as clients 130). Multi-node architecture 120 includes multiple nodes 125-1 to 125-4 (hereinafter also individually or collectively referred to as nodes 125) that are communicatively coupled to each other. It should be understood that Figure 1 The specific number of nodes and the number of clients shown in are merely illustrative, and there may be more or fewer nodes or clients.

[0019] The node 125 may receive data from the client 130 and process it accordingly. For example, the node 125 may store the data in the multi-node architecture 120 without uploading it to the cloud storage 110. As another example, the node 125 may also analyze the received data, for example, to determine whether the data has anomalies.

[0020] During such operation, one of the multiple nodes may need to access data of other nodes, modify data maintained by other nodes, or add new data on other nodes, etc. In the absence of effective management of node permissions, the data maintained in the multi-node architecture 120 will be at risk.

[0021] The following will refer to Figures 2 to 4 To further describe the process of data management according to an embodiment of the present disclosure. Figure 2 FIG. 2 is a flowchart showing a process 200 of data management according to some embodiments of the present disclosure. The process 200 may be performed by, for example Figure 1The node 125 - 1 shown in FIG. 1 (hereinafter referred to as the first node for convenience of description) is implemented.

[0022] like Figure 2 As shown, at block 202, the first node 125-1 receives a request from a second node (eg, Figure 1 1) receives a request to perform a target operation at the first node 125-1. Figure 1 In the example of , the first node 125-1 can receive a request to perform a target operation from the second node 125-2. In some embodiments, the target operation can include reading data maintained at the first node 125-1. Alternatively or additionally, the target operation can include adding new data at the first node 125-1. Alternatively or additionally, the target operation can also include modifying the data maintained at the first node 125-1. It should be understood that the target operation can also include any other appropriate data operation type.

[0023] At block 204, the first node 125-1 receives a signal from a third node (eg, Figure 1 The node 125-3 in the second node 125-2 obtains the authority of the second node 125-2. In some embodiments, the authority of multiple nodes can be managed by maintaining a distributed hash table (DHT) at multiple nodes.

[0024] The following will refer to Figure 3 To describe the specific process of block 204, Figure 3 FIG. 1 is a flowchart showing a process of obtaining permissions according to an embodiment of the present disclosure. Figure 3 As shown, in block 302, the first node 125-1 may determine a third node 125-3 for maintaining authority from among multiple nodes based on the identification of the second node 125-2. In some embodiments, the authority of multiple nodes may be maintained by a distributed hash table system. Figure 4 An example distributed hash table system 400 is shown according to an embodiment of the present disclosure.

[0025] like Figure 4 As shown, in the distributed hash table system 400, the metadata (e.g., permissions) corresponding to each node will be distributedly stored in a distributed hash table maintained in multiple nodes based on the hash value. For example, the permissions of the second node 125-2 can be stored at the third node 125-3 based on the hash value of the identifier "NODE_2" of the second node 125-2. Due to the storage randomness brought by the distributed hash table system, the permission value of the node is usually not maintained locally at the node. Based on this approach, even if the node is attacked and becomes a malicious node, the malicious node cannot directly tamper with the permission value maintained at another node, thereby improving the reliability of permission management.

[0026] In some embodiments, when the first node 125-1 receives a request from the second node 125-2 to perform a target operation, the first node 125-1 may first obtain an identifier (e.g., NODE_2) of the second node 125-2, and calculate a hash value of the identifier to determine a third node 125-3 that maintains the authority of the second node 125-2 from multiple nodes. It should be understood that the third node may be the same as or different from the first node or the second node.

[0027] At block 304, the first node 125-1 may determine the authority from the distributed hash table maintained by the third node 125-3. Figure 4 As shown, the third node 125-3 maintains a distributed hash table 410 in the distributed hash table system 400. The distributed hash table 410 may include a hash value 420 (HASH(NODE_2)) corresponding to the second node 125-2 and the permission 430 of the second node 125-2. In some embodiments, the value (in Figure 4 In the example of , the value is "50") to indicate the authority of the node. Alternatively, the authority of the node can also be indicated by other suitable forms (e.g., text). For example, the text "read-only" can indicate that the node can only read data at other nodes, but cannot modify the data or create new data.

[0028] Continue to refer Figure 2 In block 206, the first node 125-1 determines the threshold permissions for performing the target operation based on the type of the target operation. It should be understood that the operations that cannot be performed may bring different risks to the data maintained at the node. For example, data reading operations generally do not bring risks, while operations that modify data maintained by other nodes may have greater risks than operations that create new data at other nodes. Therefore, different threshold permissions can be set for different target operations.

[0029] In the example of indicating permissions with numerical values, for example, the threshold permission for reading data operations can be set to "0", the threshold permission for creating new data operations can be set to "49", and the threshold permission for modifying data operations can be set to "99". Based on this approach, the permissions of nodes for performing different operations can be managed more flexibly.

[0030] In the example of indicating permissions with text, different texts can be converted into corresponding numerical values. For example, the text "read-only" can correspond to the numerical value "1", the text "new" can correspond to the numerical value "2", and the text "modify" can correspond to the numerical value "3". The threshold permissions corresponding to "read operation", "new operation" and "modify operation" can be set to "0", "1" and "2" respectively, so that nodes with corresponding permissions can only perform corresponding operations, but cannot perform operations that require higher permissions.

[0031] At block 208, the first node 125-1 determines whether the permissions of the second node 125-2 are above the threshold permissions. In response to determining at block 208 that the permissions of the second node 125-2 are above the threshold permissions, the method 200 proceeds to block 210, i.e., the first node 125-1 performs the target operation. Otherwise, the method 200 proceeds to block 212, i.e., the first node 125-1 refuses to perform the target operation.

[0032] For example, for Figure 4 In an example, the permission of the second node 125-2 is "50". In an example, when the second node 125-1 requests to read the data of the first node 125-1, the first node 125-1 can determine that the permission "50" of the second node 125-2 is higher than the corresponding threshold permission "0". Therefore, the first node 125-1 can allow the data read operation to be performed.

[0033] In another example, when the second node 125-1 requests to create new data at the first node 125-1, the first node 125-1 can determine that the permission "50" of the second node 125-2 is higher than the corresponding threshold permission "49", so the first node 125-1 can allow the new data operation of the second node 125-2.

[0034] In another example, when the second node 125-1 requests to modify data on the first node 125-1, the first node 125-1 may determine that the permission "50" of the second node 125-2 is lower than the corresponding threshold permission "99", and therefore, the first node 125-1 rejects the data modification operation of the second node 125-2. It should be understood that the specific values ​​of the permissions and threshold permissions described above are only illustrative and are not intended to be a limitation on the present disclosure.

[0035] Based on this approach, the embodiments of the present disclosure can effectively manage the permissions of multiple nodes, and perform personalized permission management of multiple nodes according to the risk levels of different data operations, thereby improving data security.

[0036] In some embodiments, the permissions of each node can also be dynamically updated. Specifically, when the target operation is allowed to be executed, the first node 125-1 can also cause the third node 125-3 to adjust the permissions of the second node 125-2. Figure 4 In the example of, when the first node 125-1 allows the second node's request to create a new data operation, the first node 125-1 can cause the third node 125-3 to update the distributed hash table it maintains to increment the permission 430 of the second node 125-2, for example, to "51". Therefore, when the second node 125-2 successfully executes low-authority data operations multiple times, it will acquire more new permissions. Accordingly, the second node 125-2 will be granted higher permissions, so that it can execute other data operations that require higher permissions.

[0037] In some embodiments, in order to avoid malicious nodes from modifying the permissions of nodes, too frequent permission adjustments can also be avoided by setting a time window. Specifically, the first node 125-1 can obtain the historical moment when the first node 125-1 previously updated the permissions of the second node 125-2. Only when it is determined that the time difference between the historical moment and the current moment is greater than a predetermined time threshold, the first node 125-1 allows the third node 125-3 to update the permissions of the second node 125-2. Based on such a mechanism, the same node will not be able to repeatedly update the permissions of a node in a short period of time, thereby further improving the reliability of permission management.

[0038] In some embodiments, in order to facilitate the management of permissions, a management node for managing permissions can also be set in multiple nodes. The management node can, for example, set initial permissions for each new node. For example, the initial permissions of each new node can be set to "1", that is, the new node will only be able to read data from other nodes. Only after successfully reading data from other nodes multiple times within a period of time, the new node will have the permission to create data or the permission to modify data.

[0039] In some embodiments, the management node may also perform dynamic adjustment of node permissions. In some embodiments, the management node may, for example, detect whether the second node 125-2 is abnormal. For example, the management node may, for example, determine whether the data uploaded by the second node 125-2 is abnormal by comparing the data uploaded by the second node with the data of other nodes. For example, for an IoT scenario, for example, each node may upload temperature data. When the management node detects that the temperature data uploaded by the second node is significantly different from the temperature data uploaded by physically adjacent nodes, the management node may determine that the second node 125-2 is abnormal.

[0040] In some embodiments, when the management node determines that the second node 125-2 has an abnormality, the management node may cause the third node 125-3 to adjust the authority of the second node 125-2. For example, when the management node detects an abnormality in the second node 125-2, the management node may send an instruction to the third node to reduce the authority of the second node 125-2. In some embodiments, the adjustment of authority may also be based on the type of abnormality. For example, the management node may determine the severity level of the abnormality, and when the severity level of the abnormality is high, the management node may cause the authority of the second node 125-2 to be reduced to a greater extent. On the contrary, when the severity level of the abnormality is low, the management node may cause the authority of the second node 125-2 to be reduced to a lesser extent.

[0041] For example, for an autonomous driving scenario, when the data uploaded by the second node 125-2 includes temperature data and map data uploaded by an autonomous driving vehicle, the map data is more important data for the autonomous driving vehicle. In one example, the management node determines that the temperature data uploaded by the second node 125-2 is abnormal, while the map data is normal. At this time, the management node can, for example, adjust the previous permissions of the second node 125-2 (100, i.e., having the permission to modify data) to only having the permission to create data (e.g., 50). In another example, when the management node determines that the map data uploaded by the second node 125-2 is abnormal, the management node can, for example, set the previous permissions of the second node 125-2 to only have the permission to read data (e.g., 1). In this way, the management node can update the permissions of each node based on the abnormal state of the node, thereby improving the reliability of permission management.

[0042] Figure 5 Schematic block diagram of an example device 500 that can be used to implement embodiments of the present disclosure is shown. Figure 1 The node 125 shown is implemented by a device 500. As shown, the device 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 502 or loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the device 500 can also be stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0043] A number of components in the device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0044] The various processes and processing described above, such as method 200, may be performed by processing unit 501. For example, in some embodiments, method 200 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by CPU 501, one or more actions of method 200 described above may be performed.

[0045] The present disclosure may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0046] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0047] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0048] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0049] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0050] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0051] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0052] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0053] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for data management, comprising: At a first node among a plurality of nodes for collaboratively processing data, receiving a request from a second node among the plurality of nodes to perform a target operation at the first node; The first node obtains, from a third node among the plurality of nodes, the authority of the second node maintained by the third node; determining, by the first node, a threshold permission for performing the target operation based on the type of the target operation, the threshold permission having a first value when the target operation is of a first type and having a second value when the target operation is of a second type; as well as According to the first node determining that the authority of the second node is higher than the threshold authority, executing the target operation; The permission to obtain the second node includes: determining the third node for maintaining the authority from the plurality of nodes based on the identifier of the second node, and determining the authority from a distributed hash table maintained by the third node; and The permission is a value that is dynamically updated based in part on a determination that the target operation is permitted to be performed. 2 . The method according to claim 1 , wherein the target operation comprises at least one of the following: reading existing data, adding new data, or modifying existing data.

3. The method according to claim 1, further comprising: According to determining that the target operation has been performed, the third node adjusts the authority of the second node.

4. The method according to claim 3, wherein adjusting the permissions comprises: Obtain the historical moment when the first node previously updated the permission; as well as According to determining that the time difference between the historical moment and the current moment is greater than a predetermined time threshold, the third node updates the authority of the second node.

5. The method according to claim 1, further comprising: According to determining that the authority of the second node is less than or equal to the threshold authority, refusing to execute the target operation.

6. The method according to claim 1, further comprising: In response to determining that an abnormality exists in the second node at a management node for managing the authority of the plurality of nodes, the management node causes the third node to adjust the authority of the second node, the adjustment being based on a type of the abnormality.

7. An electronic device comprising: at least one processing unit; at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the apparatus to perform actions comprising: At a first node among a plurality of nodes for collaboratively processing data, receiving a request from a second node among the plurality of nodes to perform a target operation at the first node; The first node obtains, from a third node among the plurality of nodes, the authority of the second node maintained by the third node; determining, by the first node, a threshold permission for performing the target operation based on the type of the target operation, the threshold permission having a first value when the target operation is of a first type and having a second value when the target operation is of a second type; and According to the first node determining that the authority of the second node is higher than the threshold authority, executing the target operation; The permission to obtain the second node includes: determining the third node for maintaining the authority from the plurality of nodes based on the identifier of the second node, and determining the authority from a distributed hash table maintained by the third node; and The permission is a value that is dynamically updated based in part on a determination that the target operation is permitted to be performed. 8 . The device according to claim 7 , wherein the target operation comprises at least one of the following: reading existing data, adding new data, or modifying existing data.

9. The device of claim 7, wherein the actions further comprise: According to determining that the target operation has been performed, the third node adjusts the authority of the second node.

10. The device of claim 9, wherein adjusting the permissions comprises: Obtain the historical moment when the first node previously updated the permission; as well as According to determining that the time difference between the historical moment and the current moment is greater than a predetermined time threshold, the third node updates the authority of the second node.

11. The device of claim 7, wherein the actions further comprise: According to determining that the authority of the second node is less than or equal to the threshold authority, refusing to execute the target operation.

12. The apparatus of claim 7, wherein the actions further comprise: In response to determining that an abnormality exists in the second node at a management node for managing the authority of the plurality of nodes, the management node causes the third node to adjust the authority of the second node, the adjustment being based on a type of the abnormality.

13. A computer program product tangibly stored in a computer storage medium and comprising machine executable instructions which, when executed by a device, cause the device to perform the method according to any one of claims 1-6.

Images