Data permission filtering method, device, computer equipment and storage medium

Abstract

The embodiment of the present application belongs to the field of big data and relates to a data permission filtering method, including: when receiving a permission filtering request, obtaining a target database statement from a target database, parsing the target database statement to generate a first syntax tree; screening the first syntax tree to determine whether there is a central table carrying user permission information in the first syntax tree; when there is no central table in the first syntax tree, determining whether there is a target permission filtering identifier in the first syntax tree; when there is a target permission filtering identifier in the first syntax tree, obtaining a newly established central table, and adding the new central table and preset permission filtering conditions to the first syntax tree to obtain a second syntax tree after permission filtering. The present application also provides a data permission filtering device, a computer device and a storage medium. In addition, the present application also relates to blockchain technology, and the second syntax tree can be stored in the blockchain. The present application improves the efficiency of data permission filtering.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a data permission filtering method, apparatus, computer equipment, and storage medium. Background Art

[0002] With the rapid development of information technology, permission control has become an essential part of data processing to ensure the privacy and security of user information. The implementation of data permissions often requires filtering query data sets based on permission configuration information in program code to ensure that only the appropriate users can see the appropriate data sets. However, this traditional coding method may result in different data tables corresponding to different query statements, and when querying SQL statements, there may be multi-table joint queries and subqueries, ultimately leading to inefficient data permission filtering. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to propose a data permission filtering method, apparatus, computer equipment and storage medium to solve the technical problem of low efficiency of data permission filtering.

[0004] In order to solve the above technical problems, the present application provides a data permission filtering method, which adopts the following technical solutions:

[0005] When receiving a permission filtering request, obtaining a target database statement from a target database, parsing the target database statement to generate a first syntax tree;

[0006] Screening the first syntax tree to determine whether a central table carrying user authority information exists in the first syntax tree;

[0007] When the pivot table does not exist in the first syntax tree, determining whether a target permission filtering identifier exists in the first syntax tree;

[0008] When the target permission filtering identifier exists in the first syntax tree, a newly established central table is obtained, and the new central table and the preset permission filtering condition are added to the first syntax tree to obtain a second syntax tree after permission filtering.

[0009] Furthermore, the parsing of the target database statement to generate a first syntax tree includes:

[0010] Generate a configuration file based on the target database statement and obtain a preset interceptor;

[0011] The configuration file is loaded based on the preset interceptor, and the configuration file is parsed by the processing layer of the preset interceptor to obtain the first syntax tree.

[0012] Furthermore, after the step of determining whether a central table carrying user authority information exists in the first syntax tree, the method further includes:

[0013] When the pivot table exists in the first syntax tree, obtaining location information of the pivot table;

[0014] A target splicing instruction is acquired according to the position information, the target splicing instruction is executed, and a preset permission filtering condition is added to the first syntax tree to obtain a second syntax tree after permission filtering.

[0015] Furthermore, the acquiring a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree includes:

[0016] When the location information is a subquery, parsing the permission filtering request, obtaining a central field for permission control, and determining whether the central field exists in the subquery;

[0017] When the pivot field exists in the subquery, adding the pivot field and the permission filtering condition to the first syntax tree;

[0018] When the pivot field does not exist in the subquery, the alias of the subquery is searched, and the permission filtering condition is added to the first syntax tree according to the alias.

[0019] Furthermore, the acquiring a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree further includes:

[0020] When the location information is a common query, the permission filtering condition is added to the where statement of the common query.

[0021] Furthermore, after the step of parsing the target database statement to generate a first syntax tree, the method further includes:

[0022] Determining whether the first syntax tree is a combination of multiple statement result sets;

[0023] When the first syntax tree is the combination, the combination is split into multiple separate target sentences, and the pivot table is detected based on the target sentences.

[0024] Furthermore, determining whether a central table carrying user authority information exists in the first syntax tree includes:

[0025] Obtain the target field corresponding to the target database statement;

[0026] detecting whether a user table including the target field exists in the first syntax tree, and determining whether the pivot table exists in the first syntax tree when the user table exists;

[0027] When the user table does not exist, it is determined that the pivot table does not exist in the first syntax tree.

[0028] In order to solve the above technical problems, the embodiment of the present application further provides a data permission filtering device, which adopts the following technical solution:

[0029] A parsing module, configured to, upon receiving a permission filtering request, obtain a target database statement from a target database, parse the target database statement, and generate a first syntax tree;

[0030] A screening module, configured to screen the first syntax tree to determine whether a central table carrying user authority information exists in the first syntax tree;

[0031] a confirmation module, configured to determine whether a target permission filtering identifier exists in the first syntax tree when the pivot table does not exist in the first syntax tree;

[0032] The splicing module is used to obtain the newly established central table when the target permission filtering identifier exists in the first syntax tree, and add the new central table and the preset permission filtering condition to the first syntax tree to obtain a second syntax tree after permission filtering.

[0033] In order to solve the above technical problems, an embodiment of the present application also provides a computer device, including a memory and a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above data permission filtering method when executing the computer program.

[0034] In order to solve the above technical problems, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the above data permission filtering method are implemented.

[0035] The data permission filtering method proposed in the present application obtains the target database statement from the target database when receiving the permission filtering request, parses the target database statement to generate a first syntax tree, and the syntax logic of the target database statement can be represented by the first syntax tree, and the workload of data permission filtering can be reduced; then the first syntax tree is screened to determine whether there is a central table carrying user permission information in the first syntax tree, and the statements that require permission filtering can be accurately identified based on the central table; then, when there is no central table in the first syntax tree, it is determined whether there is a target permission filtering identifier in the first syntax tree; finally, when there is a target permission filtering identifier in the first syntax tree, a new central table is obtained, and the new central table and the preset permission filtering conditions are added to the first syntax tree to obtain a second syntax tree after permission filtering, thereby realizing automatic filtering of data permissions in the database, saving the time of data permission filtering, and improving the filtering efficiency and filtering ability of data permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0038] Figure 2 A flowchart according to an embodiment of the data authority filtering method of the present application;

[0039] Figure 3 This is a structural diagram of an embodiment of a data authority filtering device according to the present application;

[0040] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application.

[0041] Reference numerals: data authority filtering device 300 , parsing module 301 , screening module 302 , confirmation module 303 and splicing module 304 . DETAILED DESCRIPTION

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0043] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0044] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0045] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0046] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0047] Terminal devices 101, 102, and 103 can be various electronic devices with display screens and support web browsing, including but not limited to smartphones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV), laptop computers, desktop computers, etc.

[0048] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0049] It should be noted that the data permission filtering method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the data permission filtering device is generally set in the server / terminal device.

[0050] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0051] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for filtering data permissions according to the present application. The data permission filtering method comprises the following steps:

[0052] Step S201: upon receiving a permission filtering request, obtaining a target database statement from a target database, and parsing the target database statement to generate a first syntax tree;

[0053] In this embodiment, the target database statement is a SQL (Structured Query Language) database statement. When a permission filtering request is received, the permission filtering request is parsed to obtain the target database and all statements in the target database statement that need to be permission filtered. The statement is the target database statement. When the target database statement is obtained, the target database statement is parsed to generate a first syntax tree. Specifically, the first syntax tree is an abstract syntax tree (i.e., abstract syntax code, AST). The abstract syntax tree is a tree representation of the abstract syntax structure of the source code, and each node on the tree represents a structure in the source code. When the target database statement is obtained, the target database statement is subjected to lexical analysis and syntactic analysis to generate a first syntax tree corresponding to the target database statement.

[0054] Step S202: Screen the first syntax tree to determine whether there is a central table carrying user authority information in the first syntax tree;

[0055] In this embodiment, the pivot table is a table that carries information related to user permissions in data queries. For example, the user table carries a "department ID" field, and the permission system needs to perform permission control by department. If this user table appears in the SQL statement, then this table is the pivot table in the SQL statement, and this "department ID" is called the "pivot field". The pivot table can appear after the From statement, or after the Join statement, and is even allowed to appear in a subquery. When the first syntax tree is obtained, the target field corresponding to the target database statement is obtained. The target field can be obtained through the field information pre-associated with the target database statement, or by parsing the permission filtering request. According to the target field, the target database statement can be filtered for permissions, such as filtering the target database statement for permissions according to fields such as age or department. When the first syntax tree generated by the target database statement is obtained, the target field can be determined by querying the field associated with the target database statement or parsing the permission filtering request. Then, determine whether there is a user table including the target field in the first syntax tree. If the user table exists, determine that there is a pivot table in the first syntax tree; if the user table does not exist, determine that there is no pivot table in the first syntax tree.

[0056] Step S203: When the pivot table does not exist in the first syntax tree, determining whether a target permission filtering identifier exists in the first syntax tree;

[0057] In this embodiment, if the central table does not exist in the first syntax tree, it is determined whether there is a target permission filter identifier in the first syntax tree, wherein the target permission filter identifier is the identification information of the syntax tree that requires a permission filter statement (such as the preset target permission filter identifier is 99). The preset identification table is obtained, and the first syntax tree is traversed according to the preset identification table to determine whether there is an identification field in the first syntax tree that is consistent with the current preset identification table. If so, it is determined that the target permission filter identifier exists in the first syntax tree; if not, it is determined that the target permission filter identifier does not exist in the first syntax tree.

[0058] Step S204: when the target permission filtering identifier exists in the first syntax tree, a newly established central table is obtained, and the new central table and the preset permission filtering condition are added to the first syntax tree to obtain a second syntax tree after permission filtering.

[0059] In this embodiment, the permission filtering condition is a pre-set data filtering condition. The permission filtering condition can be composed of a plurality of target fields, or a target field can be used as the permission filtering condition, and the data can be filtered according to the permission filtering condition. When the target permission filtering identifier exists in the first syntax tree, a new central table is obtained, and the new central table is a pre-established user table including user permission information. The new central table and the preset permission filtering condition are added to the where condition of the top-level query statement of the first syntax tree to obtain a second syntax tree after permission filtering. Thus, permission filtering of the target database statement is realized according to the second syntax tree.

[0060] It should be emphasized that in order to further ensure the privacy and security of the second syntax tree, the second syntax tree can also be stored in a node of a blockchain.

[0061] The blockchain referred to in this application is a new application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0062] This embodiment realizes automatic filtering of data permissions in the database, saves the time of data permission filtering, and improves the filtering efficiency and filtering ability of data permissions.

[0063] In some embodiments of the present application, parsing the target database statement to generate the first syntax tree includes:

[0064] Generate a configuration file based on the target database statement and obtain a preset interceptor;

[0065] The configuration file is loaded based on the preset interceptor, and the configuration file is parsed by the processing layer of the preset interceptor to obtain the first syntax tree.

[0066] In this embodiment, the preset interceptor can be used to implement the custom logic without changing the logic of the original framework. Therefore, by obtaining the preset interceptor, the target database statement can be parsed according to the preset interceptor and the first syntax tree can be generated.

[0067] For example, Mybatis is a persistence layer framework that supports common SQL queries, storage, and advanced mapping. By using xml or annotations for configuration and raw mapping, the interface can be mapped to a record in the database. Specifically, when the target database statement is obtained, the target database statement, incoming parameters, and result mapping configuration are packaged into a configuration file. The Mybatis interceptor is obtained, and the interface of the Mybatis interceptor is called to pass the permission filtering request to the processing layer of the interceptor. The configuration file is parsed according to the processing layer to obtain the target database statement and incoming parameters, execute the incoming parameters, and obtain a connection with the target database. When the interceptor is successfully connected to the target database, the target database statement and incoming parameters are added to the target database statement to obtain an execution result; thereafter, according to the result mapping configuration in the configuration file, the execution result is converted into a corresponding syntax tree, which is the first syntax tree.

[0068] This embodiment parses the target database statement through a preset interceptor to obtain a first syntax tree. The first syntax tree can clearly and efficiently express the logical structure of the target database statement, saving data processing time. It further improves the efficiency of database statement permission filtering when the second syntax tree is obtained through the first syntax tree.

[0069] In some embodiments of the present application, after determining whether a hub table carrying user authority information exists in the first syntax tree, the following steps are included:

[0070] When the pivot table exists in the first syntax tree, obtaining location information of the pivot table;

[0071] A target splicing instruction is acquired according to the position information, the target splicing instruction is executed, and a preset permission filtering condition is added to the first syntax tree to obtain a second syntax tree after permission filtering.

[0072] In this embodiment, if there is a central table in the first syntax tree, the position information of the central table is obtained. The position information is the position of the current central table in the first syntax tree. Different position information corresponds to different target splicing instructions. When the position information is obtained, a preset mapping table is obtained, and the target execution instruction associated with the position information is determined according to the preset mapping table. The target execution instruction is executed, and the preset permission filter condition is added to the first syntax tree, so as to obtain the second syntax tree after permission filtering. According to the permission filter condition, the user can be filtered for permissions. If the permission filter condition is a department, the permission filtering is performed according to the department, and the permission scope of each department is limited according to the permission filter condition.

[0073] This embodiment adds permission filtering conditions to the first syntax tree to obtain a second syntax tree, so that data can be efficiently filtered through the second syntax tree, further improving the filtering efficiency of data permissions.

[0074] In some embodiments of the present application, the steps of obtaining a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree include:

[0075] When the location information is a subquery, parsing the permission filtering request, obtaining a central field for permission control, and determining whether the central field exists in the subquery;

[0076] When the pivot field exists in the subquery, adding the pivot field and the permission filtering condition to the first syntax tree;

[0077] When the pivot field does not exist in the subquery, the alias of the subquery is searched, and the permission filtering condition is added to the first syntax tree according to the alias.

[0078] In this embodiment, a SELECT-FROM-WHERE statement in SQL is called a query block. When obtaining a query answer requires multiple steps, first creating a query to determine a value unknown to the user but contained in the database, a query block is nested within the WHERE clause or HAVING clause of another query block. This query block is called a subquery or inner query. The upper query block is the parent query or outer query. The results of the subquery are passed back to the parent query or outer query as input. A subquery is essentially a complete SELECT statement.

[0079] When the location information is a subquery, it means that the pivot table is located in the subquery. However, for the pivot table in the syntax tree, not all pivot tables have corresponding pivot fields. Therefore, when the location information is a subquery, the permission filtering request is parsed to obtain the pivot field of permission control. The pivot field can be the same as the target field, and it is determined whether the pivot field exists in the subquery. If the pivot field exists in the subquery, the pivot field and the preset permission filtering condition are added to the first syntax tree; if the pivot field does not exist in the subquery, the alias of the subquery is found, and the permission filtering condition is added to the first syntax tree according to the alias.

[0080] This embodiment adds the permission filtering condition to the first syntax tree, thereby achieving accurate addition of the permission filtering condition in the first syntax tree and improving the accuracy of filtering data using the permission filtering condition.

[0081] In some embodiments of the present application, the steps of obtaining a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree further include:

[0082] When the location information is a common query, the permission filtering condition is added to the where statement of the common query.

[0083] In this embodiment, a normal query refers to a query other than a subquery. When the central table exists in the normal query, the preset permission filtering condition is directly added to the where statement of the normal query.

[0084] This embodiment directly adds permission filtering conditions to ordinary queries during ordinary queries, thereby realizing the addition of permission filtering conditions for statements in different positions, saving the time of data permission filtering and improving the accuracy of data permission filtering.

[0085] In some embodiments of the present application, after the target database statement is parsed to generate the first syntax tree, the following steps are included:

[0086] Determining whether the first syntax tree is a combination of multiple statement result sets;

[0087] When the first syntax tree is the combination, the combination is split into multiple separate target sentences, and the pivot table is detected based on the target sentences.

[0088] In this embodiment, in the database, Union is used to merge the result sets of two or more SELECT statements in SQL. The statement result set is the result set after the execution of multiple SELECT statements. If the first syntax tree is a combination of multiple statement result sets, the combination is split into multiple separate target statements, that is, multiple separate SELECT statements are obtained by splitting. When detecting whether there is a hub table in the first syntax tree, the first syntax tree is detected based on the target statement.

[0089] This embodiment improves the efficiency of data permission filtering by splitting the first syntax tree when the first syntax tree includes multiple statement results.

[0090] In some embodiments of the present application, determining whether a central table carrying user authority information exists in the first syntax tree includes:

[0091] Obtain the target field corresponding to the target database statement;

[0092] detecting whether a user table including the target field exists in the first syntax tree, and determining whether the pivot table exists in the first syntax tree when the user table exists;

[0093] When the user table does not exist, it is determined that the pivot table does not exist in the first syntax tree.

[0094] In this embodiment, the central table is a user table including a target field. When the target database statement is obtained, the target field corresponding to the current target database statement is obtained. The target field is a pre-set permission filter field. The target field can be obtained by obtaining field information associated with the target database statement or parsing the permission filter request. It is detected whether there is a user table including the target field in the current first syntax tree. When the user table exists in the first syntax tree, it is determined that there is a central table in the first syntax tree. At this time, according to the central table detected by the target field, the target field is the central field of the central table; when the user table does not exist in the first syntax tree, it is determined that there is no central table in the first syntax tree.

[0095] Taking the pre-set permission filtering field as "Department A" as an example, the permission filtering field is carried as the target field in the permission filtering request. When the first syntax tree generated by the target database statement is obtained, the permission filtering request is parsed to obtain the target field; when the target field is obtained, it is detected whether there is a user table including the target field in the first syntax tree, that is, it is detected whether there is a user table including the "Department A" field in the first syntax tree. If there is a user table including the "Department A" field, it is determined that there is a central table in the first syntax tree; if there is no user table including the "Department A" field, it is determined that there is no central table in the first syntax tree.

[0096] In addition, since not all hub tables have hub fields, when detecting the hub table through the target field, only the hub table with the target field as the hub field can be detected. For tables that cannot be detected based on the target field but are also hub tables, the position of the user table can be used to determine whether the user table is a hub table. If the position of the user table is a pre-marked target position, the user table is determined to be a hub table; if the position of the user table is not a pre-marked target position, the user table is determined not to be a hub table.

[0097] This embodiment determines the central table so that even for complex SQL statements, data can be efficiently filtered through the central table, further improving the efficiency of data permission filtering.

[0098] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware via computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0099] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0100] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a data authority filtering device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0101] like Figure 3 As shown, the data authority filtering device 300 of this embodiment includes: a parsing module 301, a screening module 302, a confirmation module 303 and a splicing module 304. Among them:

[0102] The parsing module 301 is configured to obtain a target database statement from a target database upon receiving a permission filtering request, and parse the target database statement to generate a first syntax tree;

[0103] The parsing module 301 includes:

[0104] A generating unit, configured to generate a configuration file according to the target database statement and obtain a preset interceptor;

[0105] A parsing unit is configured to load the configuration file based on the preset interceptor, and parse the configuration file through a processing layer of the preset interceptor to obtain the first syntax tree.

[0106] In this embodiment, the target database statement is a SQL (Structured Query Language) database statement. When a permission filtering request is received, the permission filtering request is parsed to obtain the target database and all statements in the target database statement that need to be permission filtered. The statement is the target database statement. When the target database statement is obtained, the target database statement is parsed to generate a first syntax tree. Specifically, the first syntax tree is an abstract syntax tree (i.e., abstract syntax code, AST). The abstract syntax tree is a tree representation of the abstract syntax structure of the source code, and each node on the tree represents a structure in the source code. When the target database statement is obtained, the target database statement is subjected to lexical analysis and syntactic analysis to generate a first syntax tree corresponding to the target database statement.

[0107] A screening module 302 is configured to screen the first syntax tree to determine whether a central table carrying user authority information exists in the first syntax tree;

[0108] The screening module 302 includes:

[0109] An acquisition unit, configured to acquire a target field corresponding to the target database statement;

[0110] a first detection unit, configured to detect whether a user table including the target field exists in the first syntax tree, and determine whether the pivot table exists in the first syntax tree when the user table exists;

[0111] The second detection unit is configured to determine that the pivot table does not exist in the first syntax tree when the user table does not exist.

[0112] In this embodiment, the pivot table is a table that carries information related to user permissions in data queries. For example, the user table carries a "department ID" field, and the permission system needs to perform permission control by department. If this user table appears in the SQL statement, then this table is the pivot table in the SQL statement, and this "department ID" is called the "pivot field". The pivot table can appear after the From statement, or after the Join statement, and is even allowed to appear in a subquery. When the first syntax tree is obtained, the target field corresponding to the target database statement is obtained. The target field can be obtained through the field information pre-associated with the target database statement, or by parsing the permission filtering request. According to the target field, the target database statement can be filtered for permissions, such as filtering the target database statement for permissions according to fields such as age or department. When the first syntax tree generated by the target database statement is obtained, the target field can be determined by querying the field associated with the target database statement or parsing the permission filtering request. Then, determine whether there is a user table including the target field in the first syntax tree. If the user table exists, determine that there is a pivot table in the first syntax tree; if the user table does not exist, determine that there is no pivot table in the first syntax tree.

[0113] A confirmation module 303 is configured to determine whether a target permission filtering identifier exists in the first syntax tree when the pivot table does not exist in the first syntax tree;

[0114] In this embodiment, if the central table does not exist in the first syntax tree, it is determined whether there is a target permission filter identifier in the first syntax tree, wherein the target permission filter identifier is the identification information of the syntax tree that requires a permission filter statement (such as the preset target permission filter identifier is 99). The preset identification table is obtained, and the first syntax tree is traversed according to the preset identification table to determine whether there is an identification field in the first syntax tree that is consistent with the current preset identification table. If so, it is determined that the target permission filter identifier exists in the first syntax tree; if not, it is determined that the target permission filter identifier does not exist in the first syntax tree.

[0115] The splicing module 304 is used to obtain a newly established central table when the target permission filtering identifier exists in the first syntax tree, and add the new central table and the preset permission filtering condition to the first syntax tree to obtain a second syntax tree after permission filtering.

[0116] In this embodiment, the permission filtering condition is a pre-set data filtering condition. The permission filtering condition can be composed of a plurality of target fields, or a target field can be used as the permission filtering condition, and the data can be filtered according to the permission filtering condition. When the target permission filtering identifier exists in the first syntax tree, a new central table is obtained, and the new central table is a pre-established user table including user permission information. The new central table and the preset permission filtering condition are added to the where condition of the top-level query statement of the first syntax tree to obtain a second syntax tree after permission filtering. Thus, permission filtering of the target database statement is realized according to the second syntax tree.

[0117] It should be emphasized that in order to further ensure the privacy and security of the second syntax tree, the second syntax tree can also be stored in a node of a blockchain.

[0118] The blockchain referred to in this application is a new application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0119] The data authority filtering device proposed in this embodiment also includes:

[0120] an acquisition module, configured to acquire location information of the pivot table when the pivot table exists in the first syntax tree;

[0121] An execution module is used to obtain a target splicing instruction according to the position information, execute the target splicing instruction, add a preset permission filtering condition to the first syntax tree, and obtain a second syntax tree after permission filtering.

[0122] In this embodiment, if there is a central table in the first syntax tree, the position information of the central table is obtained. The position information is the position of the current central table in the first syntax tree. Different position information corresponds to different target splicing instructions. When the position information is obtained, a preset mapping table is obtained, and the target execution instruction associated with the position information is determined according to the preset mapping table. The target execution instruction is executed, and the preset permission filter condition is added to the first syntax tree, so as to obtain the second syntax tree after permission filtering. According to the permission filter condition, the user can be filtered for permissions. If the permission filter condition is a department, the permission filtering is performed according to the department, and the permission scope of each department is limited according to the permission filter condition.

[0123] A judgment module, configured to determine whether the first syntax tree is a combination of multiple statement result sets;

[0124] A splitting module is used to split the combination into multiple separate target sentences when the first syntax tree is the combination, and detect the pivot table based on the target sentences.

[0125] In this embodiment, in the database, Union is used to merge the result sets of two or more SELECT statements in SQL. The statement result set is the result set after the execution of multiple SELECT statements. If the first syntax tree is a combination of multiple statement result sets, the combination is split into multiple separate target statements, that is, multiple separate SELECT statements are obtained by splitting. When detecting whether there is a hub table in the first syntax tree, the first syntax tree is detected based on the target statement.

[0126] The execution module includes:

[0127] a confirmation unit, configured to parse the permission filtering request when the location information is a subquery, obtain a central field for permission control, and determine whether the central field exists in the subquery;

[0128] A first splicing unit is configured to add the pivot field and the permission filtering condition to the first syntax tree when the pivot field exists in the subquery;

[0129] The second splicing unit is used to find the alias of the subquery when the pivot field does not exist in the subquery, and add the permission filtering condition to the first syntax tree according to the alias.

[0130] In this embodiment, a SELECT-FROM-WHERE statement in SQL is called a query block. When obtaining a query answer requires multiple steps, first creating a query to determine a value unknown to the user but contained in the database, a query block is nested within the WHERE clause or HAVING clause of another query block. This query block is called a subquery or inner query. The upper query block is the parent query or outer query. The results of the subquery are passed back to the parent query or outer query as input. A subquery is essentially a complete SELECT statement.

[0131] When the location information is a subquery, it means that the pivot table is located in the subquery. However, for the pivot table in the syntax tree, not all pivot tables have corresponding pivot fields. Therefore, when the location information is a subquery, the permission filtering request is parsed to obtain the pivot field of permission control. The pivot field can be the same as the target field, and it is determined whether the pivot field exists in the subquery. If the pivot field exists in the subquery, the pivot field and the preset permission filtering condition are added to the first syntax tree; if the pivot field does not exist in the subquery, the alias of the subquery is found, and the permission filtering condition is added to the first syntax tree according to the alias.

[0132] The third splicing unit is used to add the permission filtering condition to the where statement of the ordinary query when the location information is an ordinary query.

[0133] In this embodiment, a normal query refers to a query other than a subquery. When the central table exists in the normal query, the preset permission filtering condition is directly added to the where statement of the normal query.

[0134] The data authority filtering device proposed in this embodiment realizes automatic filtering of data authorities in a database, saves the time of data authority filtering, and improves the filtering efficiency and filtering capability of data authorities.

[0135] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0136] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 6 with components 61-63, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0137] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0138] The memory 61 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as the hard disk or memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (SMC), a secure digital (SD) card, a flash card, etc. Of course, the memory 61 can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store the operating system and various application software installed on the computer device 6, such as computer-readable instructions of the data permission filtering method. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or are to be output.

[0139] In some embodiments, the processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to execute computer-readable instructions stored in the memory 61 or process data, such as computer-readable instructions for executing the data permission filtering method.

[0140] The network interface 63 may include a wireless network interface or a wired network interface. The network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0141] The computer device proposed in this embodiment realizes automatic filtering of data permissions in a database, saves the time of data permission filtering, and improves the filtering efficiency and filtering capability of data permissions.

[0142] The present application also provides another embodiment, namely, providing a computer-readable storage medium, which stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the data permission filtering method as described above.

[0143] The computer-readable storage medium proposed in this embodiment realizes automatic filtering of data permissions in a database, saves the time of data permission filtering, and improves the filtering efficiency and filtering capability of data permissions.

[0144] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0145] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A data authority filtering method, characterized in that: The steps include: When receiving a permission filtering request, obtaining a target database statement from a target database, parsing the target database statement to generate a first syntax tree; Screening the first syntax tree to determine whether a central table carrying user authority information exists in the first syntax tree; When the pivot table does not exist in the first syntax tree, determining whether a target permission filtering identifier exists in the first syntax tree; When the target permission filtering identifier exists in the first syntax tree, obtaining a newly established central table, and adding the new central table and a preset permission filtering condition to the first syntax tree to obtain a second syntax tree after permission filtering; Wherein, the first syntax tree is an abstract syntax tree; The determining whether a central table carrying user authority information exists in the first syntax tree includes: Obtain the target field corresponding to the target database statement; detecting whether a user table including the target field exists in the first syntax tree, and determining whether the pivot table exists in the first syntax tree when the user table exists; When the user table does not exist, determining that the pivot table does not exist in the first syntax tree; Among them, for a table that cannot be detected according to the target field but is also a hub table, whether the user table is a hub table is determined by the position of the user table. If the position of the user table is the pre-marked target position, the user table is determined to be a hub table; if the position of the user table is not the pre-marked target position, the user table is determined not to be a hub table; Wherein, after the step of parsing the target database statement to generate a first syntax tree, the method includes: Determining whether the first syntax tree is a combination of multiple statement result sets; When the first syntax tree is the combination, splitting the combination into multiple separate target sentences, and detecting the pivot table based on the target sentences; Among them, in the database, Union is used to merge the result sets of executing two or more SELECT statements in SQL. The statement result set is the result set after executing multiple SELECT statements; if the first syntax tree is a combination of multiple statement result sets, the combination is split into multiple separate target statements, that is, multiple separate SELECT statements are obtained; when detecting whether there is a central table in the first syntax tree, the first syntax tree is detected based on the target statement.

2. The data authority filtering method according to claim 1, characterized in that: The parsing of the target database statement to generate a first syntax tree includes: Generate a configuration file based on the target database statement and obtain a preset interceptor; The configuration file is loaded based on the preset interceptor, and the configuration file is parsed by the processing layer of the preset interceptor to obtain the first syntax tree.

3. The data authority filtering method according to claim 1, characterized in that: After the step of determining whether a central table carrying user authority information exists in the first syntax tree, the method further includes: When the pivot table exists in the first syntax tree, obtaining location information of the pivot table; A target splicing instruction is acquired according to the position information, the target splicing instruction is executed, and a preset permission filtering condition is added to the first syntax tree to obtain a second syntax tree after permission filtering.

4. The data authority filtering method according to claim 3, characterized in that: The acquiring a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree includes: When the location information is a subquery, parsing the permission filtering request, obtaining a central field for permission control, and determining whether the central field exists in the subquery; When the pivot field exists in the subquery, adding the pivot field and the permission filtering condition to the first syntax tree; When the pivot field does not exist in the subquery, the alias of the subquery is searched, and the permission filtering condition is added to the first syntax tree according to the alias.

5. The data authority filtering method according to claim 3, characterized in that: The step of acquiring a target splicing instruction according to the location information, executing the target splicing instruction, and adding a preset permission filtering condition to the first syntax tree further includes: When the location information is a common query, the permission filtering condition is added to the where statement of the common query.

6. A data authority filtering device, characterized in that: include: A parsing module, configured to, upon receiving a permission filtering request, obtain a target database statement from a target database, parse the target database statement, and generate a first syntax tree; A screening module, configured to screen the first syntax tree to determine whether a central table carrying user authority information exists in the first syntax tree; a confirmation module, configured to determine whether a target permission filtering identifier exists in the first syntax tree when the pivot table does not exist in the first syntax tree; a splicing module configured to obtain a newly established central table when the target permission filtering identifier exists in the first syntax tree, and add the new central table and the preset permission filtering condition to the first syntax tree to obtain a second syntax tree after permission filtering; Wherein, the first syntax tree is an abstract syntax tree; The screening module includes: An acquisition unit, configured to acquire a target field corresponding to the target database statement; a first detection unit, configured to detect whether a user table including the target field exists in the first syntax tree, and determine whether the pivot table exists in the first syntax tree when the user table exists; a second detection unit, configured to determine that the pivot table does not exist in the first syntax tree when the user table does not exist; Among them, for a table that cannot be detected according to the target field but is also a hub table, whether the user table is a hub table is determined by the position of the user table. If the position of the user table is the pre-marked target position, the user table is determined to be a hub table; if the position of the user table is not the pre-marked target position, the user table is determined not to be a hub table; The data authority filtering device further includes: a judgment module for determining whether the first syntax tree is a combination of multiple statement result sets; a splitting module for splitting the combination into multiple separate target statements when the first syntax tree is the combination, and detecting the pivot table based on the target statements; Among them, in the database, Union is used to merge the result sets of executing two or more SELECT statements in SQL. The statement result set is the result set after executing multiple SELECT statements; if the first syntax tree is a combination of multiple statement result sets, the combination is split into multiple separate target statements, that is, multiple separate SELECT statements are obtained; when detecting whether there is a central table in the first syntax tree, the first syntax tree is detected based on the target statement.

7. A computer device comprising a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the data permission filtering method according to any one of claims 1 to 5 when executing the computer-readable instructions.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the data authority filtering method according to any one of claims 1 to 5.

Images