A view-based query method and apparatus

Abstract

This application provides a view-based query method and apparatus. The method includes: a business middleware receiving a first query request sent by a user; the business middleware determining a view corresponding to each sub-query in the first query request; the business middleware determining from a view record whether the user has query permission for a first view; the view record recording view information and sub-database table information of each view authorized based on historical query requests; the sub-database table indicated by the sub-database table information storing the query results of the corresponding view; the first view being any one of the views corresponding to each sub-query; and the business middleware obtaining the query results based on the sub-database tables of the views corresponding to each sub-query when the user has query permission for the views corresponding to each sub-query. This method is used to customize authorization permissions and address the security risks associated with excessively broad authorization permissions.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a view-based query method and apparatus. Background Technology

[0002] In recent years, with the development of computer technology, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, higher demands are being placed on technology. For example, Hive is a data warehouse tool based on Hadoop, used for data extraction, transformation, and loading. It's a mechanism for storing, querying, and analyzing large-scale data stored in Hadoop. The Hive data warehouse tool can map structured data files to a database table and provide SQL query functionality, transforming SQL statements into MapReduce tasks for execution. Thus, using Hive enables low-cost learning and allows for fast MapReduce statistics through SQL-like statements, simplifying MapReduce without the need to develop dedicated MapReduce applications. In today's financial industry with its massive increase in data, this effectively alleviates the pressure of data statistical processing, reduces data statistical processing costs, and accelerates the speed and accuracy of data statistical processing.

[0003] However, this data warehouse tool has a significant technical flaw: when a user retrieves a Hive view, if the user does not have query permissions for that view, authorization must be granted to the underlying database tables on which the view depends. In most cases, the information in the underlying database tables is far greater than the information in the view retrieved by the user. Therefore, if a user retrieves a view, permissions to the underlying database tables must be granted to the user, posing a security risk to the information in the underlying database tables.

[0004] Therefore, there is an urgent need for a view-based query method and device to customize authorization permissions and solve the security risks of excessive authorization permissions. Summary of the Invention

[0005] This application provides a view-based query method and apparatus for customizing authorization permissions, thereby addressing the security risks associated with excessively large authorization permissions.

[0006] In a first aspect, embodiments of this application provide a view-based query method, the method comprising:

[0007] The business middleware receives the first query request sent by the user.

[0008] The business middleware determines the view corresponding to each sub-query based on each sub-query in the first query request;

[0009] The business middleware determines from the view record whether the user has query permission for the first view; the view record is used to record view information and sub-database table information of each view that has been authorized based on historical query requests; the sub-database table indicated by the sub-database table information is used to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query;

[0010] When the user has query permissions for the views corresponding to each subquery, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each subquery.

[0011] In the above method, the business middleware determines the view corresponding to each subquery in the first query request. It then determines any view among the views corresponding to each subquery based on the authorized view information in the view record and the corresponding sub-database table information, and checks whether the user has query permissions for the first view. If not, it further grants the user permission to query the first view. This ensures the specificity of the user's query permission authorization scope, solving the problem of excessive authorization scope and security vulnerabilities in the underlying database tables caused by authorization in existing technologies.

[0012] Optionally, it also includes: for a second view that the user does not have query permission for, the business middleware generates the second view and generates a sub-database table corresponding to the second view; after obtaining the user's query permission for the second view, the view information of the second view and the sub-database table information corresponding to the second view are recorded in the view record;

[0013] When the user has query permissions for the views corresponding to each subquery, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each subquery.

[0014] In the above method, if any view in the view corresponding to each subquery is determined based on the authorized view information and the corresponding sub-database table information in the view record, and an unauthorized second view is found, then query permissions are obtained for that second view. The view information of the second view and the corresponding sub-database table information are recorded in the view record. When the user has query permissions for the views corresponding to each subquery, the query results are returned based on the sub-database tables of the views corresponding to each subquery. The sub-database table of the second view is generated in the base database, and the second view is generated based on the sub-database table and stored in the middleware database. In this way, when the user makes repeated requests, the second view can be returned directly, saving view generation time and speeding up view generation. Correspondingly, for the same view or the same data range, multiple queries only need to look up the sub-database table corresponding to the view or the data range, without having to look up the base database table, greatly improving query efficiency. Furthermore, it can also improve the efficiency of executing queries when complex scripts are running. Complex scripts can be simply understood as implementing multiple query tasks in one script or by merging them into one query.

[0015] Optionally, query results can be obtained based on the sub-tables of the view corresponding to each subquery, including:

[0016] The business middleware updates the database table involved in any subquery in the first query request to the view identifier of the corresponding view, and obtains the second query request.

[0017] The business middleware obtains query results from the sub-database tables corresponding to the views of each sub-query based on the second query request.

[0018] In the above method, after the user is authorized—that is, after determining that the user has query permissions for the views corresponding to each subquery in the first query request—the database tables of the views in each subquery are updated with the view identifier of that view, resulting in a second query request. Based on this second query request, the result information from the sub-database table corresponding to the view is returned. This ensures that the view results are quickly obtained based on the sub-database table and returned to the user.

[0019] Optionally, the user's query permissions for the second view can be obtained through the following methods:

[0020] The business middleware generates a view authorization request and sends it to the authorization end. The view authorization request contains the view information of the second view.

[0021] The business middleware receives an authorization approval message sent by the authorization terminal, the authorization approval message being used to instruct the authorization terminal to authorize the user to query the second view.

[0022] In the above method, the business middleware can generate a view authorization request for view information that the user does not have query permissions for, and send it to the authorization end. After the administrator on the authorization end authorizes the view, the business middleware receives an authorization approval message returned by the authorization end. In this way, the business middleware determines that the user has query permissions for the view that they previously did not have, and can return the view to the user.

[0023] Optionally, the business middleware determines whether the user has query permissions for the first view from the view records, including:

[0024] For any third view in the view record, if the business middleware determines that the user has query permission for the first view and query permission for the third view when the database table of the third view contains the database table of the first view, the key fields of the third view contain the key fields of the first view, and the restrictions of the third view are less than the restrictions of the first view, the user has query permission for the third view.

[0025] In the above method, the third view, which shares a base database table with the first view, is queried based on the view information of the first view. The third view and the first view are likely to have the same information. Therefore, if the key fields of the third view contain information greater than or equal to that of the first view (e.g., the second view contains students' class, name, gender, and grades, while the first view contains students' class and / or name and / or gender and / or grades), and the restrictions are less stringent than those of the first view (e.g., the third view contains the class, name, gender, and grades of students from the 2021 and 2020 graduating classes, while the first view contains the class and / or name and / or gender and / or grades of students from the 2020 graduating class), then it can be determined that if a user has query permissions for the third view, the first view and its corresponding sub-tables can be generated based on the third view and its corresponding database table or sub-table, and the query results for the first view can be returned. In this way, repeated authorization is unnecessary, and the scope of authorization can be expanded to obtain the queried view.

[0026] Secondly, embodiments of this application provide a view-based query device, the device comprising:

[0027] The transceiver module is used to receive the first query request sent by the user;

[0028] The processing module is used to determine the view corresponding to each subquery based on each subquery in the first query request;

[0029] The processing module is further configured to determine from the view record whether the user has query permission for the first view; the view record is configured to record view information and sub-database table information of each view that has been authorized based on historical query requests; the sub-database table indicated by the sub-database table information is configured to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query;

[0030] The processing module is also used to obtain query results based on the sub-database tables of the views corresponding to each subquery when the user has query permissions for the views corresponding to each subquery.

[0031] Optional, also includes:

[0032] For the second view for which the user does not have query permissions, the processing module is further configured to generate the second view and generate a sub-database table corresponding to the second view; after obtaining the user's query permissions for the second view, record the view information of the second view and the sub-database table information corresponding to the second view in the view record;

[0033] The processing module is also used to obtain query results based on the sub-database tables of the views corresponding to each subquery when the user has query permissions for the views corresponding to each subquery.

[0034] Optionally, query results can be obtained based on the sub-tables of the view corresponding to each subquery, including:

[0035] The processing module is specifically used to update the database table involved in any subquery in the first query request to the view identifier of the corresponding view, thereby obtaining the second query request;

[0036] The processing module is specifically used to obtain query results from the sub-database tables corresponding to the views of each sub-query based on the second query request.

[0037] Thirdly, embodiments of this application also provide a computing device, including: a memory for storing a program; and a processor for calling the program stored in the memory and executing the method described in various possible designs of the first aspect according to the obtained program.

[0038] Fourthly, embodiments of this application also provide a computer-readable non-volatile storage medium including a computer-readable program that, when read and executed by a computer, causes the computer to perform the method described in various possible designs of the first aspect.

[0039] These or other implementations of this application will become clearer and easier to understand in the following description of the embodiments. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A schematic diagram of the architecture of a view-based query system provided in an embodiment of this application;

[0042] Figure 2 A flowchart illustrating a view-based query method provided in an embodiment of this application;

[0043] Figure 3 A flowchart illustrating a view-based query method provided in an embodiment of this application;

[0044] Figure 4 This is a schematic diagram of a view-based query device provided in an embodiment of this application. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] Figure 1 This is a schematic diagram of the architecture of a view-based query system provided in an embodiment of this application. The user system 101 can be any system with a human-computer interaction interface, such as the business system, subsystem, system component, etc. of various enterprises, and there are no specific limitations here.

[0047] Furthermore, the business middleware 102 can connect to one or more user systems 101. The business middleware 102 receives a first query request generated from a user system 101 based on view information submitted by the user. Based on the view information corresponding to each subquery in the first query request, it determines whether the user has query permissions for each view. The view record contains the view information, the corresponding sub-database table information, and the authorization information of the user corresponding to the view.

[0048] If, based on the first query request and the view records in the middleware database 103, the business middleware 102 determines that the first query request contains a first view, the view records contain a third view, the database table of the third view contains the database table of the first view, the key fields of the third view contain the key fields of the first view, the restrictions of the third view are fewer than those of the first view, and the user has query permissions for the third view, then the business middleware 102 can generate a sub-table of the first view based on the database table of the third view in the base database 104, store the sub-table of the first view in the base database 104, and store the records of the first view in the view records. The query results of the first view are then returned to the user system 101.

[0049] If the business middleware 102 determines, based on the first query request and the view records in the middleware database 103, that a second view exists in the first query request (i.e., a second view exists, but there is no corresponding third view in the view records, such as the one the user has query permissions for), then the business middleware 102 generates a view authorization request based on the view information of the second view and sends the view authorization request to the authorization end. The authorization end can be the administrator system in the user system 101, which can display the relevant information in the view authorization request on the administrator interface to obtain administrator authorization. The authorization end can also be a subsystem, system component, another user system, business system, etc., in the user system 101. The authorization end can be configured according to business needs, and it only needs to be able to authorize query permissions for the second view queried by the user; there are no specific restrictions on the specific authorization end. After authorization at the authorization end, the business middleware 102 receives the authorization approval message for the second view returned by the authorization end. The business middleware 102 also generates the second view's sub-table based on the basic database tables / database tables / sub-tables in the basic database 104 (any database table in the basic database 104 containing the data required for the second view can be generated from the basic database tables, database tables, and sub-tables in the basic database 104; the data source for the second view's sub-table can be set as needed, without specific restrictions. For example, if the basic database tables in the basic database 104 have the largest data volume, followed by the database tables, and the sub-tables have the smallest (this description of the data volume in the database tables is just an assumption; the data volume in the sub-tables can be equal to or greater than the data volume in the database tables), then the second view's sub-table can be generated based on the sub-table. Because the sub-table has a small data volume, the generation speed of the second view's sub-table can be accelerated). The middleware database 103 then adds a record for the second view, containing the view information, sub-table information, and authorization information, to the view record. The query results of the second view are then returned to the user system 101.

[0050] Furthermore, the business middleware 102 receives the first query request initiated by a user in the user system 101. If the user does not have query permissions for any of the views corresponding to the subqueries in the first query request, or if the user does not have query permissions for some of the views corresponding to the subqueries in the first query request, the business middleware 102 can notify the user to complete the authorization after receiving the authorization notification message for the views for which the user does not have query permissions. The user can initiate the first query request in the user system 101. After receiving the first query request, the business middleware 102 replaces the database table names of each subquery in the first query request with the corresponding sub-database table names according to the view records to obtain a second query request. The business middleware 102 then executes the query according to the second query request to obtain the query results, returns them to the user system 101, and displays the query results to the user.

[0051] Based on the above system architecture, embodiments of this application provide a flow chart for a view-based query method, such as... Figure 2 As shown, it includes:

[0052] Step 201: The business middleware receives the first query request sent by the user;

[0053] Here, the first query request may contain SQL (Structured Query Language) statements, which may contain at least one subquery, each subquery querying a view. The subquery may contain the database table name of the view, the field attributes of the view, and the constraints of the database table on which the view is based, and may also contain the SQL statement that generates the view. There are no specific restrictions on the view information included in the subqueries.

[0054] In one example, subquery t1 could contain the database table name: student, view field attributes: uid, id, user_name, user_age, id_card, phone, create_time, update_time, and the constraint condition of the database table on which the view is based: where create_time >= '2020-08-01 00:00:00'

[0055] and create_time<='2020-10-01 00:00:00'.

[0056] The subquery t2 can include the database table name: class, view field attributes: id, user_name, uid, course_id, course_name, status, create_time, update_time, and the constraint condition of the database table on which the view is based: where ds>'20210901'

[0057] and ds<'20210930'order by id desc.

[0058] Step 202: The business middleware determines the view corresponding to each sub-query based on each sub-query in the first query request;

[0059] Here, the view corresponding to the subquery is the view described by the view information in the subquery.

[0060] In the example above, the view dv1 described by the view information in subquery t1 is the data information of the corresponding field attributes of student name, age, student ID, and phone number in the student information table, with creation time between August 1 and October 1, 2020.

[0061] The view dv2 described by the view information in subquery t2 is the data information of the corresponding field attributes teacher name, course number, course name, and number of students in the class information table, created between September 1 and September 30, 2021.

[0062] Step 203: The business middleware determines from the view record whether the user has query permission for the first view; the view record is used to record the view information of each view that has been authorized based on historical query requests and the sub-database table information of each view; the sub-database table indicated by the sub-database table information is used to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query;

[0063] Step 204: When the user has query permissions for the views corresponding to each subquery, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each subquery.

[0064] In the above method, the business middleware determines the view corresponding to each subquery in the first query request. It further determines any view among the views corresponding to each subquery based on the authorized view information in the view record and the sub-database table information corresponding to the view, and determines whether the user has query permissions for the first view. If not, it grants the user permission to query the first view. This ensures the specificity of the user's query permission authorization scope, solving the problem of excessive authorization scope and security vulnerabilities in the underlying database tables caused by authorization in existing technologies.

[0065] This application provides a view-based query method, further comprising: for a second view that the user does not have query permissions for, the business middleware generates the second view and generates a sub-database table corresponding to the second view; after obtaining the user's query permissions for the second view, the middleware records the view information of the second view and the sub-database table information corresponding to the second view in the view record; when the user has query permissions for the views corresponding to each sub-query, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each sub-query. In other words, there are two cases for querying the views corresponding to the sub-queries of the first query request: one is that the view corresponding to the sub-query is a view that the user does not have query permissions for—the second view. The method for determining the second view includes: for views in the view record where the user has query permissions, there are no database tables in each of these views that are identical to the database tables of the second view (the database tables corresponding to each view in the view record are all different from the database tables of the second view); / there are database tables in the view record that are identical to the database tables of the second view, but the number of field attributes in the view information corresponding to the identical database table is less than the number of field attributes in the view information of the second view; / the field attributes in the view information corresponding to the identical database table include the field attributes in the view information of the second view, but the restrictions in the view information corresponding to the identical database table are more than the restrictions in the view information of the second view. In other words, the database tables in the view record where the user has query permissions cannot provide the data required by the second view. Therefore, it is necessary to obtain the user's query permissions for the second view, generate the records and sub-tables of the second view, and return the query results to the user after obtaining the user's query permissions for the second view. Alternatively, if the user has query permissions for the base database table, the sub-tables of the second view can be generated directly, and the query results can be returned without repeated authorization from the authorizing end. Specifically, the view information of the second view and the corresponding sub-database table information are stored as records of the second view in the view record, and the corresponding sub-database table exists in the base database. Thus, subsequent queries targeting the second view, or multiple queries covering the same data range as the second view, only require searching the second view or the corresponding sub-database table, without needing to search the base database table, significantly improving query efficiency. Correspondingly, this also improves the efficiency of executing queries when running complex scripts. Complex scripts can be simply understood as implementing multiple query tasks in one script or merging them into a single query.

[0066] This application provides a view-based query method that obtains query results based on sub-database tables of the views corresponding to each sub-query. The method includes: the business middleware updating the database tables involved in any sub-query in the first query request to the view identifier of the corresponding view, thus obtaining a second query request; and the business middleware obtaining query results from the sub-database tables corresponding to the views of each sub-query based on the second query request. In other words, after the user obtains authorization to query the second view, the first query request is received, and the database table names in each sub-query of the first query request are replaced with view names to obtain the second query request. The query is then performed based on the second query request to obtain the query results. This allows the query results to be generated based on the sub-database tables of the second view, accelerating the generation of query results, improving query speed, and saving query access resources without accessing the underlying database tables.

[0067] In the example above, the subquery t1 in the first query request contains: "select * from (

[0068] After replacing "select uid,id,user_name,create_time from default.student", you get "select uid,id,user_name,create_time from dv1".

[0069] This application provides a view-based authorization method to obtain a user's query permission for a second view. The method includes: a business middleware generating a view authorization request and sending it to an authorization terminal; the view authorization request containing view information of the second view; and the business middleware receiving an authorization approval message from the authorization terminal, which instructs the authorization terminal to authorize the user's query permission for the second view. In other words, the view authorization request can contain view information of the second view, including its database tables, field attributes, and restrictions. Therefore, the view authorization request received by the authorization terminal is for the second view—a view for which the user does not have query permission. The authorization from the authorization terminal is specifically for the second view, and the returned authorization notification message also indicates authorization for the second view. Compared to prior art that authorizes only the base database table (the largest or most data-intensive base database table), this method can authorize only the second view queried by the user, effectively narrowing the scope of authorization permissions and ensuring the security of data in the base database. In the example above, if the view dv1 corresponding to subquery t1 is a second view—a view for which the user does not have query permissions—then the view authorization request includes the following: user identifier: user1; database table name of dv1: student; field attributes of dv1: uid, id, user_name, user_age, id_card, phone, create_time, update_time; and the constraint condition of the database table on which dv1 is based: where create_time >= '2020-08-01 00:00:00'.

[0070] and create_time<='2020-10-01 00:00:00'.

[0071] This application provides a view-based query method. The business middleware determines whether a user has query permissions for a first view from view records. This includes: for any third view in the view records, if the database table of the third view contains the database table of the first view, the key fields of the third view contain the key fields of the first view, and the restrictions of the third view are fewer than those of the first view, then the business middleware determines that the user has query permissions for the first view, and the user has query permissions for the third view. In other words, for a third view that the user has query permissions for, if the third view contains query information corresponding to the first view, then it can be determined that the user has query permissions for the first view.

[0072] Based on the above system architecture and method, the present application provides a flow of a view-based query method, as follows: Figure 3 As shown, it includes:

[0073] Step 301: Receive a first query request, which contains at least one subquery.

[0074] Step 302: Determine the view information corresponding to the view included in the subquery, including the database table, field attributes, and constraints of the view.

[0075] It should be noted here that including database tables, field attributes, and constraints in the view information is just an example; it can also include view types. The specific view information included in the subquery is not limited here.

[0076] Step 303: Determine whether the user has query permissions for the view corresponding to the subquery based on the view information and view records in the subquery. If not, proceed to step 304; if yes, proceed to step 308.

[0077] Here, determining whether a user has query permissions for the view corresponding to the subquery can be based on the database table, field attributes, and restrictions in the view information.

[0078] If the user has query permissions for the base database tables / if the user has query permissions for the third view in the view records, and the database table of the third view is the same as the database table of the view corresponding to the subquery, the field attributes of the third view contain the field attributes of the field corresponding to the subquery view, and the restrictions of the third view are fewer than the restrictions of the field corresponding to the subquery view, then it can be determined that the user has query permissions for the view corresponding to the subquery. A sub-database table and a view record (including sub-database table information, authorization information, and view information) for the view corresponding to the subquery can be generated, and the query results can be returned. Alternatively, if the database table of the third view is the same as the database table of the view corresponding to the subquery, the field attributes of the third view are equal to the field attributes of the field corresponding to the subquery view, and the restrictions of the third view are equal to the restrictions of the field corresponding to the subquery view, then the third view is directly used as the view corresponding to the subquery (thus avoiding repeated authorization for views with the same data range and redundant generation of sub-database tables, speeding up the query), and the query results are returned. Otherwise, if the view corresponding to the subquery does not meet any of the above conditions, it is determined that the user does not have query permissions for the view corresponding to the subquery, and query permissions for the user for the view corresponding to the subquery need to be obtained.

[0079] Step 304: Generate a view authorization request based on the view information of the view corresponding to the subquery.

[0080] Step 305: Send the view authorization request to the authorization end.

[0081] Step 306: Receive the authorization notification message returned by the authorization end, generate the sub-table of the view corresponding to the subquery and the records of the view (including view information, sub-table information, and authorization information). Associate the records of the view with the sub-table of the view.

[0082] Step 307: Receive the first query request.

[0083] In one example, the first query request might be obtained after the middleware sends an authorization completion message to the user, and the user then executes the query again. For instance, the user system's user interface could set up a task to request authorization progress when the user initiates the first query request and determines that there are views for which the user lacks authorization. This allows the user to track the view authorization progress in the first query request. Furthermore, if the view authorization progress is 100%, the user can re-initiate the first query request to obtain the query results. In another example, the first query request might only occur once. In this case, after determining that authorization for the view is granted, the middleware retrieves the query results based on the first query request and returns them to the user.

[0084] Step 308: Replace the database table name in the first query request with the sub-database table name of the view corresponding to the subquery to obtain the second query request.

[0085] Step 309: Execute the query based on the second query request to obtain the query results.

[0086] Step 310: Return the query results to the user.

[0087] Here, "return to user" can mean returning the query results to the user's user interface in the user's system, or it can be the user's client; there are no specific restrictions here.

[0088] Step 311: Obtain the view corresponding to the subquery and get the query results. Execute step 310.

[0089] Here, the view corresponding to the subquery is obtained as described in step 303 above, and will not be repeated here.

[0090] It should be noted that the above method flow is not unique. For example, steps 301 to 310 above represent the flow for users who do not have query permissions for the view in the first query request, while steps 301 to 303 and steps 311-308-310 above represent the flow for users who have query permissions for the view in the first query request. These two flows can be executed separately or simultaneously. Furthermore, if only one query request needs to be initiated regardless of whether the user has query permissions for the view corresponding to the subquery in the first query request, then step 307 can be omitted.

[0091] Based on the same concept, embodiments of the present invention provide a view-based query device. Figure 4 This is a schematic diagram of a view-based query device provided in an embodiment of this application, such as... Figure 4 The following are examples:

[0092] The transceiver module 401 is used to receive the first query request sent by the user;

[0093] Processing module 402 is used to determine the view corresponding to each subquery based on each subquery in the first query request;

[0094] The processing module 402 is further configured to determine from the view record whether the user has query permission for the first view; the view record is configured to record view information of each view that has been authorized based on historical query requests and sub-database table information of each view; the sub-database table indicated by the sub-database table information is configured to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query;

[0095] The processing module 402 is further configured to, when the user has query permissions for the views corresponding to each subquery, obtain query results based on the sub-database tables of the views corresponding to each subquery.

[0096] Optionally, for the second view for which the user does not have query permissions, the processing module 402 is further configured to generate the second view and generate the sub-database table corresponding to the second view; after obtaining the user's query permissions for the second view, record the view information of the second view and the sub-database table information corresponding to the second view in the view record; the processing module 402 is further configured to obtain the query results based on the sub-database table of the view corresponding to each sub-query when the user has query permissions for the view corresponding to each sub-query.

[0097] Optionally, the processing module 402 is specifically used to update the database table involved in any subquery in the first query request to the view identifier of the corresponding view, thereby obtaining a second query request; the processing module 402 is specifically used to obtain query results from the sub-database table corresponding to the view of each subquery based on the second query request.

[0098] Optionally, the processing module 402 is specifically used to generate a view authorization request and send it to the authorization end through the transceiver module 401, wherein the view authorization request contains the view information of the second view;

[0099] The transceiver module is specifically used to receive the authorization approval message sent by the authorization terminal, which is used to instruct the authorization terminal to authorize the user to query the second view.

[0100] Optionally, for any third view in the view record, the processing module 402 is specifically configured to determine that the user has query permission for the first view and the user has query permission for the third view when the database table of the third view contains the database table of the first view, the key fields of the third view contain the key fields of the first view, and the restrictions of the third view are less than the restrictions of the first view.

[0101] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0105] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A view-based query method, characterized by, The method includes: The business middleware receives the first query request sent by the user. The business middleware determines the view corresponding to each sub-query based on each sub-query in the first query request; The business middleware determines from the view record whether the user has query permission for the first view; the view record is used to record view information and sub-database table information of each view that has been authorized based on historical query requests; the sub-database table indicated by the sub-database table information is used to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query; When the user has query permissions for the views corresponding to each subquery, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each subquery. For the second view that the user does not have query permission for, the business middleware generates the second view and generates the sub-database table corresponding to the second view; after obtaining the user's query permission for the second view, the view information of the second view and the sub-database table information corresponding to the second view are recorded in the view record; When the user has query permissions for the views corresponding to each subquery, the business middleware obtains the query results based on the sub-database tables of the views corresponding to each subquery. The user's query permissions for the second view are obtained through the following methods: The business middleware generates a view authorization request and sends it to the authorization end. The view authorization request contains the view information of the second view. The business middleware receives an authorization approval message sent by the authorization terminal, the authorization approval message being used to instruct the authorization terminal to authorize the user to query the second view.

2. The method as described in claim 1, characterized in that, The query results are obtained from the sub-tables of the view corresponding to each subquery, including: The business middleware updates the database table involved in any subquery in the first query request to the view identifier of the corresponding view, and obtains the second query request. The business middleware obtains query results from the sub-database tables corresponding to the views of each sub-query based on the second query request.

3. The method as described in claim 1, characterized in that, The business middleware determines whether the user has query permissions for the first view from the view records, including: For any third view in the view record, if the business middleware determines that the user has query permission for the first view and query permission for the third view when the database table of the third view contains the database table of the first view, the key fields of the third view contain the key fields of the first view, and the restrictions of the third view are less than the restrictions of the first view, the user has query permission for the third view.

4. A view-based query device, characterized in that, The device includes: The transceiver module is used to receive the first query request sent by the user; The processing module is used to determine the view corresponding to each subquery based on each subquery in the first query request; The processing module is further configured to determine from the view record whether the user has query permission for the first view; the view record is configured to record view information and sub-database table information of each view that has been authorized based on historical query requests; the sub-database table indicated by the sub-database table information is configured to store the query results of the corresponding view; the first view is any one of the views corresponding to each sub-query; The processing module is also used to obtain query results based on the sub-database tables of the views corresponding to each subquery when the user has query permissions for the views corresponding to each subquery. For the second view for which the user does not have query permissions, the processing module is further configured to generate the second view and generate a sub-database table corresponding to the second view; after obtaining the user's query permissions for the second view, record the view information of the second view and the sub-database table information corresponding to the second view in the view record; The processing module is also used to obtain query results based on the sub-database tables of the views corresponding to each subquery when the user has query permissions for the views corresponding to each subquery. The user's query permissions for the second view are obtained through the following methods: A view authorization request is generated and sent to the authorization end, wherein the view authorization request contains the view information of the second view; The system receives an authorization approval message from the authorization terminal, which instructs the authorization terminal to grant the user query permissions for the second view.

5. The apparatus as described in claim 4, characterized in that, The query results are obtained from the sub-tables of the view corresponding to each subquery, including: The processing module is specifically used to update the database table involved in any subquery in the first query request to the view identifier of the corresponding view, thereby obtaining the second query request; The processing module is specifically used to obtain query results from the sub-database tables corresponding to the views of each sub-query based on the second query request.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when run on a computer, causes the computer to perform the method of any one of claims 1 to 3.

7. A computer device, characterized in that, include: Memory, used to store computer programs; A processor is configured to invoke a computer program stored in the memory and execute the method as described in any one of claims 1 to 3 according to the obtained program.

Images