Query Data Security Control Method and Device for Query Interface
By setting non-empty annotations in the query interface, obtaining and parsing permission groups, and performing group verification, the problems of redundancy and poor readability in the query interface are solved, and concise and efficient data security control and reusability of non-empty annotations are achieved.
Patent Information
- Application Number
- CN202111588097.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-23
- Publication Date
- 2025-07-29
- Estimated Expiration
- 2041-12-23
AI Technical Summary
In the prior art, when querying interfaces avoid full data queries, there are problems of code redundancy and poor readability, and multiple sets of non-empty judgments require hard coding implementation, lacking simple and reusable solutions.
By setting non-empty annotations in the query conditions, obtaining the field set with non-empty annotations, parsing the permission group of each field, and grouping judgments according to the permission group. If there are non-empty fields in all groups, the verification will not be passed, otherwise it will be passed.
It realizes data security control of zero code in the query interface, is easy to operate, strong readability, and non-empty annotations can be reused, improving development efficiency and operation and maintenance efficiency.
Smart Images
Figure CN114238933B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of automatic programming, and particularly to a method and device for query data security control of a query interface. Background Art
[0002] This section aims to provide background or context for the embodiments of the present invention described in the claims. The description herein is not admitted to be prior art merely by virtue of its inclusion in this section.
[0003] When developing a query interface at the backend, to avoid the situation where all query conditions are not passed in and all data is queried, and to ensure data security, it is necessary to perform non-null judgment on the passed-in parameters in the code of each query interface in a hard-coded manner, resulting in code redundancy and decreased code readability. Moreover, when there are multiple groups of non-null judgments (query can be performed as long as one group of constraints is satisfied), it is necessary to write multiple groups of non-null judgments with an OR relationship in the code in a hard-coded manner. Therefore, there is a need for a reusable, concise, and highly readable way to solve this problem currently. Summary of the Invention
[0004] Embodiments of the present invention provide a method for query data security control of a query interface, which is used to implement query data security control in the query interface, is convenient to operate, has strong readability, and is reusable. The method includes:
[0005] After receiving a query condition, obtain a field set with non-null annotations in the query condition;
[0006] Parse the permission group corresponding to each field in the field set;
[0007] Group all fields in the field set according to the permission group;
[0008] If there are non-null fields in all groups, determine that the permission verification fails; otherwise, determine that the permission verification passes.
[0009] Embodiments of the present invention also provide a method for query data security control of a query interface, which is used to implement visual configuration management for each service governance component in a microservice architecture in a financial business scenario and can take effect in real time. The method includes:
[0010] A field set acquisition module, configured to obtain a field set with non-null annotations in the query condition after receiving the query condition;
[0011] A permission group parsing module, configured to parse the permission group corresponding to each field in the field set;
[0012] A grouping module, configured to group all fields in the field set according to the permission group;
[0013] The permission judgment module is used to determine that the permission verification fails if there are non-empty fields in all groups; otherwise, determine that the permission verification passes.
[0014] An embodiment of the present invention further provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the query data security control method of the above query interface is implemented.
[0015] An embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the query data security control method of the above query interface is implemented.
[0016] An embodiment of the present invention further provides a computer program product. The computer program product includes a computer program. When the computer program is executed by a processor, the query data security control method of the above query interface is implemented.
[0017] In an embodiment of the present invention, after receiving a query condition, a field set with non-null annotations in the query condition is obtained; the permission group corresponding to each field in the field set is parsed; all fields in the field set are grouped according to the permission group; if there are non-empty fields in all groups, it is determined that the permission verification fails; otherwise, it is determined that the permission verification passes. Compared with the prior art technical solution that realizes the non-null judgment of field parameters through hard coding, by obtaining the field set with non-null annotations in the query condition, parsing the permission group corresponding to each field in the field set, and then performing permission verification, it only needs to set the non-null annotations in the fields of the query condition in advance, which is convenient to operate and has strong readability. The query data security control is realized with zero code in the query interface, and the non-null annotations can be reused. Description of the Drawings
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings. In the drawings:
[0019] Figure 1 is the flow of the query data security control method of the query interface in the embodiment of the present invention Figure 1 ;
[0020] Figure 2 is the flow of the query data security control method of the query interface in the embodiment of the present invention Figure 2 ;
[0021] Figure 3 The flowchart of the query data security control method for the query interface in the embodiment of the present invention Figure 3 ;
[0022] Figure 4 The flowchart of the query data security control method for the query interface in the embodiment of the present invention Figure 4 ;
[0023] Figure 5 The flowchart of the query data security control method for the query interface in the embodiment of the present invention Figure 5 ;
[0024] Figure 6 The schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 1 ;
[0025] Figure 7 The schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 2 ;
[0026] Figure 8 The schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 3 ;
[0027] Figure 9 The schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 4 ;
[0028] Figure 10 The schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 5 ;
[0029] Figure 11 The schematic diagram of the computer device in the embodiment of the present invention. Detailed implementation manners
[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer and more understandable, the following further elaborates on the embodiments of the present invention with reference to the accompanying drawings. Herein, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but not to limit the present invention.
[0031] First, the terms related to the embodiments of the present invention are explained.
[0032] Interface: A service provided by a software system that can be called internally / externally to implement a specific business, such as a business data query interface, a business data update interface, etc.;
[0033] Query data security control: Restrict the incoming query conditions, requiring that the query conditions must be non-empty judged according to business rules before allowing the query to be executed, control the query results within the minimum available range, and avoid full-scale query of data to ensure the security of query data.
[0034] Figure 1 This is the flow of the query data security control method for the query interface in the embodiments of the present invention. Figure 1 , including:
[0035] Step 101, after receiving the query condition, obtain the field set with non-null annotations in the query condition;
[0036] Step 102, parse the permission group corresponding to each field in the field set;
[0037] Step 103, group all the fields in the field set according to the permission group;
[0038] Step 104, if there are non-null fields in all groups, determine that the permission verification fails; otherwise, determine that the permission verification passes.
[0039] In the embodiments of the present invention, compared with the prior art technical solution that realizes non-null judgment of field parameters through hard coding, by obtaining the field set with non-null annotations in the query condition, parsing the permission group corresponding to each field in the field set, and then performing permission verification, it only needs to set the non-null annotations in the fields of the query condition in advance, which is convenient to operate and has strong readability. The query data security control is realized with zero code in the query interface, and the non-null annotations can be reused.
[0040] In step 101, after receiving the query condition, obtain the field set with non-null annotations in the query condition.
[0041] That is, it is necessary to set the fields with non-null annotations in the query condition first.
[0042] Figure 2 This is the flow of the query data security control method for the query interface in the embodiments of the present invention. Figure 2 , in one embodiment, the method further includes:
[0043] Step 201, in the query condition class corresponding to the query condition, set non-null annotations and the corresponding permission groups for each field in the query condition.
[0044] Among them, the non-null annotation can be defined as follows:
[0045] @QueryNotNull. The scope of the non-null annotation is the field, and the attribute groupIds (field type is String) is used to identify the permission group to which the field belongs (applied when there are multiple groups of permissions for the entity query condition). The relationship between each group is "OR", that is, only need to meet the query conditions of one group to pass the permission verification. The code example is as follows:
[0046]
[0047] In the query condition class corresponding to the query condition, when setting the non-null annotation and the belonging permission group for each field in the query condition, for example, @QueryNotNull(groupIds = "1,2"). When a field belongs to multiple permission groups at the same time, the ids of each group are separated by ",", and the code example is as follows:
[0048]
[0049] Specifically, when executing step 101-step 104, it is implemented based on the underlying BaseService.
[0050] Figure 3 This is the process of the query data security control method for the query interface in the embodiments of the present invention Figure 3 , in one embodiment, the method further includes:
[0051] Step 301, after receiving the query condition, if there is a field without the non-null annotation, determine whether the parameter of the field is non-null. If so, determine that the permission verification fails.
[0052] Here are the exception error measures to avoid the situation where there is a field without the non-null annotation, resulting in the execution of the query for the non-null parameter field at the end.
[0053] Figure 4 This is the process of the query data security control method for the query interface in the embodiments of the present invention Figure 4 , in one embodiment, the method further includes:
[0054] Step 401, when the permission verification fails, abort the query operation corresponding to the query condition;
[0055] Step 402, when the permission verification passes, execute the query operation corresponding to the query condition.
[0056] According to the permission verification result, determine whether to execute or abort the query operation, which can ensure the security of the query data.
[0057] Figure 5 This is the process of the query data security control method for the query interface in the embodiments of the present invention Figure 5, in one embodiment, after aborting the query operation corresponding to the query condition, it further includes:
[0058] Step 501, generate a permission exception reminder message, which is used to remind the user that there are non-empty fields.
[0059] Adding a permission exception reminder message helps the user check the query conditions and further avoid errors.
[0060] In summary, in the method proposed in the embodiment of the present invention, after receiving a query condition, obtain the field set with non-empty annotations in the query condition; parse the permission group corresponding to each field in the field set; group all the fields in the field set according to the permission group; if there are non-empty fields in all groups, determine that the permission verification fails; otherwise, determine that the permission verification passes. Compared with the prior art technical solution that realizes the non-empty judgment of field parameters through hard coding, by obtaining the field set with non-empty annotations in the query condition, parsing the permission group corresponding to each field in the field set, and then performing permission verification, it only needs to set the non-empty annotations in the fields of the query condition in advance, which is convenient to operate and has strong readability. The query data security control is realized with zero code in the query interface, and the non-empty annotations can be reused.
[0061] In the embodiment of the present invention, there is also provided a query data security control device for a query interface, as described in the following embodiments. Since the principle of the device to solve the problem is similar to the query data security control method of the query interface, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.
[0062] Figure 6 Schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 1 , including:
[0063] Field set acquisition module 601, configured to obtain the field set with non-empty annotations in the query condition after receiving the query condition;
[0064] Permission group parsing module 602, configured to parse the permission group corresponding to each field in the field set;
[0065] Grouping module 603, configured to group all the fields in the field set according to the permission group;
[0066] Permission judgment module 604, configured to determine that the permission verification fails if there are non-empty fields in all groups; otherwise, determine that the permission verification passes.
[0067] Figure 7 Schematic diagram of the query data security control device for the query interface in the embodiment of the present invention Figure 2, in one embodiment, the device further includes an auxiliary permission determination module 701, which is used for:
[0068] After receiving the query condition, if there is a field without a non-empty annotation, determine whether the parameter of the field is non-empty. If so, determine that the permission verification fails.
[0069] Figure 8 Schematic of the query data security control device for the query interface in the embodiment of the present invention Figure 3 , in one embodiment, the device further includes a query operation execution module 801, which is used for:
[0070] When the permission verification fails, abort the query operation corresponding to the query condition;
[0071] When the permission verification passes, execute the query operation corresponding to the query condition.
[0072] Figure 9 Schematic of the query data security control device for the query interface in the embodiment of the present invention Figure 4 , in one embodiment, the device further includes an exception reminder module 901, which is used for:
[0073] After aborting the query operation corresponding to the query condition, generate a permission exception reminder message, which is used to remind the user that there is a non-empty field.
[0074] Figure 10 Schematic of the query data security control device for the query interface in the embodiment of the present invention Figure 5 , in one embodiment, the device further includes an annotation setting module 1001, which is used for:
[0075] In the query condition class corresponding to the query condition, set a non-empty annotation and the corresponding permission group for each field in the query condition.
[0076] In summary, in the device proposed in the embodiment of the present invention, the field set acquisition module is used to acquire the field set with non-empty annotations in the query condition after receiving the query condition; the permission group parsing module is used to parse the permission group corresponding to each field in the field set; the grouping module is used to group all the fields in the field set according to the permission group; the permission determination module is used to determine that the permission verification fails if there are non-empty fields in all groups; otherwise, determine that the permission verification passes. Compared with the prior art technical solution that realizes the non-empty judgment of field parameters through hard coding, by acquiring the field set with non-empty annotations in the query condition, parsing the permission group corresponding to each field in the field set, and then performing permission verification, it only needs to set the non-empty annotations in the fields of the query condition in advance, which is convenient to operate and has strong readability. The query data security control is realized with zero code in the query interface, and the non-empty annotations can be reused.
[0077] An embodiment of the present invention further provides a computer device. Figure 11 As a schematic diagram of the computer device in the embodiment of the present invention, the computer device 1100 includes a memory 1110, a processor 1120, and a computer program 1130 stored on the memory 1110 and executable on the processor 1120. When the processor 1120 executes the computer program 1130, the query data security control method of the above query interface is implemented.
[0078] An embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the query data security control method of the above query interface is implemented.
[0079] An embodiment of the present invention further provides a computer program product. The computer program product includes a computer program. When the computer program is executed by a processor, the query data security control method of the above query interface is implemented.
[0080] In summary, the beneficial effects of the computer device, computer-readable storage medium, and computer program product proposed in the embodiments of the present invention are as follows:
[0081] (1) Based on the service catalog of transaction codes, the management cost of users for parameter configuration metadata is greatly reduced;
[0082] (2) Parameters can be directly set through the parameter configuration interface corresponding to the transaction code, avoiding the need for users to first learn the configuration definitions of different development frameworks in the past, greatly improving the R & D efficiency and saving development costs;
[0083] (3) The service governance component of the business application end is updated according to the configuration parameters, and has the ability to take effect in real time, avoiding the drawback that at least the application needs to be restarted to update after modifying the configuration in the traditional way, and effectively improving the overall operation and maintenance efficiency.
[0084] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0085] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device generate means for implementing the functions specified in the Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.
[0086] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory produce a manufacture including instruction means that implement the functions specified in the Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.
[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in the Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.
[0088] The specific embodiments described above further elaborate on the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection scope of the present invention.
Claims
1. A query data security control method for a query interface, characterized in that, including: After receiving a query condition, obtain the field set with non-null annotations in the query condition; Parse the permission group corresponding to each field in the field set; Group all the fields in the field set according to the permission group; If there are non-null fields in all groups, determine that the permission verification fails; Otherwise, determine that the permission verification passes; It also includes: In the query condition class corresponding to the query condition, set non-null annotations and the corresponding permission groups for each field in the query condition.
2. The method according to claim 1, characterized in that, It also includes: After receiving the query condition, if there is a field without a non-null annotation, determine whether the parameter of the field is non-null. If so, determine that the permission verification fails.
3. The method according to claim 1, wherein It also includes: When the permission verification fails, abort the query operation corresponding to the query condition; When the permission verification passes, execute the query operation corresponding to the query condition.
4. The method according to claim 3, wherein After aborting the query operation corresponding to the query condition, it also includes: Generate a permission exception reminder message, which is used to remind the user that there are non-null fields.
5. A query data security control device for a query interface, characterized in that, including: A field set acquisition module, which is used to obtain the field set with non-null annotations in the query condition after receiving the query condition; A permission group parsing module, which is used to parse the permission group corresponding to each field in the field set; A grouping module, which is used to group all the fields in the field set according to the permission group; A permission judgment module, which is used to determine that the permission verification fails if there are non-null fields in all groups; otherwise, determine that the permission verification passes; It also includes an annotation setting module, which is used for: In the query condition class corresponding to the query condition, set non-null annotations and the corresponding permission groups for each field in the query condition.
6. The device according to claim 5, characterized in that, It also includes an auxiliary permission judgment module, which is used for: After receiving the query condition, if there is a field without a non-null annotation, determine whether the parameter of the field is non-null. If so, determine that the permission verification fails.
7. The device according to claim 5, characterized in that, It also includes a query operation execution module, which is used for: When the permission verification fails, abort the query operation corresponding to the query condition; When the permission verification passes, execute the query operation corresponding to the query condition.
8. The device according to claim 7, characterized in that, It also includes an exception reminder module, which is used for: After aborting the query operation corresponding to the query condition, generate a permission exception reminder message, which is used to remind the user that there are non-null fields.
9. A computer device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method described in any one of claims 1 to 4.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the method described in any one of claims 1 to 4.
11. A computer program product, characterized in that, The computer program product includes a computer program, and when the computer program is executed by the processor, it implements the method described in any one of claims 1 to 4.
Citation Information
Patent Citations
Data query method and device, electronic equipment and computer readable storage medium
CN112988781A
Method and system for segmenting query urls
US20110119268A1