A data authority control method and device, electronic equipment and storage medium

Abstract

This application relates to the field of data security technology, and in particular to a data access control method, apparatus, electronic device, and storage medium. The method includes: obtaining a user terminal's data access request through a data access interceptor; if the target role information in the data access request is restricted role information, obtaining the target data access information corresponding to the target role information according to a pre-configured correspondence between role information and data access information; obtaining a data query statement corresponding to the data access request, and adding data filtering conditions generated based on the target data access information to the data query statement to obtain a new data query statement; executing the new data query statement to query data from the database that meets the data filtering conditions, and sending the queried data to the user terminal. This application can restrict the data that different operators can access, thereby ensuring the security and confidentiality of an enterprise's database system.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data access control method, apparatus, electronic device and storage medium. Background Technology

[0002] For database systems, data security and confidentiality are of paramount importance. Enterprise business systems handle massive amounts of data, typically distributing this data among operators in different departments, positions, and teams for processing.

[0003] Currently, how to restrict the data that different operators can access in order to ensure the security and confidentiality of an enterprise's database system is a problem that needs to be solved. Summary of the Invention

[0004] This application provides a data access control method, apparatus, electronic device, and storage medium to restrict the data that different operators can access, so that each operator can only access data in the database that conforms to their own data permissions, thereby ensuring the security and confidentiality of the enterprise's database system.

[0005] In a first aspect, embodiments of this application provide a data access control method, including:

[0006] The data access request of the user terminal is obtained through the data permission interceptor, and the data access request includes the target role information of the target user;

[0007] If the target role information is restricted role information, then the target data permission information corresponding to the target role information is obtained according to the pre-configured correspondence between role information and data permission information;

[0008] Obtain the data query statement corresponding to the data access request, and add the data filtering conditions generated based on the target data permission information to the data query statement to obtain a new data query statement;

[0009] The new data query statement is executed to retrieve data from the database that meets the data filtering conditions, and the retrieved data is sent to the user terminal.

[0010] In one possible embodiment, the restricted role information includes at least one of the following: non-management teams in non-management positions, management positions in branch offices, and management teams in non-management positions; the method further includes:

[0011] If the target role information belongs to a non-management position, then determine whether the target role information belongs to the management team;

[0012] If not, then the target role information is determined to be a non-management team in a non-management position;

[0013] If so, the target role information is determined to be the management team in a non-management position;

[0014] If the target role information belongs to a management position, then determine whether the target role information belongs to the headquarters organization;

[0015] If not, then the target role information is determined to be a management position in a branch office.

[0016] In one possible embodiment, if the restricted role information is a non-management team in a non-management position, then the data permission information includes query permissions for data service types of multiple business data, and the role information includes organizational information, which is an organization or a team within an organization.

[0017] The correspondence between the role information and the data permission information is obtained in the following way:

[0018] For each piece of business data, the multiple data service types corresponding to the business data are associated with the corresponding organization or the corresponding team within the organization, thereby obtaining the correspondence between the organization information and the query permissions of the respective data service types of the multiple business data.

[0019] Each data service type represents the processing type for the corresponding business data.

[0020] In one possible embodiment, if the restricted role information is a management position in a branch or a management team in a non-management position, then the data permission information includes query permissions for all data in the organization, and the role information includes the organization;

[0021] The correspondence between role information and data permission information includes the correspondence between the organization and the query permissions for all data within the organization.

[0022] In one possible embodiment, the method further includes:

[0023] If the target role information is unrestricted role information, then the data query statement corresponding to the data access request is executed to query the corresponding data from the database, and the queried data is sent to the user terminal.

[0024] In one possible embodiment, the unrestricted role information includes at least management positions within the headquarters; the method further includes:

[0025] After determining that the target role information belongs to a management position, it is then determined whether the target role information belongs to the headquarters organization;

[0026] If so, the target role information is determined to be unrestricted role information.

[0027] Secondly, embodiments of this application provide a data access control device, comprising:

[0028] The interception module is used to obtain data access requests from user terminals through a data permission interceptor. The data access requests include the target role information of the target user.

[0029] The permission acquisition module is used to obtain the target data permission information corresponding to the target role information according to the pre-configured correspondence between role information and data permission information if the target role information is restricted role information;

[0030] The statement generation module is used to obtain the data query statement corresponding to the data access request, and add the data filtering conditions generated according to the target data permission information to the data query statement to obtain a new data query statement;

[0031] The query restriction module is used to execute the new data query statement to retrieve data from the database that meets the data filtering conditions, and send the retrieved data to the user terminal.

[0032] In one possible embodiment, the restricted role information includes at least one of the following: non-management teams in non-management positions, management positions in branch offices, and management teams in non-management positions;

[0033] The device further includes a first determination module, used for:

[0034] If the target role information belongs to a non-management position, then determine whether the target role information belongs to the management team;

[0035] If not, then the target role information is determined to be a non-management team in a non-management position;

[0036] If so, the target role information is determined to be the management team in a non-management position;

[0037] If the target role information belongs to a management position, then determine whether the target role information belongs to the headquarters organization;

[0038] If not, then the target role information is determined to be a management position in a branch office.

[0039] In one possible embodiment, if the restricted role information is a non-management team in a non-management position, then the data permission information includes query permissions for data service types of multiple business data, and the role information includes organizational information, which is an organization or a team within an organization.

[0040] The correspondence between the role information and the data permission information is obtained in the following way:

[0041] For each piece of business data, the multiple data service types corresponding to the business data are associated with the corresponding organization or the corresponding team within the organization, thereby obtaining the correspondence between the organization information and the query permissions of the respective data service types of the multiple business data.

[0042] Each data service type represents the processing type for the corresponding business data.

[0043] In one possible embodiment, if the restricted role information is a management position in a branch or a management team in a non-management position, then the data permission information includes query permissions for all data in the organization, and the role information includes the organization;

[0044] The correspondence between role information and data permission information includes the correspondence between the organization and the query permissions for all data within the organization.

[0045] In one possible embodiment, the apparatus further includes a non-restricted query module for:

[0046] If the target role information is unrestricted role information, then the data query statement corresponding to the data access request is executed to query the corresponding data from the database, and the queried data is sent to the user terminal.

[0047] In one possible embodiment, the unrestricted role information includes at least management positions in the headquarters; the device further includes a second determination module for:

[0048] After determining that the target role information belongs to a management position, it is then determined whether the target role information belongs to the headquarters organization;

[0049] If so, the target role information is determined to be unrestricted role information.

[0050] Thirdly, embodiments of this application provide an electronic device including a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of any of the above-described data access control methods.

[0051] Fourthly, embodiments of this application provide a computer storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the steps of any of the above-described data access control methods.

[0052] Fifthly, according to an embodiment of this application, a computer program product includes computer instructions stored in a computer-readable storage medium; when a processor of an electronic device reads the computer instructions from the computer-readable storage medium, the processor executes the computer instructions, causing the electronic device to perform the steps of any of the above-described data access control methods.

[0053] Since the embodiments of this application adopt the above-described technical solution, they have at least the following technical effects:

[0054] This application embodiment obtains data access requests from user terminals through a data permission interceptor, and acquires the target data permission information corresponding to the target role information in the data access request. Then, it generates data filtering conditions from the target data permission information and adds them to the data query statement to obtain a new data query statement. By executing the new data query statement, data that meets the data filtering conditions can be retrieved from the database. In this way, by implementing different data permission controls for operators with different role information, the data that different operators can access can be restricted, ensuring that each operator can only access data in the database that conforms to their own data permissions, thereby ensuring the security and confidentiality of the enterprise's database system. Furthermore, by differentiating the data that different operators can access, each operator can focus on processing data within their own work scope.

[0055] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram illustrating an application scenario of a data access control method provided in an embodiment of this application.

[0058] Figure 2A flowchart illustrating a data access control method provided in this application embodiment;

[0059] Figure 3 A flowchart illustrating another data access control method provided in this application embodiment;

[0060] Figure 4 A data permission authorization diagram provided for an embodiment of this application;

[0061] Figure 5 A logical schematic diagram of a data access control method provided in an embodiment of this application;

[0062] Figure 6 A structural block diagram of a data access control device provided in an embodiment of this application;

[0063] Figure 7 A structural block diagram of another data access control device provided in an embodiment of this application;

[0064] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0066] To facilitate a better understanding of the technical solutions of this application by those skilled in the art, the terms involved in this application are introduced below.

[0067] Data permissions: These are the data that a user is authorized to access. The difference between data permissions and role-based permissions is that role-based permissions determine what menu permissions a user has and what operations they can perform; data permissions, on the other hand, determine what data a user can see and manipulate within the menu.

[0068] Institution: In data permissions, the institution refers to the data operation institution. It is the basic unit that exists in the hosting system and can handle hosting business. It is the highest level and necessary object to grant data permissions in the hosting system.

[0069] Teams: Teams exist within an organization and provide detailed control over data permissions within that organization. They represent the lowest level of data permissions and are the only entities authorized to grant them. Teams have the following characteristics:

[0070] (1) Teams have organizational attributes. A team can only belong to one organization and inherits the data permissions of the organization to which it belongs (the data permissions of a team cannot be greater than the data permissions of the organization to which it belongs).

[0071] (2) A team is the smallest unit to which data permissions are granted. Users gain or lose data permissions that a team has by joining and leaving the team.

[0072] (3) Setting up teams is not mandatory. Teams and team authorization are only required when further refined control of an organization's data permissions is needed. However, once a team is set up and team authorization is granted for a certain data permission, the recipient of that data permission changes from the organization to the team. The actual change is that users in positions within the organization can see and operate this data before team authorization, but will not be able to see and operate this data if they do not join the team after team authorization.

[0073] (4) In order to further refine data access control, an organization can set up multiple teams.

[0074] Operators: also known as users, are the main entities responsible for handling managed services. The relationship between teams and users is N:N, meaning that a team can have multiple users, and these users all have the same data permissions as that team; the same user can also join multiple teams and have the data permissions of multiple teams simultaneously.

[0075] Data service type: This refers to the data processing type triggered by a combination of function menus. Multiple function menus within a combination are closely linked and often require authorization to the same object (organization or team). For example, if the business data to be processed is a fund portfolio, multiple function menus for accounting and managing the fund portfolio can be considered as a function menu combination.

[0076] The word “exemplary” as used below means “serving as an example, embodiment, or illustration.” Any embodiment illustrated as an “exemplary” need not be construed as superior to or better than other embodiments.

[0077] The terms "first" and "second" used in this document are for descriptive purposes only and should not be construed as indicating relative importance or implying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0078] The design concept of the embodiments of this application is briefly introduced below:

[0079] Currently, enterprise business systems handle massive amounts of data, which is typically distributed among operators in different departments, positions, and teams. Therefore, business departments want to differentiate the data accessible to operators from different departments, positions, and teams, allowing them to focus on data within their specific responsibilities. This necessitates restricting the data access available to different operators to ensure the security and confidentiality of the enterprise's database system.

[0080] In view of this, embodiments of this application provide a data access control method, apparatus, electronic device, and storage medium for restricting the data that different operators can access, so that each operator can only access data in the database that conforms to their own data permissions, thereby ensuring the security and confidentiality of the enterprise's database system.

[0081] like Figure 1 The diagram illustrates an application scenario of an embodiment of this application. The application scenario diagram includes multiple terminal devices 100 and a server 200, with a database deployed in the server 200. The terminal devices 100 and the server 200 can be directly or indirectly connected via a communication network, which can be a wired network or a wireless network; this application does not impose any limitations on this.

[0082] Terminal device 100 can be a desktop computer, tablet computer, laptop computer, smartphone, intelligent voice interaction device, etc., but is not limited to these. Various applications can be installed on the terminal device, including applications related to financial business. Server 200 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0083] In one possible implementation, the data access control method of this application embodiment can be applied to financial data query scenarios. In a specific implementation, the database of the server 200 of a financial enterprise stores financial-related business data. The amount of this business data is very large and is usually distributed to operators of different institutions, positions, teams, etc. for processing.

[0084] When an operator needs to access relevant business data in the database of server 200 through a financial business-related application on terminal device 100, the operator can trigger the corresponding function menu in the application to send a data access request to server 200. Server 200 can obtain the data access request from terminal device 100 through a data permission interceptor. The data access request contains the operator's organization or team within the organization (i.e., target role information). If the target role information is determined to be restricted role information, the target data permission information corresponding to the target role information is obtained according to the pre-configured correspondence between role information and data permission information. The server 200 obtains the data query statement corresponding to the data access request and adds the data filtering conditions generated based on the target data permission information to the data query statement to obtain a new data query statement. The server 200 executes the new data query statement to query data from the database that meets the data filtering conditions and sends the queried data to terminal device 100.

[0085] It should be noted that, Figure 1 The examples shown are merely illustrative; in reality, the number of terminal devices and servers is unlimited and is not specifically limited in the embodiments of this application.

[0086] The data access control method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way.

[0087] Figure 2 This application illustrates a data access control method provided by an embodiment of the present application. This method can be applied to a server, such as... Figure 2 As shown, this data access control method includes the following steps:

[0088] S201, the data access request of the user terminal is obtained through the data permission interceptor. The data access request includes the target role information of the target user.

[0089] In this embodiment, the server can be the backend server of the business system, and its database stores a large amount of business data. This business data can be determined according to the actual business. For example, when the actual business is financial-related, the business data can be financial business data, such as fund business data, capital business data, etc. Different businesses of the business system can be assigned to operators of different institutions, positions, teams, etc. for processing. Therefore, the business data in the database can be accessed by operators of different institutions, positions, teams, etc.

[0090] Specifically, the server can use an existing system framework that provides data interception plugins to perform database data queries. For example, the system framework could be MyBatis, MyBatis-Plus, etc. Through the interceptors of the aforementioned system framework, all data access requests can be intercepted and data filtering can be performed. That is, data filtering conditions can be added to the query statements of the operator's data access requests, thereby achieving data access control.

[0091] The aforementioned MyBatis is a persistence layer framework that supports Structured Query Language (SQL) queries, stored procedures, and advanced mappings. It allows the use of simple XML (Extensible Markup Language) or annotations for configuration and raw mapping, mapping interfaces and Java POJOs (Plain Ordinary Java Objects) to records in the database. MyBatis-Plus (MP) is an enhancement tool for MyBatis, building upon it without altering its core functionality, designed to simplify development and improve efficiency. Both MyBatis and MyBatis-Plus provide the interceptors required in this application.

[0092] Furthermore, the data permission interceptor in this application embodiment is not limited to the interceptors of MyBatis and MyBatis-Plus described above, but may be other interceptors, which are not limited here.

[0093] In S201 above, the user terminal can be a terminal device used by the operator, such as the one described above. Figure 1 The terminal device 100 is used in the system. Business-related applications can be installed on this user terminal, allowing operators to perform corresponding business operations, such as financial transactions. When an operator triggers the appropriate function menu within the application, the user terminal can send a corresponding data access request to the server.

[0094] It should be noted that operators from different organizations, positions, teams, etc., may be responsible for different business data. Through the following embodiments of this application, different operators can access different business data after triggering the same function menu, and the same operator can access different combinations of business data after triggering different function menus.

[0095] S202, if the target role information is restricted role information, then according to the pre-configured correspondence between role information and data permission information, the target data permission information corresponding to the target role information is obtained.

[0096] The target role information may include some or all of the following: job position information, organization information, employee number, and team information. In this embodiment, the restricted role information can be set as needed, for example, including: non-management teams in non-management positions, management positions in branch offices, management teams in non-management positions, etc., which are not limited here.

[0097] To restrict role information, relevant personnel can pre-configure data permission information corresponding to different role information on the server, thus establishing the correspondence between role information and data permission information. The data permission information can be access permissions for business data, which can be determined based on the business data within the scope of work for different roles. This will be further described in detail in the following embodiments.

[0098] S203, obtain the data query statement corresponding to the data access request, and add the data filtering conditions generated based on the target data permission information to the data query statement to obtain a new data query statement.

[0099] In this embodiment, the server can retrieve relevant business data from the database by executing the data query statement corresponding to the data access request. This data query statement can be a Structured Query Language (SQL). To restrict data access, this embodiment captures the user terminal's data access request through a data permission interceptor, obtains the data query statement corresponding to the database access request, generates data filtering conditions based on the aforementioned target data permission information, and adds these filtering conditions to the obtained data query statement to obtain a new data query statement.

[0100] For example: If the target data permission information is the access permission of the corresponding data service type of business data 1, then the data filtering condition can be accessing data of the corresponding data service type of business data 1; where the data service type represents the processing type of business data 1, such as clearing management, accounting management and other processing types. Each data service type can correspond to multiple function menus, that is, the operator can trigger the corresponding data service type through multiple function menus.

[0101] S204, execute a new data query statement to retrieve data from the database that meets the data filtering conditions, and send the retrieved data to the user terminal.

[0102] The server can execute new data query statements to retrieve data from the database that meets the data filtering conditions corresponding to the data access request, and then send the retrieved data to the user terminal. After receiving the queried data, the user terminal displays it so that the operator can perform corresponding processing on the queried data.

[0103] For example: Operator A has the authority to manage the settlement of business data 1. When operator A triggers the settlement management function menu on the user terminal, the server can query business data 1 from the database and send business data 1 to the user terminal. The user terminal displays business data 1 so that the operator can perform settlement processing on business data 1.

[0104] In this embodiment of the application, by implementing different data permission controls for operators with different roles, the data that different operators can access can be restricted, so that each operator can only access data in the database that conforms to their own data permissions, thereby ensuring the security and confidentiality of the enterprise's database system; and by differentiating the data that different operators can access, each operator can focus on processing the data within their own work scope.

[0105] In one possible embodiment, the restricted role information in S202 above may include at least one of the following: a non-management team in a non-management position, a management position in a branch office, or a management team in a non-management position. Therefore, before executing S202, it can be further determined whether the target role information belongs to a non-management team in a non-management position, a management position in a branch office, or a management team in a non-management position; specifically as follows... Figure 3 As shown, after obtaining the target role information from the data access request, the following steps can be performed:

[0106] S301, determine whether the target role information belongs to a non-management position. If not, proceed to S302; if yes, proceed to S305.

[0107] In this embodiment of the application, management positions can be set according to actual needs, such as general manager, manager, etc.

[0108] S302, determine whether the target role information belongs to the management team. If not, execute S303; if yes, execute S304.

[0109] The management team can be set up according to actual needs, such as a supervisory team.

[0110] S303, Determine the target role information as the non-management team in the non-management position.

[0111] S304, the target role information is determined to be the management team in a non-management position.

[0112] S305, determine whether the target role information belongs to the headquarters organization; if not, execute S306, if yes, execute S307.

[0113] S306, The target role information is determined to be a management position in a branch office.

[0114] S307, the target role information is determined to be a management position in the headquarters organization.

[0115] In one possible implementation, if the role information is restricted to non-management teams within non-management positions, then data permission authorization is required. Data permission authorization has the following two characteristics: (1) Uniqueness: Data permissions are unique, meaning that at any given time, a data permission record can only be granted to one organization or one team. (2) Hierarchy: Data permission authorization is divided into two levels: organization authorization and team authorization. Organization authorization is mandatory; that is, data permission control must first be performed by the organization before deciding whether to perform team authorization based on whether more detailed control is required.

[0116] In practical implementation, if the role information is restricted to non-management teams within non-management positions, then the data permission information includes query permissions for each data service type for multiple business data items, and the role information includes organizational information, which refers to the organization or teams within the organization. The correspondence between the role information and data permission information in S202 above can be obtained as follows:

[0117] For each piece of business data, the multiple data service types corresponding to the business data are associated with the corresponding organization or the corresponding team within the organization to obtain the correspondence between the organization information and the query permissions of the respective data service types for the multiple business data; whereby each data service type represents the processing type for processing the corresponding business data.

[0118] In this embodiment, the specific data types of multiple business data can be determined according to actual business needs. For example, for financial business, multiple business data may include multiple fund portfolios, which refer to a collection of multiple funds held by an investor or financial institution. Each piece of business data may correspond to multiple data service types. For example, for a fund portfolio, data service types may include, but are not limited to, accounting management, clearing management, etc. The multiple data service types corresponding to each piece of business data can be authorized to the corresponding institutions or teams within those institutions.

[0119] For example Figure 4 As shown, business data 1 corresponds to data service type 1, data service type 2, data service type 3, etc. Data service type 1 can be authorized to organization 1, data service type 2 can be authorized to team 1 in organization 2, data service type 2 can be authorized to team 2 in organization 3, and so on.

[0120] For example: The business system has two main categories of business data. One category is clearing data, which operators can access using the "Clearing Management" data service type within the clearing management function menu. The other category is accounting data, which operators can access using the "Accounting Management" data service type within the accounting management function menu. Taking fund portfolios as an example, the clearing management data service type for fund portfolio Z1 is authorized to institution A, and the accounting management data service type for fund portfolio Z1 is authorized to institution B; similarly, the clearing management data service type for fund portfolio Z2 is authorized to institution B, and the accounting management data service type for fund portfolio Z2 is authorized to institution A.

[0121] In practical applications, for example, if operator A1 belongs to institution A, then operator A1 can only view and process the data of fund portfolio Z1 in the clearing management menu; and can only view and process the data of fund portfolio Z1 in the accounting management menu; in this way, the same operator can operate the business data of different portfolios under different function menus.

[0122] For example, if operator B1 belongs to institution B, then operator B1 can only view and process the data of fund portfolio Z1 in the accounting management menu; operator B1 can only view and process the data of fund portfolio Z2 in the clearing management menu; in this way, different operators can operate different business data under the same function menu.

[0123] For example, data service types include parameter configuration and parameter calculation. Parameter configuration is triggered by menu C1, and parameter calculation is triggered by menu C2. The same operator can view business data 1 and configure parameters in menu C1, and view business data 2 and perform parameter calculation in menu C2, so that the same operator can operate different combinations of business data under different function menus.

[0124] In this embodiment, different operators can operate different business data under the same function menu; the same operator can operate different combinations of business data under different function menus; and different operators can only operate business data belonging to their respective organizations under the same function menu.

[0125] It should be noted that the same operator will obtain different data if they select different permission modes when querying data under the same function menu. For example, if the same operator belongs to both Team 1 and Team 2, with Team 1 corresponding to data permission 1 and Team 2 corresponding to data permission 2, when the operator queries data as a member of Team 1, they can query the data corresponding to data permission 1; when the operator queries data as a member of Team 2, they can query the data corresponding to data permission 2.

[0126] In this embodiment of the application, data access control is related not only to the authorization of business data, but also to the position selected by the operator, the organization corresponding to the position, and the team to which the operator belongs under that organization.

[0127] In one possible embodiment, if the role information is restricted to management positions in branch offices or management teams in non-management positions, then the data permission information includes query permissions for all data in the organization, and the role information includes the organization; the correspondence between role information and data permission information includes the correspondence between the organization and the query permissions for all data in the organization.

[0128] In this embodiment of the application, the management positions or management teams in non-management positions within a branch have data permissions for the organization. In other words, operators in management positions or operators in management teams in non-management positions within a branch can view all business data of the organization.

[0129] In one possible embodiment, the method may further include the following steps:

[0130] If the target role information is unrestricted role information, then the data query statement corresponding to the data access request is executed to retrieve the corresponding data from the database, and the retrieved data is sent to the user terminal.

[0131] Among these, unrestricted role information includes at least management positions within the headquarters, which can be specifically identified through the above... Figure 3 Determine whether the target role is a management position within the headquarters.

[0132] In this embodiment of the application, data permissions may not be set for management positions in the headquarters. In other words, operators in management positions in the headquarters can view all business data in the database.

[0133] The following is combined Figure 5 The data access control method of this application embodiment is described by way of example.

[0134] The data permission interceptor in this embodiment takes the interceptor in the Mybatis framework as an example. This interceptor can capture all data access requests and add data filtering conditions to the data query statement to achieve seamless data filtering.

[0135] like Figure 5As shown, when the server performs a Mybatis data query, the Mybatis interceptor can intercept the aspect during the original query process, obtain the original SQL statement, and then rewrite the original SQL statement. Specifically, data permission information is encapsulated as a data filtering condition in the data permission code block, and the rewritten SQL statement replaces the original SQL statement. The replaced SQL statement is then executed in the database.

[0136] The original SQL statement is stored in the Mybatis executor context, while the data permission parameters are stored in a thread variable. In the interceptor, the context parameters of the Mybatis executor can be obtained to get the original SQL statement, and the data permission parameters in the thread variable can also be obtained. Then, data permission filtering conditions are encapsulated according to the data permission parameters outside the original SQL statement to achieve the purpose of data permission control.

[0137] This application embodiment can implement a unified data permission control interface based on the Mybatis framework using aspect-oriented interception technology, avoiding intrusion of business logic code. In other words, business system developers do not need to worry about the permission handling of the data itself, which can improve development efficiency and avoid data out-of-bounds problems caused by human negligence.

[0138] Based on the same inventive concept, this application also provides a data access control device that can be applied to a server. Since the principle of this device in solving the problem is similar to the method in the embodiments of this application, the implementation of this device can refer to the embodiments of the method, and repeated details will not be described again.

[0139] like Figure 6 As shown in the figure, an embodiment of this application provides a data access control device, including an interception module 61, an access control module 62, a statement generation module 63, and a query restriction module 64.

[0140] Interception module 61 is used to obtain data access requests from user terminals through a data permission interceptor. The data access requests include the target role information of the target user.

[0141] The permission acquisition module 62 is used to obtain the target data permission information corresponding to the target role information according to the pre-configured correspondence between role information and data permission information if the target role information is restricted role information;

[0142] The statement generation module 63 is used to obtain the data query statement corresponding to the data access request, and add the data filtering conditions generated according to the target data permission information to the data query statement to obtain a new data query statement;

[0143] The query restriction module 64 is used to execute new data query statements to retrieve data from the database that meets the data filtering conditions, and send the retrieved data to the user terminal.

[0144] In this embodiment of the application, by implementing different data permission controls for operators with different roles, the data that different operators can access can be restricted, so that each operator can only access data in the database that conforms to their own data permissions, thereby ensuring the security and confidentiality of the enterprise's database system; and by differentiating the data that different operators can access, each operator can focus on processing the data within their own work scope.

[0145] In one possible embodiment, the restricted role information includes at least one of the following: non-management teams in non-management positions, management positions in branch offices, and management teams in non-management positions;

[0146] like Figure 7 As shown, the device also includes a first judgment module 65, used for:

[0147] If the target role information belongs to a non-management position, then determine whether the target role information belongs to the management team;

[0148] If not, then the target role information is determined to be a non-management team in a non-management position;

[0149] If so, then the target role information is determined to be the management team in a non-management position;

[0150] If the target role information belongs to a management position, then determine whether the target role information belongs to the headquarters organization;

[0151] If not, then the target role information is determined to be a management position in a branch office.

[0152] In one possible embodiment, if the role information is restricted to non-management teams in non-management positions, then the data permission information includes the data service type query permissions for each of the multiple business data, and the role information includes organizational information, which is the organization or a team within the organization.

[0153] The mapping relationship between role information and data permission information is obtained through the following method:

[0154] For each piece of business data, associate the multiple data service types corresponding to the business data with the corresponding organization or the corresponding team within the organization to obtain the correspondence between the organization information and the query permissions of the respective data service types of the multiple business data.

[0155] Each data service type represents the processing type for the corresponding business data.

[0156] In one possible embodiment, if the role information is restricted to management positions in branch offices or management teams in non-management positions, then the data permission information includes query permissions for all data in the organization, and the role information includes the organization.

[0157] The correspondence between role information and data permission information includes the correspondence between the organization and the query permissions for all data within the organization.

[0158] In one possible embodiment, the apparatus further includes a non-restricted query module 67, for:

[0159] If the target role information is unrestricted role information, then the data query statement corresponding to the data access request is executed to retrieve the corresponding data from the database, and the retrieved data is sent to the user terminal.

[0160] In one possible embodiment, the unrestricted role information includes at least management positions in the headquarters; the device further includes a second determination module 66, used for:

[0161] After determining that the target role information belongs to a management position, determine whether the target role information belongs to the headquarters organization;

[0162] If so, then the target role information is determined to be unrestricted role information.

[0163] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0164] Having introduced the data access control method and apparatus according to exemplary embodiments of this application, we will now introduce a data access control apparatus according to another exemplary embodiment of this application.

[0165] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0166] In some possible implementations, the data access control device according to this application may include at least a processor and a memory. The memory stores program code that, when executed by the processor, causes the processor to perform the steps of the data access control method according to various exemplary embodiments of this application described in this specification. For example, the processor may perform actions such as... Figure 2The steps are shown in the figure.

[0167] Having introduced the image classification method and apparatus according to exemplary embodiments of this application, we will now introduce an electronic device according to another exemplary embodiment of this application.

[0168] Based on the same inventive concept, this application also provides an electronic device, which can be a server or a terminal device. Since the principle of solving the problem by this electronic device is similar to the method in the embodiments of this application, the implementation of this electronic device can refer to the embodiments of the method, and repeated parts will not be described again.

[0169] like Figure 8 As shown, the electronic device includes a processor 80, a memory 81, and a communication interface 82. The processor 80 communicates with the communication interface 82 and the memory 81 through a communication bus 83. The memory 81 is used to store programs executable by the processor 80, and the processor 80 is used to read the programs in the memory 81 and execute the steps of any of the data access control methods in the above embodiments.

[0170] The aforementioned communication bus 83 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. The communication interface 82 is used for communication between the aforementioned computing device and other devices. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0171] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0172] Based on the same inventive concept, this application also provides a computer storage medium, which stores a computer program executable by a processor. When the program runs on the processor, it causes the processor to perform the steps of any of the data access control methods in the above embodiments.

[0173] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), optical storage such as CDs, DVDs, BDs, HVDs, and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND FLASH), solid-state drives (SSDs), etc.

[0174] In another embodiment provided in this application, a computer program product containing instructions is also provided. When the computer program product is invoked and executed by an electronic device, it enables the electronic device to perform the steps of any of the data access control methods in the above embodiments.

[0175] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0176] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0177] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0178] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0179] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A data authority control method, characterized by, The method comprises: obtaining a data access request of a user terminal through a data authority interceptor, wherein the data access request comprises target role information of a target user; if the target role information is restricted role information, obtaining target data authority information corresponding to the target role information according to a pre-configured correspondence between role information and data authority information; obtaining a data query statement corresponding to the data access request, and adding a data filtering condition generated according to the target data authority information into the data query statement to obtain a new data query statement; executing the new data query statement to query data meeting the data filtering condition from a database, and sending the queried data to the user terminal; the restricted role information at least comprises one of the following: a non-management team in a non-management post, a management post in a branch, and a management team in a non-management post; the method further comprises: if the target role information belongs to a non-management post, determining whether the target role information belongs to a management team; if not, determining that the target role information is a non-management team in a non-management post; if yes, determining that the target role information is a management team in a non-management post; if the target role information belongs to a management post, determining whether the target role information belongs to a headquarter; if not, determining that the target role information is a management post in a branch; if the restricted role information is a non-management team in a non-management post, the data authority information comprises data service type query authority of each business data, the role information comprises organization information, the organization information is an organization or a team in an organization, and the correspondence between the role information and the data authority information is obtained by: for each business data in the plurality of business data, associating a plurality of data service types corresponding to the business data with a corresponding organization or a corresponding team in the corresponding organization, to obtain a correspondence between the organization information and the data service type query authority of each business data; wherein each data service type represents a processing type for processing corresponding business data; if the restricted role information is a management post in a branch or a management team in a non-management post, the data authority information comprises query authority of all data in an organization, the role information comprises an organization, and the correspondence between the role information and the data authority information comprises a correspondence between the organization and the query authority of all data in the organization.

2. The method of claim 1, wherein, The method further comprises: if the target role information is non-restricted role information, executing a data query statement corresponding to the data access request to query corresponding data from a database, and sending the queried data to the user terminal.

3. The method of claim 2, wherein, the non-restricted role information at least comprises a management post in a headquarter; the method further comprises: after determining that the target role information belongs to a management post, determining whether the target role information belongs to a headquarter; if yes, determining that the target role information is non-restricted role information.

4. A data authority control apparatus characterized by comprising: The method comprises: An intercepting module is configured to acquire a data access request of a user terminal through a data authority interceptor, wherein the data access request comprises target role information of a target user; An authority acquiring module is configured to, if the target role information is restricted role information, acquire target data authority information corresponding to the target role information according to a preconfigured correspondence between role information and data authority information. A statement generating module is configured to acquire a data query statement corresponding to the data access request, and add a data filtering condition generated according to the target data authority information into the data query statement to obtain a new data query statement. A restricted query module is configured to execute the new data query statement to query data meeting the data filtering condition from a database, and send the queried data to the user terminal. The restricted role information at least comprises one of the following: a non-management team in a non-management post, a management post in a branch, and a management team in a non-management post. The device further comprises a first judging module configured to, if the target role information belongs to a non-management post, judge whether the target role information belongs to a management team, and if not, determine that the target role information is a non-management team in a non-management post, and if yes, determine that the target role information is a management team in a non-management post. If the target role information belongs to a management post, judge whether the target role information belongs to a headquarter, and if not, determine that the target role information is a management post in a branch. If the restricted role information is a non-management team in a non-management post, the data authority information comprises data service type query authority of each business data, the role information comprises organization information, the organization information is an organization or a team in an organization, and the correspondence between the role information and the data authority information is obtained by associating, for each business data in a plurality of business data, a plurality of data service types corresponding to the business data with a corresponding organization or a corresponding team in the corresponding organization, to obtain a correspondence between the organization information and the data service type query authority of each business data. If the restricted role information is a management post in a branch or a management team in a non-management post, the data authority information comprises query authority of all data in an organization, the role information comprises the organization, and the correspondence between the role information and the data authority information comprises a correspondence between the organization and the query authority of all data in the organization.

5. An electronic device, comprising: The device comprises a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the method in any one of claims 1-3.

6. A computer readable storage medium characterized by, The device comprises program code, and when the program code is executed on the electronic device, the program code is configured to cause the electronic device to execute the steps of the method in any one of claims 1-3.

7. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium; when a processor of an electronic device reads the computer instructions from the computer readable storage medium, the processor executes the computer instructions, so that the electronic device executes the steps of the method in any one of claims 1-3.

Images