Data access control method, apparatus, device, system, and medium

Abstract

The application discloses a data access control method, device, equipment, system and medium, and belongs to the field of data processing. The method comprises the following steps: receiving a data consumption request message of a target consumer sent by a consumer equipment; determining the authority of the target consumer according to the data consumption request message; sending a first management configuration message to the consumer equipment, wherein the first management configuration message comprises first data table information and first view information, so that the consumer equipment obtains data from a distributed message system through the first data table information and a view generated based on the first view information, and the first data table information comprises a part of a data table matched with the authority of the target consumer, and the first view information is used for forming a view corresponding to a processing rule matched with the authority of the target consumer. According to the embodiment of the application, the resources occupied by data access control can be reduced.

Description

Technical Field

[0001] This application belongs to the field of data processing, and in particular relates to a data access control method, apparatus, device, system and medium. Background Technology

[0002] As user demands continue to rise, business systems are increasingly requesting access to real-time data. Distributed messaging systems can be used to integrate this data. Data producers can add data to the distributed messaging system, and data consumers can read data from it. To ensure big data security, data access is limited to data relevant to the business systems' operations. Different business systems have different data requirements. To meet these needs, a custom data transfer service system needs to be developed for each business system. This system filters and anonymizes data before pushing it to the appropriate business system.

[0003] Developing separate custom data transfer service systems for different business systems would consume a lot of resources, resulting in a waste of resources. Summary of the Invention

[0004] This application provides a data access control method, apparatus, device, system, and medium that can reduce the resources occupied by data access control.

[0005] In a first aspect, embodiments of this application provide a data access control method applied to an access center device. The access center device stores a data table, which includes metadata of data in a distributed messaging system. The method includes: receiving a data consumption request message from a consumer device for a target consumer; determining the permissions of the target consumer based on the data consumption request message; and sending a first management configuration message to the consumer device. The first management configuration message includes first data table information and first view information, enabling the consumer device to obtain data from the distributed messaging system through the first data table information and a view generated based on the first view information. The first data table information includes a portion of the data table that matches the permissions of the target consumer, and the first view information is used to form a view corresponding to a processing rule that matches the permissions of the target consumer.

[0006] Secondly, embodiments of this application provide a data access control method applied to a consumer device. The method includes: sending a data consumption request message of a target consumer to an access center device, so that the access center device determines the permissions of the target consumer based on the data consumption request message; the access center device storing a data table, the data table including metadata of data in a distributed messaging system; receiving a first management configuration message sent by the access center device, the first management configuration message including first data table information and first view information, the first data table information including a portion of the data table that matches the permissions of the target consumer, the first view information being used to form a view corresponding to a processing rule matching the permissions of the target consumer; generating a view based on the first view information, and obtaining data from the distributed messaging system through the first data table information and the view.

[0007] Thirdly, embodiments of this application provide an access center device. The access center device stores a data table, which includes metadata of data in a distributed messaging system. The access center device includes: a receiving module for receiving a data consumption request message from a consumer device for a target consumer; a permission determination module for determining the permissions of the target consumer based on the data consumption request message; and a sending module for sending a first management configuration message to the consumer device. The first management configuration message includes first data table information and first view information, enabling the consumer device to obtain data from the distributed messaging system through the first data table information and a view generated based on the first view information. The first data table information includes a portion of the data table that matches the permissions of the target consumer, and the first view information is used to form a view corresponding to the processing rules that match the permissions of the target consumer.

[0008] Fourthly, embodiments of this application provide a consumer device, comprising: a sending module, configured to send a data consumption request message of a target consumer to an access center device, so that the access center device determines the permissions of the target consumer based on the data consumption request message; the access center device storing a data table, the data table including metadata of data in a distributed messaging system; a receiving module, configured to receive a first management configuration message sent by the access center device, the first management configuration message including first data table information and first view information, the first data table information including a portion of the data table matching the permissions of the target consumer, the first view information being used to form a view corresponding to a processing rule matching the permissions of the target consumer; and a processing module, configured to generate a view based on the first view information, and obtain data from the distributed messaging system through the first data table information and the view.

[0009] Fifthly, embodiments of this application provide an access center device, including: a processor and a memory storing computer program instructions; the processor implements the data access control method of the first aspect when executing the computer program instructions.

[0010] In a sixth aspect, embodiments of this application provide a consumer device, including: a processor and a memory storing computer program instructions; the processor implements the data access control method of the second aspect when executing the computer program instructions.

[0011] In a seventh aspect, embodiments of this application provide a data access control system, including an access center device as described in the fifth aspect and a consumer device as described in the sixth aspect.

[0012] Eighthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the data access control method of the first aspect or the data access control method of the second aspect.

[0013] This application provides a data access control method, apparatus, device, system, and medium. The access center device stores a data table containing metadata of data in a distributed messaging system. Based on a data consumption request message received from a consumer device, the access center device determines the permissions of the target consumer and sends a management configuration message matching the target consumer's permissions. The data table information in the management configuration message may include the portion of the data table matching the target consumer's permissions, and the view information in the management configuration message can be used to form a view corresponding to the processing rules matching the target consumer's permissions. The consumer terminal retrieves data from the distributed messaging system based on the data table information in the management configuration message and the view generated based on the view information. Different data consumers retrieve data from the distributed messaging system using their respective data table information and views, which matches their respective permissions. This eliminates the need to develop a separate data transfer service system for each data consumer, enabling access to filtered and anonymized data for different data consumers. This reduces the resources consumed by data access control and avoids resource waste. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 A schematic diagram illustrating an application scenario of the data access control method provided in this application embodiment;

[0016] Figure 2 A schematic diagram illustrating another example of an application scenario for the data access control method provided in the embodiments of this application;

[0017] Figure 3A flowchart of an embodiment of the data access control method provided in the first aspect of this application;

[0018] Figure 4 A flowchart of another embodiment of the data access control method provided in the first aspect of this application;

[0019] Figure 5 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application;

[0020] Figure 6 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application;

[0021] Figure 7 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application;

[0022] Figure 8 A flowchart of an embodiment of the data access control method provided in the second aspect of this application;

[0023] Figure 9 A flowchart of another embodiment of the data access control method provided in the second aspect of this application;

[0024] Figure 10 A flowchart of yet another embodiment of the data access control method provided in the second aspect of this application;

[0025] Figure 11 A schematic diagram illustrating an example of the logical architecture of the data access control method provided in an embodiment of this application;

[0026] Figure 12 A schematic diagram of the structure of an embodiment of the access center device provided in the third aspect of this application;

[0027] Figure 13 A schematic diagram of another embodiment of the access center device provided in the third aspect of this application;

[0028] Figure 14 A schematic diagram of the structure of yet another embodiment of the access center device provided in the third aspect of this application;

[0029] Figure 15 A schematic diagram of the structure of an embodiment of the consumer device provided in the fourth aspect of this application;

[0030] Figure 16 A schematic diagram of the structure of an embodiment of the access center device provided in the fifth aspect of this application;

[0031] Figure 17 This is a schematic diagram of the structure of an embodiment of a consumer device provided in the sixth aspect of this application. Detailed Implementation

[0032] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0033] As user demands continue to rise, business systems are increasingly requesting access to real-time data. Distributed messaging systems can be used to integrate this data. Data producers can add data to the distributed messaging system, and data consumers can read data from it. To ensure big data security and adhere to the principle of minimizing data access—meaning data access should only retrieve data relevant to the business systems' operations—different business systems have different data requirements. To meet these needs, a custom data transfer service system needs to be developed for each business system. This system filters and anonymizes data before pushing it to the appropriate business system. In other words, different custom data transfer service systems need to be developed for different business systems. For example, if ten different business systems all need to read data from the distributed messaging system, then a custom data transfer service system needs to be developed for each of these ten systems, requiring a total of ten custom data transfer service systems. Developing and maintaining these data transfer service systems consumes significant resources, and the deployment process for multiple systems is also more complex.

[0034] This application provides a data access control method, apparatus, device, system, and medium. In this method, a data table including metadata of data in a distributed messaging system can be set up in an access center. This table provides data consumers (i.e., business systems) with data table information and view information matching the permissions of the data consumers. The consumer device can obtain data from the distributed messaging system through a view generated based on the received data table information and view information. The data obtained by the consumer device conforms to the processing rules of its permissions. In this application embodiment, by using the data table information and view information corresponding to the permissions of each data consumer provided by the access center, filtered and anonymized data can be provided to different data consumers. This eliminates the need to develop separate data transfer service systems for different data consumers, significantly reducing resource consumption and avoiding resource waste.

[0035] The data access control method in this application embodiment may involve access control center devices, consumer devices, and distributed messaging systems. Figure 1 This is a schematic diagram illustrating an example application scenario of the data access control method provided in the embodiments of this application. For example... Figure 1 As shown, the data access control system may include an access center device 11 and a consumer device 12, which can be communicatively connected to the access center device 11. The data access control system may also include a distributed messaging system 13, which the consumer device 12 can also be communicatively connected to.

[0036] Distributed messaging system 13 can integrate data. In some examples, distributed messaging system 13 can specifically integrate streaming data. Distributed messaging system 13 may include multiple clusters, and data can be distributed and integrated across multiple clusters of distributed messaging system 13. Each cluster may include one or more data devices, which is not limited herein. The specific type of distributed messaging system 13 is not limited herein; for example, distributed messaging system 13 may include Kafka or other types of distributed messaging systems. For ease of explanation, this application embodiment uses Kafka as an example for illustration. In Kafka, data can be stored in the cluster at the topic level.

[0037] Consumer device 12 is a data consumer device, and its quantity and type are not limited here. Data consumers can be business systems, and the business systems corresponding to the data consumers are downstream systems of the distributed messaging system 13. The business systems corresponding to the data consumers can execute business operations; different business systems execute different business operations, and the data required for execution also differs. Data consumers can read data from the distributed messaging system 13, i.e., subscribe to data, through consumer device 12.

[0038] Access center device 11 is a device for accessing data. An access center may include one or more access center devices 11; the number and type of access center devices 11 are not limited here. Access center device 11 stores data tables, which include metadata of the data in the distributed messaging system 13. Metadata, also known as intermediary data or relay data, describes the data in the distributed messaging system 13. Specifically, metadata may include information describing the attributes of the data in the distributed messaging system 13. For example, a data table may include field information of the data in the distributed messaging system 13. Access center device 11 can communicate with consumer device 12, providing consumer device 12 with data table information and view information that match the permissions of the data consumer. The data table information matching the permissions of the data consumer includes the portion of the data table that matches the permissions of the data consumer. The view information matching the permissions of the data consumer is used to form a view corresponding to the processing rules that match the permissions of the target consumer. A view is a virtual table, and the content of the view is defined by the processing rules.

[0039] In other examples, the data access control method in the embodiments of this application may also involve producer equipment. Figure 2 This is a schematic diagram illustrating another example of an application scenario for the data access control method provided in the embodiments of this application. Figure 2 and Figure 1 The difference is that, Figure 2 The data access control system shown may also include producer device 14, which can be communicatively connected to distributed messaging system 13.

[0040] Producer device 14 is a device for data production, and its quantity and type are not limited here. Data producers can be business systems, and the business systems corresponding to data producers are upstream systems of distributed messaging system 13. The business systems corresponding to data producers can execute business operations; different business systems execute different business operations, and thus generate different data. Data producers can write data to distributed messaging system 13, i.e., publish data, through producer device 14. Different producer devices 14 can write data to the same cluster within distributed messaging system 13, and different producer devices 14 can also write data to different clusters within distributed messaging system 13; this is not limited here.

[0041] The data access control methods, apparatus, devices, systems, and media in the embodiments of this application will be described in turn below.

[0042] The first aspect of this application provides a data access control method that can be applied to an access center device, i.e., the data access control method can be executed by the access center device. Figure 3 A flowchart illustrating an embodiment of the data access control method provided in the first aspect of this application. Figure 3As shown, the data access control method may include steps S201 to S203.

[0043] In step S201, a data consumption request message from the target consumer sent by the consumer device is received.

[0044] The target consumer can be any data consumer. This application embodiment describes the data access control for one data consumer. The data access control for other data consumers is basically the same as that for the target consumer, and will not be described in detail here.

[0045] Data consumption request messages are used to notify the target consumer of the access center device of the management configuration information required to consume or access data. In some examples, the data consumption request message may include a consumer identifier of the target consumer, which identifies the target consumer and facilitates the determination of its permissions. In other examples, the data consumption request message may include a permission identifier of the target consumer, which identifies the target consumer's permissions; for example, the permission identifier may be a first token, meaning the data consumption request message may include a first token to represent the target consumer's permissions.

[0046] In step S202, the permissions of the target consumer are determined based on the data consumption request message.

[0047] In some examples, the target consumer can be identified based on the consumer identifier of the target consumer in the data consumption request message, and then the permissions of the target consumer can be determined based on the correspondence between data consumers and their respective permissions in the access center.

[0048] In other examples, the permissions of the target consumer can be determined based on the target consumer's permission identifier in the data consumption request message.

[0049] The permissions of a target consumer may limit which data the target consumer can access, what processed data they can obtain, etc., but these are not limited here. The target consumer's permissions can be pre-negotiated and determined between the target consumer and the access center. In some examples, after the target consumer's permissions are pre-negotiated and determined by the access center, the access center device can send a first token to the target consumer through the consumer terminal, so that the target consumer can use the first token to represent their permissions when accessing data subsequently.

[0050] In step S203, a first management configuration message is sent to the consumer device so that the consumer device can obtain data from the distributed messaging system through the first data table information and the view generated based on the first view information.

[0051] Distributed messaging systems originally lacked metadata management capabilities. In this embodiment, the access center device stores data tables that include metadata about the data in the distributed messaging system. By storing metadata in the form of table structure information, the distributed messaging system is endowed with metadata management capabilities. Metadata management capabilities for the distributed messaging system can be achieved through the management of these data tables. In some examples, data tables can be set up based on the topic dimension.

[0052] The first management configuration message includes first data table information and first view information. The first data table information and first view information belong to the management configuration information. The first data table information includes the portion of the data table that matches the permissions of the target consumer; for example, the first data table information may include field information in the data table that matches the permissions of the target consumer. The first view information is used to form a view corresponding to the processing rules that match the permissions of the target consumer; this view is defined by the processing rules that match the permissions of the target consumer.

[0053] The consumer device can generate a view based on the first view information in the first management configuration message, and can obtain data from the distributed messaging system through the first data table information and the view. The data obtained through the view is the portion that matches the permissions of the data table and the target consumer, and is processed according to the processing rules that match the permissions of the target consumer. Therefore, different business systems, i.e., data consumers, can obtain their respective data from the distributed messaging system through views generated based on their respective permission-matched data table information and view information. The obtained data matches their respective permissions, eliminating the need to develop a separate data transfer service system for each data consumer. This allows access to filtered, anonymized, and other processed data for different data consumers. The consumer device can install a consumer client plugin to implement the relevant operations in the data access control method of this application embodiment. The consumer client plugin is compatible with the existing interfaces of the distributed messaging system, such as Application Programming Interfaces (APIs), allowing for simple consumption and access to data. Filtering, anonymization, and other processing can be easily implemented through the view, eliminating the need for developers to focus on the complex processes of filtering, anonymization, and other processing, thus reducing development difficulty. The operation of consumer devices is transparent to the business systems corresponding to the target consumers. Consumer client plugins are plug-and-play, minimizing the impact on the development and modification of the business systems corresponding to the target consumers. The business systems corresponding to the target consumers can easily access the distributed messaging system under the restriction of access security control.

[0054] In some examples, views include both row and column data, thus enabling access to row and column-level data. In technical solutions that access and retrieve data through a separately developed data transfer service system, the smallest granularity is limited to accessing and retrieving topic-level data, not row and column-level data. Compared to this approach, the embodiments of this application do not require modifications to the distributed messaging system, allowing for refined data access and retrieval down to the row and column level, thus achieving row and column-level access to data within the distributed messaging system.

[0055] In some examples, the processing rules may include one or more of the following: row data filtering rules, column data filtering rules, field processing rules, and custom function rules.

[0056] Row data filtering rules are rules used to filter row data. For example, row data filtering rules may include rules on which rows of data to access and retrieve. Column data filtering rules are rules used to filter column data. For example, column data filtering rules may include rules on which columns of data to access and retrieve. Field processing rules are rules for processing fields, such as field desensitization rules, etc., and are not limited here. Custom function rules are rules for processing the accessed data using custom functions. Custom functions may include user-defined functions (UDFs), which can be defined by the target consumer and are not limited here. By limiting the view through processing rules, the principle of minimizing data access is satisfied, ensuring that each data consumer can access data that matches its own permissions.

[0057] In some examples, the consumer device can be configured with a synchronizer to periodically poll the interface of the central device through data consumption request messages to obtain the first management configuration message. This allows for timely updates to the corresponding view and access to data that conforms to the new data table information and / or the new view information when the first management configuration message is updated.

[0058] In this embodiment, the access center device stores a data table containing metadata of data from the distributed messaging system. Based on a data consumption request message received from a consumer device, the access center device determines the target consumer's permissions and sends a management configuration message matching those permissions to the target consumer. The data table information in the management configuration message may include the portion of the data table matching the target consumer's permissions, and the view information in the management configuration message can be used to form a view corresponding to the processing rules matching the target consumer's permissions. The consumer terminal retrieves data from the distributed messaging system based on the data table information in the management configuration message and the view generated based on the view information. Different data consumers retrieve data from the distributed messaging system using their respective data table information and views, which matches their respective permissions. This eliminates the need to develop a separate data transfer service system for each data consumer, enabling access to filtered and anonymized data for different data consumers. This reduces the resources consumed by data access control and avoids resource waste.

[0059] In some examples, the data consumption request message includes a first token. The consumer device can request this first token from the access center device in advance, and then directly use this first token to obtain the corresponding first management configuration message during subsequent data access control processes. Figure 4 A flowchart of another embodiment of the data access control method provided in the first aspect of this application. Figure 4 and Figure 3 The difference is that, Figure 4 The data access control method shown may also include steps S204 to S206.

[0060] In step S204, a first authorization authentication message sent by the consumer device is received.

[0061] The first authentication message is used to request authentication from the access center device for the target consumer, and may include the target consumer's user identifier and password. The user identifier can be used to identify the target consumer. In some examples, the user identifier may include a username or user number, etc., but this is not limited to this.

[0062] In step S205, the target consumer is authenticated based on the target consumer's user ID and user password.

[0063] Based on the target consumer's user identifier and password in the first authentication message, the target consumer's identity can be authenticated, thereby authenticating the target consumer's permissions. If the target consumer's user identifier and password in the first authentication message match the target consumer's login information pre-stored in the access center device, the target consumer's authentication is considered successful. If the target consumer's user identifier and password in the first authentication message do not match the target consumer's login information pre-stored in the access center device, the target consumer's authentication is considered to have failed.

[0064] In step S206, if authentication is successful, a first token corresponding to the target consumer's user identifier and user password is obtained, and the first token is sent to the consumer device.

[0065] Successful authentication indicates that the person operating the consumer device is the target consumer, and the first token can be provided to the target consumer.

[0066] If this authentication is the target consumer's first authentication, the access center device can assign a first token to the target consumer, that is, generate a first token corresponding to the target consumer's user identifier and user password, and send the first token to the consumer device. This allows the target consumer to directly use the first token to obtain the first management configuration message from the access center device in subsequent data access control processes, without having to perform authentication every time, simplifying the process and improving the efficiency of data access control.

[0067] If this authentication is not the target consumer's first authentication, for example, if the target consumer changes consumer devices, the access center device can find the first token corresponding to the target consumer and send the first token to the consumer device, so that the target consumer can directly use the first token to obtain the first management configuration message from the access center device in subsequent data access control processes through the consumer device.

[0068] By authenticating data consumers using their user ID and password, a first token corresponding to the data consumer's permissions is provided, preventing the misuse of other data consumers' permissions and ensuring the security of data control access for data consumers.

[0069] In some embodiments, a data producer can write data matching its permissions to a distributed messaging system cluster that matches the producer's permissions via a producer device. Figure 5 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application. Figure 5 and Figure 3 The difference is that, Figure 5The data access control method shown may further include steps S207 to S209.

[0070] In step S207, a data production request message from the target producer is received from the producer device.

[0071] The data tables stored in the access center device may also include cluster information for the distributed messaging system. This cluster information can be used to indicate clusters. For example, if the distributed messaging system includes five clusters, the data tables stored in the access center device may include J1, J2, J3, J4, and J5. J1, J2, J3, J4, and J5 are all cluster information; J1 indicates the first cluster, J2 indicates the second cluster, J3 indicates the third cluster, J4 indicates the fourth cluster, and J5 indicates the fifth cluster.

[0072] The target producer can be any data producer. This application embodiment describes the data access control for one data producer. The data access control for other data producers is basically the same as that for the target producer, and will not be described in detail here.

[0073] The data production request message is used to notify the target producer at the access center device of the management configuration information required to produce data, i.e., to write data. In some examples, the data production request message may include a producer identifier for the target producer, which identifies the target producer and facilitates the determination of its permissions. In other examples, the data production request message may include a permission identifier for the target producer, which identifies its permissions; for example, the permission identifier may be a second token, meaning the data production request message may include a second token to represent the target producer's permissions.

[0074] In step S208, the permissions of the target producer are determined based on the data production request message.

[0075] In some examples, the target producer can be identified based on the producer identifier of the target producer in the data production request message, and then the permissions of the target producer can be determined based on the correspondence between data producers and their respective permissions in the access center.

[0076] In other examples, the permissions of the target producer can be determined based on the target producer's permission identifier in the data production request message.

[0077] The permissions of the target producer can limit which clusters of the distributed messaging system the target producer can write data to, and what data the target producer can write to the distributed messaging system, etc., but this is not limited here.

[0078] The permissions of the target producer can be pre-negotiated and determined between the target producer and the access center. In some examples, after the target producer and the access center have pre-negotiated and determined the target producer's permissions, the access center device can send a second token to the target producer through the producer terminal, so that the target producer can use the second token to represent the target producer's permissions when writing data later.

[0079] In step S209, a second management configuration message is sent to the producer device so that the producer device sends data corresponding to the second data table information to the cluster of the distributed messaging system indicated by the second data table information.

[0080] The second management configuration message includes second data table information. This second data table information is part of the management configuration information. It includes the portion of the data table that matches the permissions of the target producer. For example, the second data table information includes cluster information and / or field information that matches the permissions of the data table with those of the target producer.

[0081] Based on the second data table information, the producer device can determine the cluster indicated by the second data table information in the distributed messaging system, and also determine the data indicated by the second data table information. The cluster indicated by the second data table information is the cluster whose permissions match those of the target producer. The data indicated by the second data table information is the data whose permissions match those of the target producer. The producer device sends the data whose permissions match those of the target producer to the cluster whose permissions match those of the target producer, thereby writing the data whose permissions match those of the target producer to the cluster whose permissions match those of the target producer.

[0082] In some examples, the producer device can be configured with a synchronizer to periodically poll the central device via data production request messages to obtain a second management configuration message. This facilitates timely updates of the data indicated by the second data table information that can be written to the cluster and the data indicated by the second data table information that can be written to the distributed messaging system, in the event of an update to the second management configuration message.

[0083] The producer device can install a producer client plugin, which enables the relevant operations in the data access control method of this application embodiment. The producer client plugin is compatible with the existing interfaces of the distributed messaging system, such as application programming interfaces (APIs), allowing for simple data publishing and writing. The operation of the producer device is transparent to the business system corresponding to the target producer. The producer client plugin is plug-and-play, minimizing the impact on the development and modification of the business system corresponding to the target producer. The business system corresponding to the target producer can easily access the distributed messaging system under the restrictions of access control and security.

[0084] In some embodiments, the data production request message includes a second token. The producer device may request the second token from the access center device in advance, and in subsequent data access control processes, it can directly use the second token to obtain the corresponding second management configuration message. Figure 6 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application. Figure 6 and Figure 5 The difference is that, Figure 6 The data access control method shown may further include steps S210 to S212.

[0085] In step S210, a second authorization authentication message sent by the producer device is received.

[0086] The second authentication message is used to request authentication from the access center device for the target producer, and may include the target producer's user identifier and password. The user identifier can be found in the relevant description in the above embodiments, and will not be repeated here.

[0087] In step S211, the target producer is authenticated based on its user ID and password.

[0088] Based on the target producer's user identifier and password in the second authentication message, the target producer's identity can be authenticated, thereby authenticating the target producer's permissions. If the target producer's user identifier and password in the second authentication message match the target producer's login information pre-stored in the access center device, the target producer's authentication is considered successful. If the target producer's user identifier and password in the second authentication message do not match the target producer's login information pre-stored in the access center device, the target consumer's authentication is considered to have failed.

[0089] In step S212, if authentication is successful, a second token corresponding to the target producer's user identifier and user password is obtained and sent to the producer device.

[0090] Successful authentication indicates that the person operating the producer device is the target producer, and a second token can be provided to the target producer.

[0091] If this authentication is the target producer's first authentication, the access center device can assign a second token to the target producer, that is, generate a second token corresponding to the target producer's user identifier and user password, and send the second token to the producer device. This allows the target producer to directly use the second token to obtain the second management configuration message from the access center device in subsequent data access control processes, without having to perform authentication every time, simplifying the process and improving the efficiency of data access control.

[0092] If this authentication is not the target producer's first authentication, for example, if the target producer changes its producer equipment, the access center equipment can find the second token corresponding to the target producer and send the second token to the producer equipment, so that the target producer can directly use the second token to obtain the second management configuration message from the access center equipment in the subsequent data access control process.

[0093] By authenticating data producers using their user ID and password, a second token corresponding to their permissions is provided, preventing the misuse of other data producers' permissions and ensuring the security of data producers' data control access.

[0094] In this embodiment, the execution order of steps S207 to S212 and steps S201 to S203 is not limited. If the data written to the distributed message system in steps S207 to S212 is the same as the data obtained from the distributed message system in steps S201 to S203, then steps S207 to S212 can be executed before steps S201 to S203. If the data written to the distributed message system in steps S207 to S212 is unrelated to the data obtained from the distributed message system in steps S201 to S203, then steps S207 to S212 can be executed before, after, or during steps S201 to S203.

[0095] In some embodiments, SQL statements can also be used as input for managing and querying data tables and views. Figure 7 A flowchart of yet another embodiment of the data access control method provided in the first aspect of this application. Figure 7 and Figure 3 The difference is that, Figure 7 The data access control method shown may further include steps S213 to S216.

[0096] In step S213, the Structured Query Language (SQL) service interface is invoked to receive SQL statements.

[0097] In some examples, the access center device can be equipped with an SQL client, which can be used to submit SQL statements and call the SQL server interface to receive SQL statements.

[0098] In step S214, the SQL statement is parsed to determine its type.

[0099] SQL statements can be categorized into management and query types. Management SQL statements can include, but are not limited to, statements for creating, modifying, and deleting data tables, views, data producers, and data consumers. Statements for creating, modifying, and deleting data tables allow for the creation, modification, and deletion of metadata related to the distributed messaging system. Statements for creating, modifying, and deleting views allow for the creation, modification, and deletion of views and the processing rules required to create them. Statements for creating, modifying, and deleting data producers and consumers allow for the creation, modification, and deletion of data producers and consumers. Query SQL statements can include statements for querying data; the conditions for these queries are not limited.

[0100] In some examples, the access center device can be configured with an SQL access engine that can parse SQL statements and determine their type.

[0101] In step S215, if the SQL statement is of the management type, the Data Definition Language (DDL) function is invoked to execute the management operation indicated by the SQL statement.

[0102] The access center device can be configured with DDL functionality, which allows the execution of management operations indicated by SQL statements. Management operations may include creating, modifying, and deleting data tables, views, data producers, data consumers, etc., but are not limited to these operations.

[0103] In some examples, the access center device supports common syntax of Relational Database Management Systems (RDBMS), such as CREATE TABLE / VIEW / USER for creating data tables / views / users (i.e., data consumers and data producers), and GRANT / REVOKE SELECT / INSERT for granting permissions to users (i.e., data consumers and data producers).

[0104]

[0105]

[0106]

[0107]

[0108]

[0109] Figure 8 Figure 8

[0110]

[0111]

[0112]

[0113]

[0114]

[0115]

[0116]

[0117]

[0118]

[0119]

[0120]

[0121] Figure 9 Figure 9 Figure 8 Figure 9

[0122]

[0123]

[0124]

[0125]

[0126]

[0127]

[0128]

[0129]

[0130] Figure 10 Figure 10 Figure 8 Figure 10

[0131]

[0132]

[0133]

[0134]

[0135]

[0136] Figure 11 Figure 11

[0137]

[0138] Figure 11

[0139]

[0140] Figure 11

[0141]

[0142]

[0143] Figure 12 Figure 12

[0144]

[0145]

[0146]

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153] Figure 13 Figure 13 Figure 12

[0154]

[0155]

[0156]

[0157]

[0158]

[0159]

[0160]

[0161]

[0162]

[0163]

[0164]

[0165]

[0166]

[0167]

[0168]

[0169] Figure 14 Figure 14 Figure 12

[0170]

[0171]

[0172]

[0173]

[0174]

[0175]

[0176] Figure 15 Figure 15

[0177]

[0178]

[0179]

[0180]

[0181]

[0182]

[0183]

[0184]

[0185]

[0186]

[0187]

[0188]

[0189]

[0190]

[0191]

[0192]

[0193]

[0194]

[0195]

[0196]

[0197] Figure 16 Figure 16

[0198]

[0199]

[0200]

[0201] Figure 16

[0202]

[0203]

[0204] Figure 17 Figure 17

[0205]

[0206]

[0207]

[0208] Figure 17

[0209]

[0210]

[0211]

[0212]

[0213]

[0214]

[0215]

[0216]

[0217]

[0218] The system supports viewing data tables / views / users (i.e., data consumers and data producers) using DESCRIBE TABLE / VIEW / USER, but this is not limited. In step S216, if the SQL statement type is query-based, the query operation indicated by the SQL statement is executed on the data table and / or view information, and a trigger message is sent to the consumer device. The trigger message is used to trigger the consumer device to retrieve data from the distributed messaging system based on the data table and view information after the query operation. By executing the query operation indicated by the SQL statement on the data table and / or view information, the first data table information and the first view information obtained by the consumer device are changed, and the corresponding view will also change. Data can be retrieved from the distributed messaging system using the changed first data table information and the changed view, thus enabling the querying of data in the distributed messaging system. In some examples, the access center device may also support common RDBMS syntax such as SELECT...FROM TABLE / VIEW...WHERE...LIMIT for querying data from data tables and views in the distributed messaging system. The execution order of steps S213 to S216 and steps S201 to S203 is not limited in this embodiment. Steps S213 to S216 can be executed before, after, or during steps S201 to S203. By accessing the DDL function of the central device and sending trigger messages to the consumer device, the consumer device is triggered to retrieve data from the distributed messaging system based on the first data table information and view information after the query operation. This enables the distributed messaging system to have relatively complete SQL access capabilities, that is, to establish a lightweight SQL access capability based on the distributed messaging system. This not only meets the needs of daily operation, maintenance, querying, and analysis of business systems and the distributed messaging system, but also makes the distributed messaging system as simple and easy to use as a database. When the view includes row data and column data, it can also support lightweight SQL queries on the row and column level data of the distributed messaging system, filling the gap that the current distributed messaging system does not support SQL queries. The second aspect of this application provides a data access control method that can be applied to a consumer device, that is, the data access control method can be executed by the consumer device. A flowchart of an embodiment of the data access control method provided by the second aspect of this application is shown. As shown, the data access control method may include steps S301 to S303. In step S301, a data consumption request message for a target consumer is sent to the access center device, so that the access center device determines the permissions of the target consumer based on the data consumption request message. The access center device stores a data table, which includes metadata of data in the distributed messaging system.In some examples, the data consumption request message may include a first token, which is used to represent the permissions of the target consumer. In step S302, a first management configuration message sent by the access center device is received. The first management configuration message includes first data table information and first view information. The first data table information includes the part of the data table that matches the permissions of the target consumer. The first view information is used to form a view corresponding to the processing rules that match the permissions of the target consumer. In step S303, a view is generated based on the first view information, and data is obtained from the distributed messaging system through the first data table information and the view. In some examples, the view may include row data and column data. In some examples, the processing rules include one or more of the following: row data filtering rules, column data filtering rules, field processing rules, and user-defined function rules. In some examples, the distributed messaging system includes Kafka. The specific content of steps S301 to S303 can be found in the relevant content of the above embodiments, and will not be repeated here. In the embodiments of this application, the consumer device sends a data consumption request message of the target consumer to the access center device so that the access center device can determine the permissions of the target consumer based on the data consumption request message. The consumer device receives a management configuration message sent by the access center device in response to a data consumption request message. The management configuration message includes data table information and view information matching the permissions of the target consumer. Based on the view information matching the permissions of the target consumer, the consumer device generates a view and retrieves data from the distributed messaging system using the data table information and view matching the permissions of the target consumer. Different data consumers retrieve data from the distributed messaging system using their respective data table information and views, which corresponds to their respective permissions. This eliminates the need to develop a separate data transfer service system for each data consumer, enabling access to filtered and anonymized data for different data consumers, reducing the resources consumed by data access control, and thus avoiding resource waste. In some embodiments, the data consumption request message includes a first token. The consumer device can request this first token from the access center device in advance. A flowchart of another embodiment of the data access control method provided in the second aspect of this application is shown. The difference between this and [the previous one] is that the data access control method shown may further include steps S304 and S305. In step S304, a first authorization authentication message is sent to the access center device to authenticate the target consumer. The first authorization authentication message includes the user identifier and user password of the target consumer. In step S305, if authentication is successful, a first token corresponding to the target consumer's user identifier and password is received from the access center device. The specific details of steps S304 and S305 can be found in the relevant descriptions in the above embodiments, and will not be repeated here. In some embodiments, the data table also includes cluster information of the distributed messaging system.In the distributed messaging system, data is sent by the producer device based on the second data table information in the received second management configuration message. The second data table information includes a portion of the data table that matches the permissions of the target producer. The second management configuration message is generated based on the permissions of the target producer determined by the data production request message and sent by the access center device. The data production request message is sent by the producer device. In some examples, the data production request message includes a second token, which is used to represent the permissions of the target producer. In some examples, the second token is obtained by the access center device after successful authentication based on the target producer's user identifier and user password and sent to the producer device. Specific details related to the producer device can be found in the relevant descriptions in the above embodiments, and will not be repeated here. In some embodiments, SQL statements can also be used as input for the management and querying of data tables and views. A flowchart of another embodiment of the data access control method provided in the second aspect of this application is shown. The difference between this and [the previous one] is that the data access control method shown may further include steps S306 and S307. In step S306, a trigger message sent by the access center device is received. The trigger message is sent by the access center device when the received Structured Query Language (SQL) statement is of the query type, and the SQL statement indicates a query operation on the data table and / or view information. In step S307, in response to the trigger message, data is retrieved from the distributed messaging system based on the data table and view information after the query operation. The specific content of steps S306 and S307 can be found in the relevant descriptions in the above embodiments, and will not be repeated here. The execution order of steps S306 and S307 from steps S301 to S303 is not limited in this application embodiment. Steps S306 and S307 can be executed before, after, or during steps S301 to S303. For ease of understanding, the logical architecture of the data access control method in this application embodiment is described below using a Kafka cluster as an example of the distributed messaging system. A schematic diagram illustrating an example of the logical architecture of the data access control method provided in this application embodiment is shown below. As shown, the logical architecture of this data access control method may include one center, one service, and three clients. The center is the access center 41, the service is the SQL access service 42, and the three clients include a consumer client 43, a producer client 44, and an SQL client 45. Consumer client 43 corresponds to business system A1, and producer client 44 corresponds to business system A2. Producer client 44 and consumer client 45 can interact with the Kafka cluster 46. The data access control flow in this embodiment may include a producer client data sending flow, a consumer client data consumption flow, and an SQL access flow. These three flows will be described in turn below.Producer Client Data Sending Flow: Producer client 44 may have security authentication, synchronizer, and customized producer functions. Access center 41 has security authentication service, configuration synchronization service, and DDL service. As shown, in step a1, producer client 44 can use a username and password to authenticate with access center 41. After successful authentication, a token is obtained, and subsequent operations are performed using the token to execute the data sending flow. In step a2, producer client 44 configures the synchronizer to periodically poll the interface of access center 41 to obtain management configuration data and obtain authorized data table information. In step a3, producer client 44 can connect to the corresponding Kafka cluster 46 through customized producer functions and send data to the Kafka cluster 46 corresponding to the specified data table. Consumer Client Data Consumption Flow: Consumer client 43 may have security authentication, synchronizer, SQL query engine, and customized consumer functions. Access center 41 has security authentication service, configuration synchronization service, and DDL service. As shown, in step b1, consumer client 43 can authenticate with access center 41 using a username and password. After successful authentication, a token is obtained, and subsequent operations are performed using the token to execute the data consumption process. In step b2, consumer client 43 configures the synchronizer to periodically poll the interface of access center 41 to obtain management configuration data and obtain information on authorized data tables / views. If a change is found in the processing rules corresponding to the view, consumer client 43 uses the SQL query engine function to re-parse the processing rules. The processing rules can also be considered as a type of SQL rule. In step b3, consumer client 43 uses the customized consumer function to consume data from Kafka cluster 46 at the data table and view dimensions. In step b4, consumer client 43 uses the SQL query engine function to parse the processing rules (i.e., the SQL rules) and then connects to the streaming data, filtering and transforming the data according to the processing rules. The SQL access process: SQL client 45 may have SQL accesser functionality. SQL access service 42 has SQL access engine functionality. Access center 41 has security authentication service, configuration synchronization service, and DDL service. In step c1, SQL client 45 submits an SQL statement, calling the interface of SQL access service 42. In step c2, SQL access service 42 uses the SQL access engine to parse the SQL statement and determine its type. If it is a management-type SQL statement, it calls the DDL service of access center 41, such as creating, modifying, or deleting data tables, views, data consumers, data producers, etc., or modifying Kafka metadata. In step c3, if it is a query-type SQL statement, it calls consumer client 43 to consume data on demand, with the specific process being consistent with the consumer client's data consumption process. A third aspect of this application provides an access center device that stores data tables, including metadata of data in a distributed messaging system.This is a schematic diagram of an embodiment of an access center device provided in the third aspect of this application. As shown, the access center device 500 may include a receiving module 501, a permission determination module 502, and a sending module 503. The receiving module 501 can be used to receive a data consumption request message for a target consumer sent by a consumer device. In some examples, the data consumption request message includes a first token, which is used to characterize the permissions of the target consumer. The permission determination module 502 can be used to determine the permissions of the target consumer based on the data consumption request message. The sending module 503 can be used to send a first management configuration message to the consumer device, so that the consumer device can obtain data from the distributed messaging system through first data table information and a view generated based on first view information. The first management configuration message includes first data table information and first view information. The first data table information includes the portion of the data table that matches the permissions of the target consumer. The first view information is used to form a view corresponding to the processing rules that match the permissions of the target consumer. In some examples, the view includes row data and column data. In some examples, the processing rules include one or more of the following: row data filtering rules, column data filtering rules, field processing rules, and user-defined function rules. In some examples, the distributed messaging system includes Kafka. In this embodiment, the access center device stores a data table containing metadata of data in the distributed messaging system. Based on a data consumption request message received from a consumer device, the access center device can determine the permissions of the target consumer and send a management configuration message matching the target consumer's permissions. The data table information in the management configuration message may include the portion of the data table matching the target consumer's permissions, and the view information in the management configuration message can be used to form a view corresponding to the processing rules matching the target consumer's permissions. The consumer terminal obtains data from the distributed messaging system based on the data table information in the management configuration message and the view generated based on the view information. Different data consumers obtain data from the distributed messaging system using their respective data table information and views, which matches their respective permissions. This eliminates the need to develop a separate data transfer service system for each data consumer, enabling access to filtered, anonymized, and other processed data for different data consumers. This reduces the resources occupied by data access control, thereby avoiding resource waste. The diagram below illustrates another embodiment of the access center device provided in the third aspect of this application. The difference between this and [the previous embodiment] is that the access center device 500 may further include an authentication module 504 and a token acquisition module 505. The receiving module 501 described above can also be used to receive a first authentication message sent by the consumer device. The first authentication message includes the target consumer's user identifier and user password.The authentication module 504 can be used to authenticate the target consumer based on the target consumer's user ID and user password; the token acquisition module 505 can be used to acquire a first token corresponding to the target consumer's user ID and user password if the authentication is successful. The sending module 503 can also be used to send the first token to the consumer device. In some embodiments, the data table further includes cluster information of the distributed messaging system. The receiving module 301 can also be used to receive a data production request message from the producer device for the target producer. In some examples, the data production request message includes a second token, which represents the permissions of the target producer. The permission determination module 502 can also be used to determine the permissions of the target producer based on the data production request message; the sending module 503 can also be used to send a second management configuration message to the producer device, the second management configuration message including second data table information, so that the producer device sends data corresponding to the second data table information to the cluster of the distributed messaging system indicated by the second data table information, the second data table information including the portion of the data table that matches the permissions of the target producer. In some embodiments, the receiving module 301 can also be used to receive a second permission authentication message from the producer device. The second permission authentication message includes the target producer's user ID and user password. The authentication module 504 described above can also be used to authenticate the target producer based on the target producer's user identifier and user password. The token acquisition module 505 described above can also be used to acquire a second token corresponding to the target producer's user identifier and user password upon successful authentication. The sending module 503 described above can also be used to send the second token to the producer device. This is a schematic diagram of the structure of another embodiment of the access center device provided in the third aspect of this application. The difference from [previous embodiment] is that the access center device 500 may further include an SQL service module 506, a parsing module 507, and an execution module 508. The SQL service module 506 can be used to call the SQL service interface to receive SQL statements. The parsing module 507 can be used to parse the SQL statements and determine the type of the SQL statements. The execution module 508 can be used to call the data definition language function to execute the management operation indicated by the SQL statement when the type of the SQL statement is management-type; the execution module 508 can also be used to execute the query operation indicated by the SQL statement on the data table and / or view information when the type of the SQL statement is query-type. The sending module 503 described above can also be used to send a trigger message to the consumer device when the type of the SQL statement is query-type. A trigger message is used to instruct a consumer device to retrieve data from a distributed messaging system based on data table and view information after a query operation. A fourth aspect of this application provides a consumer device. The diagram below illustrates an embodiment of the consumer device provided in this fourth aspect. As shown, the consumer device 600 may include a sending module 601, a receiving module 602, and a processing module 603.The sending module 601 can be used to send a data consumption request message for the target consumer to the access center device, so that the access center device can determine the target consumer's permissions based on the data consumption request message. In some examples, the data consumption request message includes a first token, which is used to represent the target consumer's permissions. The access center device stores a data table, which includes metadata of the data in the distributed messaging system. The receiving module 602 can be used to receive a first management configuration message sent by the access center device. The first management configuration message includes first data table information and first view information. The first data table information includes the portion of the data table that matches the target consumer's permissions. The first view information is used to form a view corresponding to the processing rules that match the target consumer's permissions. In some examples, the processing rules include one or more of the following: row data filtering rules, column data filtering rules, field processing rules, and user-defined function rules. The processing module 603 can be used to generate a view based on the first view information and obtain data from the distributed messaging system through the first data table information and the view. In some examples, the view includes row data and column data. In some examples, the distributed messaging system includes Kafka. In this embodiment, the consumer device sends a data consumption request message for the target consumer to the access center device, enabling the access center device to determine the target consumer's permissions based on the data consumption request message. The consumer device receives a management configuration message sent by the access center device in response to the data consumption request message. The management configuration message includes data table information and view information matching the target consumer's permissions. The consumer device generates a view based on the view information matching the target consumer's permissions and retrieves data from the distributed messaging system using the data table information and view matching the target consumer's permissions. Different data consumers retrieve data from the distributed messaging system using their respective data table information and views, which corresponds to their respective permissions. This eliminates the need to develop a separate data transfer service system for each data consumer, enabling access to filtered and anonymized data for different data consumers, reducing the resources consumed by data access control, and thus avoiding resource waste. In some embodiments, the data consumption request message includes a first token. The sending module 601 can also be used to send a first authorization authentication message to the access center device, enabling the access center device to authenticate the target consumer. The first authorization authentication message includes the target consumer's user identifier and user password. The receiving module 602 described above can also be used to receive, upon successful authentication, a first token sent by the access center device corresponding to the user identifier and password of the target consumer. In some embodiments, the data table further includes cluster information of a distributed messaging system. Data in the distributed messaging system is sent by the producer device based on the second data table information in the received second management configuration message. The second data table information includes the portion of the data table that matches the permissions of the target producer.The second management configuration message is generated based on the permissions of the target producer determined by the data production request message and sent by the access center device. The data production request message is sent by the producer device. In some examples, the data production request message includes a second token, which is used to characterize the permissions of the target producer. In some embodiments, the receiving module 602 described above can also be used to receive a trigger message sent by the access center device. The trigger message is sent by the access center device when the received SQL statement is of the query type, and the query operation is performed on the data table and / or view information according to the SQL statement. The processing module 603 described above can also be used to retrieve data from the distributed messaging system based on the data table and view information after the query operation in response to the trigger message. The fifth aspect of this application also provides an access center device. A schematic diagram of the structure of an embodiment of the access center device provided by the fifth aspect of this application is shown. As shown, the access center device 700 includes a memory 701, a processor 702, and a computer program stored on the memory 701 and executable on the processor 702. In one example, the processor 702 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application. Memory 701 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the data access control method according to the embodiments of the first aspect of this application. Processor 702 runs a computer program corresponding to the executable program code stored in memory 701 to implement the data access control method described in the embodiments of the first aspect above. In one example, access center device 700 may also include a communication interface 703 and a bus 704. As shown, memory 701, processor 702, and communication interface 703 are connected via bus 704 and communicate with each other. The communication interface 703 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application. Input devices and / or output devices can also be accessed through the communication interface 703. The bus 704 includes hardware, software or both, and couples the components of the access center device 700 together.For example, and not as a limitation, bus 704 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 704 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect. A sixth aspect of this application also provides a consumer device. This is a schematic diagram illustrating an embodiment of a consumer device provided in the sixth aspect of this application. As shown, the consumer device 800 includes a memory 801, a processor 802, and a computer program stored on the memory 801 and executable on the processor 802. In one example, the processor 802 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of this application. The memory 801 may include read-only memory (ROM), random access memory (RAM), a disk storage medium, an optical storage medium, a flash memory, or an electrical, optical, or other physical / tangible memory storage device.Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the data access control method in the embodiments of the second aspect of this application. Processor 802 runs a computer program corresponding to the executable program code stored in memory 801 to implement the data access control method in the embodiments of the second aspect described above. In one example, consumer device 800 may also include a communication interface 803 and a bus 804. As shown, memory 801, processor 802, and communication interface 803 are connected via bus 804 and communicate with each other. Communication interface 803 is mainly used to realize communication between modules, devices, units, and / or equipment in the embodiments of this application. Input devices and / or output devices can also be accessed through communication interface 803. Bus 804 includes hardware, software, or both, coupling components of consumer device 800 together. For example, and not as a limitation, bus 804 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 804 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect. A seventh aspect of this application also provides a data access control system. The data access control system may include the access center device and consumer device as described in the above embodiments.The specific details of the access center device and consumer device can be found in the relevant descriptions in the above embodiments, and will not be repeated here. Access center device 11, access center device 500, and access center device 700 in the above embodiments can all serve as access center devices in this data access control system. Similarly, consumer device 12, consumer device 600, and consumer device 800 in the above embodiments can all serve as consumer devices in this data access control system. In some embodiments, the data access control system may further include producer devices. Producer devices can be used to: send a data production request message from a target producer to the access center device, so that the access center device determines the permissions of the target producer based on the data production request message; the data table also includes cluster information of a distributed messaging system; receive a second management configuration message sent by the access center device, the second management configuration message including second data table information, the second data table information including a portion of the data table matching the permissions of the target producer; and send data corresponding to the second data table information to the cluster of the distributed messaging system indicated by the second data table information. Producer device 14 in the above embodiments and producer devices in the data access control method can all serve as producer devices in this data access control system. The specific details of the producer equipment can be found in the relevant descriptions in the above embodiments, and will not be repeated here. In some embodiments, the data access control system may also include the distributed messaging system in the above embodiments. The distributed messaging system 13 in the above embodiments and the distributed messaging system in the data access control method can both serve as the distributed messaging system in the data access control system. The specific details of the distributed messaging system can be found in the relevant descriptions in the above embodiments, and will not be repeated here. The eighth aspect of this application also provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are executed by a processor, they can implement the model publishing method in the distributed system in the embodiments of the first or second aspect above, and can achieve the same technical effect. To avoid repetition, they will not be repeated here. The computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc., and is not limited here. It should be noted that the various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments. For the embodiments of access center device, consumer device, data access control system, and computer-readable storage medium, relevant details can be found in the description section of the method embodiments.This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here. The above description of various aspects of this application is based on flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowcharts and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented by dedicated hardware performing the specified function or action, or by a combination of dedicated hardware and computer instructions. Those skilled in the art should understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The function of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A data access control method characterized by, The method is applied to an access center device, the access center device stores a data table, the data table includes metadata of data in a distributed message system, metadata management capability is given to the distributed message system by storing metadata in the form of table structure information, and the method includes the following steps: Receiving a data consumption request message of a target consumer sent by a consumer device; According to the data consumption request message, determining the authority of the target consumer; Sending a first management configuration message to the consumer device, the first management configuration message including first data table information and first view information, so that the consumer device obtains data from the distributed message system through the first data table information and a view generated based on the first view information, the first data table information including a part of the data table matching the authority of the target consumer, and the first view information being used to form a view corresponding to a processing rule matching the authority of the target consumer.

2. The method of claim 1, wherein, The data consumption request message includes a first Token, and the first Token is used to represent the authority of the target consumer.

3. The method of claim 2, wherein, Before receiving the data consumption request message of the target consumer sent by the consumer device, the method further includes the following steps: Receiving a first authority authentication message sent by the consumer device, the first authority authentication message including a user identifier and a user password of the target consumer; According to the user identifier and the user password of the target consumer, authenticating the target consumer; If the authentication is successful, obtaining the first Token corresponding to the user identifier and the user password of the target consumer, and sending the first Token to the consumer device.

4. The method of claim 1, wherein, The view includes row data and column data.

5. The method of claim 1, wherein, The processing rule includes one or more of the following: Row data filtering rule, column data filtering rule, field processing rule, and custom function rule.

6. The method of claim 1, wherein, The data table further includes cluster information of the distributed message system, The method further includes the following steps: Receiving a data production request message of a target producer sent by a producer device; According to the data production request message, determining the authority of the target producer; Sending a second management configuration message to the producer device, the second management configuration message including second data table information, so that the producer device sends data corresponding to the second data table information to a cluster of the distributed message system indicated by the second data table information, and the second data table information including a part of the data table matching the authority of the target producer.

7. The method of claim 6, wherein, The data production request message includes a second Token, and the second Token is used to represent the authority of the target producer.

8. The method of claim 7, wherein, Before receiving the data production request message of the target producer sent by the producer device, the method further includes the following steps: Receiving a second authority authentication message sent by the producer device, the second authority authentication message including a user identifier and a user password of the target producer; According to the user identifier and the user password of the target producer, authenticating the target producer; In the case of successful authentication, the second Token corresponding to the user identifier and the user password of the target producer is obtained, and the second Token is sent to the producer device.

9. The method of claim 1, wherein, Further comprising: calling a structured query language (SQL) service interface to receive an SQL statement; parsing the SQL statement to determine the type of the SQL statement; in the case of the type of the SQL statement being a management class, calling a data definition language (DDL) function to perform a management operation indicated by the SQL statement; in the case of the type of the SQL statement being a query class, performing a query operation indicated by the SQL statement on the data table and / or view information, and sending a trigger message to the consumer device, the trigger message being used to trigger the consumer device to obtain data from the distributed message system based on the data table and view information after the query operation.

10. The method according to any one of claims 1 to 9, characterized in that, The distributed message system comprises Kafka.

11. A data access control method characterized by, The method applied to a consumer device comprises: sending a data consumption request message of a target consumer to an access center device, so that the access center device determines the authority of the target consumer according to the data consumption request message, the access center device storing a data table, the data table comprising metadata of data in a distributed message system, and the distributed message system being given a metadata management capability by storing metadata in the form of table structure information; receiving a first management configuration message sent by the access center device, the first management configuration message comprising first data table information and first view information, the first data table information comprising a part of the data table matching the authority of the target consumer, and the first view information being used to form a view corresponding to a processing rule matching the authority of the target consumer; generating a view based on the first view information, and obtaining data from the distributed message system through the first data table information and the view.

12. The method of claim 11, wherein, The data consumption request message comprises a first Token, and the first Token is used to represent the authority of the target consumer.

13. The method of claim 12, wherein, Before the data consumption request message of the target consumer is sent to the access center device, the method further comprises: sending a first authority authentication message to the access center device, the first authority authentication message comprising a user identifier and a user password of the target consumer, so that the access center device authenticates the target consumer; in the case of successful authentication, receiving the first Token corresponding to the user identifier and the user password of the target consumer sent by the access center device.

14. The method of claim 11, wherein, The view comprises row data and column data.

15. The method of claim 11, wherein, The processing rule comprises one or more of the following: row data filtering rule, column data filtering rule, field processing rule, and custom function rule.

16. The method of claim 11, wherein, The data table further comprises cluster information of the distributed message system, The data in the distributed message system is sent by a producer device based on second data table information in a received second management configuration message, the second data table information including a part of the data table matching the authority of a target producer, the second management configuration message being generated by the access center device based on the authority of the target producer determined based on a data production request message sent by the producer device.

17. The method of claim 16, wherein, The data production request message includes a second Token, and the second Token is used to represent the authority of the target producer.

18. The method of claim 17, wherein, The second Token is obtained and sent to the producer device by the access center device in a case where authentication based on a user identifier and a user password of the target producer is successful.

19. The method of claim 11, wherein, Further comprising: receiving a trigger message sent by the access center device, the trigger message being sent by the access center device in a case where the type of a received structured query language (SQL) statement is query, and the access center device performing a query operation indicated by the SQL statement on the data table and / or view information; in response to the trigger message, obtaining data from the distributed message system based on the data table and view information after the query operation.

20. The method of any one of claims 11 to 19, wherein, The distributed message system includes Kafka.

21. An access center device, comprising: The access center device stores a data table, the data table including metadata of data in a distributed message system, and the distributed message system is given a metadata management capability by storing the metadata in the form of table structure information, and the access center device includes: a receiving module configured to receive a data consumption request message of a target consumer sent by a consumer device; an authority determination module configured to determine the authority of the target consumer according to the data consumption request message; a sending module configured to send a first management configuration message to the consumer device, the first management configuration message including first data table information and first view information, so that the consumer device obtains data from the distributed message system through the first data table information and a view generated based on the first view information, the first data table information including a part of the data table matching the authority of the target consumer, and the first view information being used to form a view corresponding to a processing rule matching the authority of the target consumer.

22. A consumer device, characterized by Further comprising: a sending module configured to send a data consumption request message of a target consumer to an access center device, so that the access center device determines the authority of the target consumer according to the data consumption request message, and the access center device stores a data table, the data table including metadata of data in a distributed message system, and the distributed message system is given a metadata management capability by storing the metadata in the form of table structure information. receiving a first management configuration message sent by the access center device, the first management configuration message comprising first data table information and first view information, the first data table information comprising a part of the data table matching the authority of the target consumer, and the first view information being used to form a view corresponding to a processing rule matching the authority of the target consumer; generating a view based on the first view information, and obtaining data from the distributed message system through the first data table information and the view.

23. An access center device, comprising: comprising: a processor and a memory storing computer program instructions; the processor implements the data access control method in any one of claims 1-10 when executing the computer program instructions.

24. A consumer device, characterized by comprising: a processor and a memory storing computer program instructions; the processor implements the data access control method in any one of claims 11-20 when executing the computer program instructions.

25. A data access control system, characterized by comprising the access center device in claim 23 and the consumer device in claim 24.

26. The system of claim 25, wherein, Further comprising a producer device, the producer device being configured to: send a data production request message of a target producer to the access center device, so that the access center device determines the authority of the target producer according to the data production request message, and the data table further comprises cluster information of the distributed message system; receive a second management configuration message sent by the access center device, the second management configuration message comprising second data table information, the second data table information comprising a part of the data table matching the authority of the target producer; send data corresponding to the second data table information to a cluster of the distributed message system indicated by the second data table information.

27. The system of claim 25, wherein, Further comprising a distributed message system.

28. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and the computer program instructions are executed by the processor to implement the data access control method in any one of claims 1-20.

Images