A permission control method and related apparatus

Abstract

The application discloses a permission control method and related devices, wherein the permission control method comprises the following steps: after receiving a SQL statement executed by a current user, parsing and verifying the SQL statement to obtain an operation operation tree corresponding to the SQL statement; identifying an operation type and operation information of the operation operation tree; transmitting the operation type and the operation information to a Ranger plug-in, so that the Ranger plug-in judges whether the current user has an operation permission of a database according to the operation type and the operation information; if yes, the SQL statement is continuously executed; otherwise, information of a permission exception is returned. Through the above method, pre-control and fine control of user permissions can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed computing, and particularly relates to a permission control method and related device. BACKGROUND

[0002] In recent years, big data platforms have attracted widespread attention due to their ability to manage massive amounts of data assets. Among them, data security is a topic that cannot be ignored. Generally, data security is achieved through two main steps: identity authentication and permission control. For the Hadoop big data ecosystem, Ranger is the preferred solution for implementing permission control functions.

[0003] In the prior art, permission verification actions are usually performed during the running stage of Flink tasks, or additional services such as thriftserver services are enabled to provide permission control permissions similar to Hiveserver2 services. However, the present inventors have found through long-term research that the above technical solutions have problems such as resource waste and permission management lag, which may result in invalid Flink tasks being submitted to the cluster, producing dirty data. In addition, the prior art also has problems such as too large permission control granularity, which cannot cope with rich scenarios. SUMMARY

[0004] The technical problem solved by the present application is to provide a permission control method and related device that can achieve pre-control and fine-grained control of user permissions.

[0005] To solve the above technical problems, one technical solution adopted by the present application is to provide a permission control method, comprising: after receiving a SQL statement executed by a current user, parsing and verifying the SQL statement to obtain an operation operation tree corresponding to the SQL statement; identifying the operation type and operation information of the operation operation tree; transmitting the operation type and the operation information to a Ranger plug-in, so that the Ranger plug-in determines whether the current user has the operation permission of the database according to the operation type and the operation information; if yes, the SQL statement is continued to be executed; otherwise, information of a permission exception is returned.

[0006] The step of identifying the operation type and the operation information of the operation operation tree comprises: sequentially arranging and storing all first nodes in the operation operation tree into a first queue to form a plurality of first storage nodes; sequentially obtaining each first storage node of the first queue, and identifying the current first storage node to obtain the corresponding operation type and operation information; determining whether the current first storage node has a first child node; if yes, sequentially arranging and storing the first child node to the end of the first queue, and returning to the step of sequentially obtaining each first storage node of the first queue; otherwise, determining whether all first storage nodes in the first queue are traversed, if yes, filtering out the operation type and the operation information related to the HIVE table in the database, otherwise, returning to the step of sequentially obtaining each first storage node of the first queue.

[0007] The step of identifying the operation type and the operation information of the operation operation tree comprises: sequentially arranging and storing all first nodes in the operation operation tree into a first queue to form a plurality of first storage nodes; sequentially obtaining each first storage node of the first queue, and identifying the current first storage node to obtain the corresponding operation type and operation information; determining whether the current first storage node has a first child node; if yes, sequentially arranging and storing the first child node to the end of the first queue, and returning to the step of sequentially obtaining each first storage node of the first queue; otherwise, determining whether all first storage nodes in the first queue are traversed, if yes, filtering out the operation type and the operation information related to the HIVE table in the database, otherwise, returning to the step of sequentially obtaining each first storage node of the first queue.

[0008] The step of identifying the operation type and the operation information of the operation operation tree comprises: sequentially arranging and storing all first nodes in the operation operation tree into a first queue to form a plurality of first storage nodes; sequentially obtaining each first storage node of the first queue, and identifying the current first storage node to obtain the corresponding operation type and operation information; determining whether the current first storage node has a first child node; if yes, sequentially arranging and storing the first child node to the end of the first queue, and returning to the step of sequentially obtaining each first storage node of the first queue; otherwise, determining whether all first storage nodes in the first queue are traversed, if yes, filtering out the operation type and the operation information related to the HIVE table in the database, otherwise, returning to the step of sequentially obtaining each first storage node of the first queue.

[0009] The step of identifying the current second storage node to obtain the operation type and operation information corresponding to the current second storage node comprises: obtaining the operation type of the current second storage node, and determining whether the operation type is a Project type; if yes, determining whether the current second storage node is the first node of the Project type in the second queue; if yes, parsing the operation information in the current second storage node that can be mapped to the second sub-node; otherwise, obtaining the operation type and the operation information corresponding to the current second storage node; otherwise, directly obtaining the operation type and the operation information corresponding to the current second storage node.

[0010] The step of transmitting the operation type and the operation information to the Ranger plug-in, so that the Ranger plug-in determines whether the current user has the operation permission of the database according to the operation type and the operation information, comprises: transmitting the operation information related to the HIVE table in the database to the Ranger plug-in; obtaining a data persistence directory according to the metadata information of the HIVE table; and the Ranger plug-in determines whether the current user has the operation permission of the database by using the persistence directory, the operation type and the operation information.

[0011] The step of continuing to execute the SQL statement further comprises: obtaining the logical plan tree corresponding to the SQL statement; optimizing the logical plan tree by using a set of optimization rules in the Blink optimizer; generating a physical execution plan tree according to the optimized logical plan tree; and generating a Flink task by using the physical execution plan tree.

[0012] The operation information comprises table field information including a library name, a table name and a field name.

[0013] To solve the above technical problems, another technical solution adopted by the present application is to provide a permission control device comprising a memory and a processor coupled to each other, the memory storing program instructions, the program instructions being used to be executed by the processor to implement the permission control method mentioned in any of the above embodiments.

[0014] To solve the above technical problems, another technical solution adopted by the present application is to provide a computer readable storage medium, the computer readable storage medium storing a computer program, the computer program being used to implement the permission control method mentioned in any of the above embodiments.

[0015] Differently from the prior art, the application has the beneficial effects that: the application provides a permission control method and related device, wherein the permission control method comprises the following steps: after receiving a SQL statement executed by a current user, the SQL statement is parsed and verified to obtain an operation operation tree corresponding to the SQL statement; the operation type and operation information of the operation operation tree are identified; the operation type and the operation information are transmitted to a Ranger plug-in, so that the Ranger plug-in judges whether the current user has an operation permission of a database according to the operation type and the operation information; if yes, the SQL statement is continuously executed; otherwise, information of a permission exception is returned. In the above manner, on the one hand, the method provided by the application completes the control action of the permission at the parsing level of the SQL statement, can realize the preposition of the operation permission verification stage, returns the permission exception information in advance, and provides better interactive experience for the user to execute the SQL statement; on the other hand, the operation information obtained according to the operation operation tree can realize the permission control of a finer granularity, and the permission control scene that can be realized is more abundant. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor. Among them:

[0017] Figure 1 is a flowchart of an embodiment of the permission control method of the application;

[0018] Figure 2 is Figure 1 is a flowchart of an embodiment of step S102 in the method;

[0019] Figure 3 is Figure 2 is a flowchart of an embodiment of step S202 in the method;

[0020] Figure 4 is Figure 3 is a flowchart of an embodiment of step S303 in the method;

[0021] Figure 5 is Figure 4 is a flowchart of an embodiment of step S402 in the method;

[0022] Figure 6 is Figure 1 is a flowchart of an embodiment of step S103 in the method;

[0023] Figure 7 is Figure 1is a flowchart of an embodiment of the method of controlling permissions according to the present application;

[0024] Figure 8 is a frame diagram of an embodiment of the permission control device according to the present application;

[0025] Figure 9 is a structure diagram of an embodiment of the permission control device according to the present application;

[0026] Figure 10 is a frame diagram of an embodiment of the computer readable storage medium according to the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.

[0028] The embodiments of the present application can be applied to the server side with a database and the Hadoop cluster to perform permission control of a big data platform. The method can be performed by a central processing module, which can be implemented by software and / or hardware and can be integrated in the server side.

[0029] Please refer to Figure 1 , Figure 1 is a flowchart of an embodiment of the method of controlling permissions according to the present application. The permission control method provided in the embodiment mainly includes the following steps:

[0030] S101: After receiving the SQL statement executed by the current user, the SQL statement is parsed and verified to obtain an operation operation tree corresponding to the SQL statement.

[0031] Specifically, the SQL statement is a database query and programming language, which is used to access data and query, update and manage a database system. The SQL statement can realize data access and extraction in the database, that is, when the user inputs the SQL statement to be executed, the corresponding data can be accessed from the database.

[0032] In the exemplary embodiments of the present application, in order to control the access permission of data in the data warehouse in the data platform, the step S101 specifically comprises: using a Calcite parser to parse the SQL statement according to a syntax rule to obtain an abstract syntax tree; and using a Flink SQL verifier to verify the syntax of the SQL statement, and generating an operation operation tree (Operation tree) according to the abstract syntax tree obtained after the verification is passed. It should be noted that the Calcite parser is a dynamic data management framework, which can be used to construct a syntax analysis module of a database system, and the framework is used in the Flink SQL module to complete the SQL text analysis and logical execution plan optimization. Through the above steps, technical support can be provided for the subsequent implementation of the permission control of the present application.

[0033] S102: Identify the operation type and operation information of the operation operation tree.

[0034] Specifically, the operation operation tree (Operation tree) at least includes one or more combinations of the operation type, the operation table object, the database where the operation table is located, and the execution current user ID used in a specific application scenario or application system.

[0035] In a specific implementation scenario, the operation type involved in the SQL statement includes any one of SELECT, UPDATE, DROP, ALTER, CREATE, and USE. Of course, in other implementation scenarios, the operation type can also be other types, which are not limited here.

[0036] In another specific implementation scenario, the operation information includes table field information such as library name, table name, and field name. The table field information is a short name of the operation information of the library, table, and field. In this embodiment, the permission control is performed at the field level, the permission granularity is finer, and the scenario of the permission control is more abundant.

[0037] In addition, the specific identification process of obtaining the operation type and the operation information involves a special Operation tree analysis algorithm, and the specific process of the algorithm will be described in detail in subsequent embodiments.

[0038] S103: Transmit the operation type and the operation information to the Ranger plug-in, so that the Ranger plug-in determines whether the current user has the operation permission of the database according to the operation type and the operation information.

[0039] Specifically, the Ranger (Apache Ranger) plug-in is a framework for enabling, monitoring, and managing comprehensive data security across the entire Hadoop platform. The framework stores specific permissions of each user, including the permissions of the user when operating in the data platform, including but not limited to the modification permissions in the above operation types and default permissions.

[0040] S104: If yes, continue to execute the SQL statement.

[0041] S105: If no, return the information of the permission exception.

[0042] Specifically, when the operation type included in the SQL statement is contained in the user permissions stored in the Ranger plug-in, it indicates that the operation type in the SQL statement is allowed to be executed, otherwise it will be prevented from being executed.

[0043] Through the above implementation, on the one hand, the control action of the permission is completed at the parsing level of the SQL statement, which can realize the preposition of the operation permission verification stage, return the permission exception information in advance, and provide better interactive experience for the user to execute the SQL statement; on the other hand, the operation information obtained according to the operation operation tree can realize the permission control of a finer granularity, and the implementable permission control scene is more abundant.

[0044] Please refer to Figure 2 , Figure 2 is Figure 1 a flowchart of an embodiment of step S102 in

[0045] S201: sequentially arrange and store all first nodes in the operation operation tree into a first queue to form a plurality of first storage nodes.

[0046] Specifically, the first node here refers to the root node of the operation operation tree, and the first queue is a queue for storing the Operation nodes to be analyzed, which has the characteristics of first-in first-out, that is, the nodes in the queue are analyzed in the order of arrangement, and the analyzed nodes are deleted from the queue.

[0047] S202: sequentially obtain each first storage node of the first queue, and identify the current first storage node to obtain the corresponding operation type and operation information.

[0048] Specifically, the identification process of the operation type and operation information of the first storage node involves an Operation tree analysis algorithm, which will be described in detail in the following embodiments.

[0049] Please refer to Figure 3 ,Figure 3 yes Figure 2 A flowchart illustrating one embodiment of step S202. Step S202 may include the following steps:

[0050] S301: Get the operation type of the current first storage node.

[0051] Specifically, the operation types of the first storage node include, but are not limited to, modification permissions such as deleting a database, creating a database, creating a view, adding a list, modifying a peer, clearing a table, and deleting a partition, as well as default permissions for viewing lists, functions, and views.

[0052] S302: Determine whether the operation type is a planned query operation type.

[0053] Specifically, the full English name of the planned query operation type here is Planner Query Operation.

[0054] S303: If so, obtain the logical plan tree corresponding to the current first storage node, and identify the operation type and operation information corresponding to the logical plan tree.

[0055] Specifically, please refer to Figure 4 , Figure 4 yes Figure 3 A flowchart illustrating one embodiment of step S303. Step S303 specifically includes:

[0056] S401: Arrange all second nodes in the logical plan tree sequentially and store them in the second queue to form second storage nodes.

[0057] Specifically, the second node here refers to the root node of the logical plan tree, and the second queue is a queue used to store the Calcite logical plan nodes to be analyzed. It also has the first-in-first-out characteristic, that is, the nodes in the second queue are analyzed in the order of their arrangement, and the Calcite logical plan nodes that have been analyzed are deleted from the second queue.

[0058] S402: Sequentially obtain each second storage node in the second queue, and identify the current second storage node to obtain the corresponding operation type and operation information.

[0059] Please see Figure 5 , Figure 5 yes Figure 4 A flowchart illustrating one embodiment of step S402. Step S402 specifically includes:

[0060] S501: Get the operation type of the current second storage node.

[0061] Specifically, the operation types of the second storage node include, but are not limited to, deleting a database, creating a database, creating a view, adding a list, modifying a permission among deleting a partition, and a default permission of viewing a list, a function, and a view.

[0062] S502: Determine whether the operation type is a Project type.

[0063] S503: If yes, continue to determine whether the current second storage node is the first Project type node in the second queue.

[0064] Specifically, the above step determines whether the Project type node is first identified in the second queue. In other words, in the analysis algorithm provided in the embodiment, only the first encountered Project type node in the logical plan tree is identified.

[0065] S504: If yes, parse all operation information in the current second storage node that can be mapped to the second child node.

[0066] Specifically, the operation information involved in the embodiment includes table field information of the second child node, and the table field information is stored in tableColumnMap. It should be noted that tableColumnMap refers to a table specially used to store the latest database table field and its operation information collected during the identification process.

[0067] S505: If no, obtain the operation type and operation information corresponding to the current second storage node.

[0068] Specifically, in response to the node in the logical plan tree not being the first Project type node in the second queue, the operation type and operation information of the current node are directly obtained, and the obtained information is stored in tableColumnMap.

[0069] S506: If no, directly obtain the operation type and operation information corresponding to the current second storage node.

[0070] In response to the current second storage node not being a Project type node, the operation type and operation information corresponding to the current second storage node are directly stored in tableColumnMap.

[0071] Through the above embodiment, the identification process of the operation type and operation information of each second storage node in the second queue can be realized, and the obtained operation information includes field-level operation information, which can improve the refinement degree of permission control.

[0072] S403: Determine whether the current second storage node has a second child node.

[0073] Specifically, the second child node refers to the next level of nodes of the root node of the logical plan tree, which can be understood as a branch of the second node.

[0074] S404: If yes, the second child node is sequentially arranged and stored at the end of the second queue, and returns to step S402.

[0075] Specifically, in response to the current second storage node having a second child node, all second child nodes are arranged behind all second nodes, and after all second nodes are sequentially obtained, each second child node in the second queue is sequentially obtained.

[0076] S405: If no, continue to determine whether the second storage node in the second queue is traversed.

[0077] Specifically, in response to the current second storage node not having a second child node, it is determined whether all nodes in the second queue are traversed.

[0078] S406: If yes, return to step S203.

[0079] Specifically, in response to all nodes in the second queue being traversed, return to the step of determining whether the current first storage node has a first child node.

[0080] S407: If no, return to step S402.

[0081] Through the above implementation, it is ensured that all nodes in the logical plan tree are traversed, and the operation type and operation information corresponding to all nodes in the logical plan tree are obtained, ensuring the completeness of information acquisition and avoiding the occurrence of information omission.

[0082] S304: If no, obtain the operation type and operation information corresponding to the current first storage node.

[0083] Specifically, in response to the operation type of the current first storage node not being the plan query operation type, the operation type and operation information corresponding to the first storage node are directly stored in tableColumnMap.

[0084] Through the above implementation, the identification process of the operation type and operation information of each first storage node in the first queue can be realized.

[0085] S203: Determine whether the current first storage node has a first child node.

[0086] Specifically, the first child node refers to the next level of nodes of the root node of the Operation tree, which can be understood as a branch of the first node.

[0087] S204: If yes, the first child node is sequentially arranged and stored at the end of the first queue, and step S202 is returned.

[0088] Specifically, in response to the current first storage node having a first child node, the first child node is arranged behind all first nodes in the first queue, and each first child node in the first queue is sequentially obtained after all first nodes are sequentially obtained.

[0089] S205: If no, it is judged whether all first storage nodes in the first queue are traversed.

[0090] Specifically, in response to the current first storage node not having a first child node, it is continuously judged whether all first storage nodes in the first queue are traversed.

[0091] S206: If yes, the operation type and operation information related to the HIVE table in the database are filtered out.

[0092] Specifically, in response to all nodes in the first queue being traversed, all operation types and operation information stored in tableColumnMap are screened, and the operation type and operation information related to the HIVE table are retained. It should be noted that HIVE is a data warehouse tool based on Hadoop, which is used for data extraction, transformation and loading, and is a mechanism that can store, query and analyze large-scale data stored in Hadoop.

[0093] S207: If no, return to step S202.

[0094] Specifically, in response to all nodes in the first queue not being traversed, return to the step of sequentially obtaining each first storage node of the first queue.

[0095] Through the above implementation, all nodes in the Operation tree are traversed, and the operation type and operation information corresponding to all nodes in the Operation tree are obtained, ensuring the integrity of information acquisition and avoiding the occurrence of information omission.

[0096] Please refer to Figure 6 , Figure 6 is Figure 1 a flowchart of an embodiment of step S103 in

[0097] S601: The operation information related to the HIVE table in the database is filtered out and transmitted to the Ranger plug-in.

[0098] Specifically, Ranger is a framework for enabling, monitoring and managing comprehensive data security on the entire Hadoop platform.

[0099] S602: Obtain the data persistence directory according to the metadata information of the HIVE table.

[0100] S603: The Ranger plug-in determines whether the current user has the operation permission of the database by using the persistence directory, the operation type and the operation information.

[0101] Specifically, when the HIVE table needs to be accessed, the data persistence directory is obtained according to the metadata information of the HIVE table, and the read-write operation is performed on the data persistence directory. The read-write operation is controlled according to the Ranger plug-in installed on the server side.

[0102] Through the above embodiment, the judgment process of whether the user has the permission operation is completed based on the Ranger plug-in. The logic of the permission control is integrated in the internal of the SQL statement analysis, and the additional thrifserver service does not need to be resident, thereby saving the computing resources.

[0103] Please refer to Figure 7 , Figure 7 is Figure 1 the flowchart of an embodiment of step S104 in

[0104] S701: Obtain the logical plan tree corresponding to the SQL statement.

[0105] Specifically, the logical plan tree here is the same as the logical plan tree obtained in step S303, and therefore, the logical plan tree corresponding to each node in step S303 can be directly obtained.

[0106] S702: Optimize the logical plan tree by using the optimization rule set in the Blink optimizer.

[0107] S703: Generate the physical execution plan tree according to the optimized logical plan tree.

[0108] S704: Generate the Flink task by using the physical execution plan tree.

[0109] Through the above embodiment, due to the preposition of the permission verification stage, the effectiveness of the Flink task submitted to the cluster is guaranteed, and the SQL statement issued by the user can be executed smoothly.

[0110] Please refer to Figure 8 , Figure 8is a framework schematic diagram of an embodiment of the permission control apparatus of the present application. The control apparatus 100 comprises an obtaining module 10, an identifying module 12, a judging module 14 and a processing module 16. Specifically, the obtaining module 10 is configured to receive a SQL statement executed by a current user, parse and verify the SQL statement to obtain an operation tree corresponding to the SQL statement. The identifying module 12 is configured to identify an operation type and operation information of the operation tree. The judging module 14 is configured to transmit the operation type and operation information to a Ranger plug-in, so that the Ranger plug-in judges whether the current user has an operation permission of a database according to the operation type and operation information. The processing module 16 is configured to, in response to that the current user has the operation permission, continue to execute the SQL statement. The processing module 16 is also configured to, in response to that the current user does not have the operation permission, return information of a permission exception. Through the above embodiment, on one hand, the control action of the permission is completed at the parsing level of the SQL statement, the operation permission checking stage can be pre-processed, the permission exception information is returned in advance, and better interactive experience is provided for the user to execute the SQL statement; on the other hand, the operation information obtained according to the operation tree can realize the permission control of a finer granularity, and the permission control scenarios are more abundant.

[0111] Please refer to Figure 9 , Figure 9 is a structural schematic diagram of an embodiment of the permission control apparatus of the present application. The apparatus 20 comprises a memory 200 and a processor 202 coupled with each other. The memory 200 stores program instructions. The processor 202 is configured to execute the program instructions to implement the permission control method mentioned in any of the above embodiments.

[0112] Specifically, the processor 202 can also be referred to as a CPU (Central Processing Unit). The processor 202 can be an integrated circuit chip with a processing capability of signals. The processor 202 can also be a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. In addition, the processor 202 can be implemented by a plurality of integrated circuit chips.

[0113] Please refer to Figure 10 , Figure 10is a schematic diagram of a framework of an embodiment of the computer readable storage medium of the present application. The computer readable storage medium 30 stores a computer program 300, which can be read by a computer, and the computer program 300 can be executed by a processor to implement the permission control method mentioned in any of the above embodiments. The computer program 300 can be stored in the computer readable storage medium 30 in the form of a software product, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in the various embodiments of the present application. The computer readable storage medium 30 with storage function can be a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, etc. various media that can store program codes, or a terminal device such as a computer, a server, a mobile phone, a tablet, etc.

[0114] The above is only an embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent flow transformation using the content of the specification and drawings of the present application, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method of controlling rights, characterized by, The method comprises the following steps: After receiving a SQL statement executed by a current user, the SQL statement is parsed and verified to obtain an operation tree corresponding to the SQL statement; An operation type and operation information of the operation tree are identified; The operation type and the operation information are transmitted to a Ranger plug-in, so that the Ranger plug-in determines whether the current user has an operation permission of a database according to the operation type and the operation information; If yes, the SQL statement is executed continuously; Otherwise, information of a permission exception is returned; The step of identifying the operation type and the operation information of the operation tree comprises the following steps: All first nodes in the operation tree are sequentially arranged and stored in a first queue to form a plurality of first storage nodes; Each first storage node in the first queue is sequentially acquired, and the current first storage node is identified to obtain the corresponding operation type and operation information; It is determined whether the current first storage node has a first child node; If yes, the first child node is sequentially arranged and stored at the end of the first queue, and the step of sequentially acquiring each first storage node in the first queue is returned to; Otherwise, it is determined whether all the first storage nodes in the first queue are traversed, if yes, the operation type and the operation information related to a HIVE table in the database are filtered out, otherwise, the step of sequentially acquiring each first storage node in the first queue is returned to.

2. The rights control method according to claim 1, characterized by, The step of identifying the current first storage node to obtain the corresponding operation type and operation information comprises the following steps: The operation type of the current first storage node is acquired, and it is determined whether the operation type is a planned query operation type; If yes, a logical plan tree corresponding to the current first storage node is acquired, and the operation type and the operation information corresponding to the logical plan tree are identified; Otherwise, the operation type and the operation information corresponding to the current first storage node are acquired.

3. The rights control method according to claim 2, characterized by, The step of identifying the operation type and the operation information corresponding to the logical plan tree comprises the following steps: All second nodes in the logical plan tree are sequentially arranged and stored in a second queue to form second storage nodes; Each second storage node in the second queue is sequentially acquired, and the current second storage node is identified to obtain the corresponding operation type and operation information; It is determined whether the current second storage node has a second child node; If yes, the second child node is sequentially arranged and stored at the end of the second queue, and the step of sequentially acquiring each second storage node in the second queue is returned to; Otherwise, it is determined whether the second storage nodes in the second queue are traversed, if yes, the step of determining whether the current first storage node has a first child node is returned to, otherwise, the step of sequentially acquiring each second storage node in the second queue is returned to.

4. The rights control method according to claim 3, characterized by, The step of identifying the current second storage node to obtain the corresponding operation type and operation information comprises the following steps: acquiring the operation type of the second storage node, and determining whether the operation type is a Project type; if yes, determining whether the second storage node is the first Project type node in the second queue; if yes, obtaining all operation information in the second storage node that can be mapped to the second sub-node; otherwise, acquiring the operation type and the operation information corresponding to the second storage node. otherwise, directly acquiring the operation type and the operation information corresponding to the second storage node.

5. The rights control method of claim 1, wherein The step of transmitting the operation type and the operation information to the Ranger plug-in, so that the Ranger plug-in determines whether the current user has the operation permission of the database according to the operation type and the operation information, comprises: transmitting the operation information related to the HIVE table in the database to the Ranger plug-in; obtaining a data persistence directory according to the metadata information of the HIVE table; the Ranger plug-in determines whether the current user has the operation permission of the database by using the persistence directory, the operation type and the operation information.

6. The rights control method of claim 2, wherein The step of continuing to execute the SQL statement further comprises: acquiring the logical plan tree corresponding to the SQL statement; optimizing the logical plan tree by using an optimization rule set in the Blink optimizer; generating a physical execution plan tree according to the optimized logical plan tree; generating a Flink task by using the physical execution plan tree.

7. The rights control method of claim 1, wherein The operation information comprises table field information including a library name, a table name and a field name.

8. An apparatus for controlling rights, characterized by The computer readable storage medium stores a computer program, and the computer program is used to implement the permission control method in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is used to implement the permission control method in any one of claims 1-7.

Images