A data processing method, device and storage medium

Abstract

Embodiments of the present application disclose a data processing method and device and a storage medium, which are mainly applied to a database management system. The method comprises: in response to a query operation of a user, obtaining a data identifier of to-be-queried data; constructing an authority query function containing the data identifier, and generating a query request, the query request comprising the authority query function; sending the query request to a server, so that the server converts the authority query function into a condition query function, the condition query function comprising the data identifier, the server generates a blank query interface based on the condition query function, and the server finds query data matched with the condition query function in a database of the server based on the data identifier, the server fills the query data into the blank query interface to obtain a query result; and receiving the query result sent by the server and displaying the query result. The data processing method provided by the embodiments of the present application can effectively improve the efficiency of data authority management.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular to a data processing method and device and storage medium. BACKGROUND

[0002] Thanks to the vigorous development of Internet technology, database technology has brought great convenience to the data processing of various enterprises. In the big data scenario, there is often a cross-department access demand, for example, in the enterprise data processing scenario, the users of a department may have the demand of querying the information managed by another department.

[0003] In order to ensure the security of information, the database storing the information needs to be managed in terms of permissions, including cross-department permission management (i.e. permission management of one department accessing the information of another department), so that when the user queries the data, the database only returns the data related to the department where the user is located, and does not leak the data of other departments. Since the existing technology is too complex in terms of cross-department permission management of the database, how to improve the efficiency of data permission management has become a hot topic of research. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device and storage medium, which can improve the efficiency of data permission management.

[0005] In one aspect, the present application provides a data processing method, which is applied to a client and includes:

[0006] In response to a query operation of a user, a data identifier of to-be-queried data is obtained;

[0007] A permission query function containing the data identifier is constructed, and a query request is generated, wherein the query request includes the permission query function;

[0008] The query request is sent to a server, so that the server converts the permission query function into a condition query function, the condition query function includes the data identifier, the server generates a blank query interface based on the condition query function, and the server finds query data matched with the condition query function in a database of the server based on the data identifier, the server fills the query data into the blank query interface to obtain a query result;

[0009] The query result sent by the server is received, and the query result is displayed.

[0010] In one aspect, the present application provides another data processing method, which is applied to a server and includes:

[0011] receive a query request sent by a client, the query request comprising a permission query function, the permission query function comprising data identification of data to be queried;

[0012] convert the permission query function into a condition query function, the condition query function comprising the data identification;

[0013] generate a blank query interface based on the condition query function;

[0014] find query data matching the condition query function in a database of a server based on the data identification, and fill the query data into the blank query interface to obtain a query result;

[0015] send the query result to the client to enable the client to display the query result.

[0016] In one aspect, an embodiment of the present application provides a data processing apparatus, comprising:

[0017] a first acquisition unit configured to acquire data identification of data to be queried in response to a query operation of a user;

[0018] a first processing unit configured to construct a permission query function comprising the data identification, and generate a query request, the query request comprising the permission query function;

[0019] a first sending unit configured to send the query request to a server, to enable the server to convert the permission query function into a condition query function, the condition query function comprising the data identification, the server to generate a blank query interface based on the condition query function, and the server to find query data matching the condition query function in a database of the server based on the data identification, the server to fill the query data into the blank query interface to obtain a query result;

[0020] a first receiving unit configured to receive the query result sent by the server, and display the query result.

[0021] In one aspect, an embodiment of the present application provides a data processing apparatus, comprising:

[0022] a second receiving unit configured to receive a query request sent by a client, the query request comprising a permission query function, the permission query function comprising data identification of data to be queried;

[0023] a second processing unit configured to convert the permission query function into a condition query function, the condition query function comprising the data identification;

[0024] The second processing unit is further configured to generate a blank query interface based on the conditional query function.

[0025] The second processing unit is further configured to find query data matching the conditional query function in a database of the server based on the data identifier, and fill the query data into the blank query interface to obtain a query result.

[0026] The second sending unit is configured to send the query result to the client, so that the client displays the query result.

[0027] In one aspect, an embodiment of the present application provides a terminal, comprising:

[0028] A processor is adapted to implement one or more computer programs.

[0029] A computer storage medium stores one or more computer programs, and the one or more computer programs are adapted to be loaded and executed by the processor:

[0030] In response to a query operation of a user, a data identifier of to-be-queried data is acquired; an authority query function containing the data identifier is constructed, and a query request is generated, wherein the query request comprises the authority query function; the query request is sent to a server, so that the server converts the authority query function into a conditional query function, the conditional query function comprises the data identifier, the server generates a blank query interface based on the conditional query function, and the server finds query data matching the conditional query function in a database of the server based on the data identifier; the server fills the query data into the blank query interface to obtain a query result; the query result sent by the server is received, and the query result is displayed.

[0031] In one aspect, an embodiment of the present application provides a server, comprising:

[0032] A processor is adapted to implement one or more computer programs.

[0033] A computer storage medium stores one or more computer programs, and the one or more computer programs are adapted to be loaded and executed by the processor:

[0034] The query request sent by the client is received, the query request includes a permission query function, the permission query function includes data identification of data to be queried; the permission query function is converted into a condition query function, the condition query function includes the data identification; a blank query interface is generated based on the condition query function; query data matched with the condition query function is found in a database of the server based on the data identification, and the query data is filled into the blank query interface to obtain a query result; and the query result is sent to the client to enable the client to display the query result.

[0035] In one aspect, the embodiment of the present application provides a computer storage medium, the computer storage medium stores one or more computer programs, the one or more computer programs are adapted to be loaded and executed by the processor:

[0036] In response to a query operation of a user, data identification of data to be queried is acquired; a permission query function containing the data identification is constructed, and a query request is generated, the query request includes the permission query function; the query request is sent to a server to enable the server to convert the permission query function into a condition query function, the condition query function includes the data identification, the server generates a blank query interface based on the condition query function, and the server finds query data matched with the condition query function in a database of the server based on the data identification, the server fills the query data into the blank query interface to obtain a query result; the query result sent by the server is received, and the query result is displayed.

[0037] In one aspect, the embodiment of the present application provides a computer storage medium, the computer storage medium stores one or more computer programs, the one or more computer programs are adapted to be loaded and executed by the processor:

[0038] The query request sent by the client is received, the query request includes a permission query function, the permission query function includes data identification of data to be queried; the permission query function is converted into a condition query function, the condition query function includes the data identification; a blank query interface is generated based on the condition query function; query data matched with the condition query function is found in a database of the server based on the data identification, and the query data is filled into the blank query interface to obtain a query result; and the query result is sent to the client to enable the client to display the query result.

[0039] In one aspect, the embodiments of the present application provide a computer program product or a computer program, the computer program product comprising a computer program stored in a computer storage medium, a processor of a client reads the computer program from the computer storage medium, and the processor executes the computer program to enable a data processing device to perform the following steps:

[0040] In response to a query operation of a user, obtaining a data identifier of data to be queried; constructing an authority query function containing the data identifier, and generating a query request, the query request comprising the authority query function; sending the query request to a server to enable the server to convert the authority query function into a condition query function, the condition query function comprising the data identifier, the server generating a blank query interface based on the condition query function, and the server searching for query data matching the condition query function in a database of the server based on the data identifier, the server filling the query data into the blank query interface to obtain a query result; receiving the query result sent by the server, and displaying the query result.

[0041] In one aspect, the embodiments of the present application provide another computer program product or computer program, the computer program product comprising a computer program stored in a computer storage medium, a processor of a client reads the computer program from the computer storage medium, and the processor executes the computer program to enable a data processing device to perform the following steps:

[0042] Receiving a query request sent by a client, the query request comprising an authority query function, the authority query function comprising a data identifier of data to be queried; converting the authority query function into a condition query function, the condition query function comprising the data identifier; generating a blank query interface based on the condition query function; searching for query data matching the condition query function in a database of the server based on the data identifier, and filling the query data into the blank query interface to obtain a query result; sending the query result to the client to enable the client to display the query result.

[0043] The embodiments of the present application enable the server to obtain the query authority of the client and the data to be queried by constructing the authority query function containing the data identifier and generating the query request, further enable the server to generate the condition query function containing the data identifier of the data to be queried based on the authority query function, implement the security management of data through the rewriting of query language (or: SQL rewriting), effectively guarantee the security of data, and then enable the server to search based on the condition query function to generate the query result, enable the client to receive and display the query result sent by the server, and improve the efficiency of data authority management while guaranteeing the security of data. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0045] Figure 1a is a schematic diagram of a data processing system provided by an embodiment of the present application;

[0046] Figure 1b is a schematic flow diagram of a data authority relationship provided by an embodiment of the present application;

[0047] Figure 2 is a schematic diagram of a data processing method provided by an embodiment of the present application;

[0048] Figure 3a is a user query interface schematic diagram provided by an embodiment of the present application;

[0049] Figure 3b is a query result schematic diagram provided by an embodiment of the present application;

[0050] Figure 4 is a flow diagram of a data processing method provided by an embodiment of the present application;

[0051] Figure 5 is a schematic diagram of another data processing method provided by an embodiment of the present application;

[0052] Figure 6 is a structural schematic diagram of a data processing device provided by an embodiment of the present application;

[0053] Figure 7 is a structural schematic diagram of another data processing device provided by an embodiment of the present application;

[0054] Figure 8 is a structural schematic diagram of a terminal provided by an embodiment of the present application;

[0055] Figure 9 is a structural schematic diagram of a server provided by an embodiment of the present application. DETAILED DESCRIPTION

[0056] An embodiment of the present application provides a data processing method, which is mainly applied to authority management of data, especially in a data processing scenario with cross-authority query. In an embodiment, the cross-authority query can refer to Figure 1aIt is understood that: there are three models of users, data permissions, and advertiser-department relationships in the data processing system corresponding to the advertising business, as well as the relationships between the three models. In addition, there are also users in the data processing system, and the user fields corresponding to the users. The users belong to user departments (or user clusters), and the user fields can be, for example, the authorization information of the users obtained by the data processing system by granting different database permissions (including library permissions, table permissions, and column permissions) to different users. In actual application in the business, in addition to the user fields, there is always an advertiser field in the data processing system, and the advertiser generally belongs to an advertiser department. Therefore, it is not difficult to understand that the relationship between the users and the advertisers can be generated through the relationship between the advertiser department and the user department. For example, assuming that there is a user A in the user department, and the user A corresponds to database permissions (or user authorization information); and assuming that there is an advertiser B in the advertiser department, and the advertiser B corresponds to a department relationship. Therefore, since the user A and the advertiser B do not belong to the same department, the relationship between the user department and the advertiser department can be used to represent (or generate) the relationship between the user A and the advertiser B. The relationship between the user A and the advertiser B is cross-department permission information (or cross-cluster permission information), which can be used for cross-department permission management.

[0057] In one embodiment, the data processing method mainly comprises: in response to a data query operation of a user, a client acquires a data identifier of to-be-queried data, constructs a permission query function containing the data identifier, and then generates a query request. The query request is sent to a server, so that the server can convert the permission query function into a conditional query function. Then, the server performs data query based on the conditional query function, generates a query result, and the client receives and displays the query result sent by the server, thereby improving the efficiency of data permission management.

[0058] In one embodiment, the data processing method mainly comprises: in response to a data query operation of a user, a client acquires a data identifier of to-be-queried data, constructs a permission query function containing the data identifier, and then generates a query request. The query request is sent to a server, so that the server can convert the permission query function into a conditional query function. Then, the server performs data query based on the conditional query function, generates a query result, and the client receives and displays the query result sent by the server, thereby improving the efficiency of data permission management.

[0059] In one embodiment, the data processing method can be applied to a system for data processing as shown in Figure 1b The system includes at least one client 101, a server 102, as shown in Figure 1b The client 101 can run in a terminal that can establish a communication connection with the server. The terminal includes but is not limited to a smart phone, a smart speaker, a tablet computer, etc. The server can be a standalone physical server, a server cluster composed of multiple physical servers or a distributed system, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, etc. The terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc. but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the present application.

[0060] Please refer to Figure 2 , Figure 2 is a schematic diagram of a data processing method provided by an embodiment of the present application, which can be applied to a client. As shown in Figure 2 The method includes:

[0061] S201, in response to a user's query operation, obtaining data identifiers of data to be queried.

[0062] In one embodiment, the user's query operation can be the user's input operation in the user query interface. The user query interface can be seen in Figure 3a The data to be queried can be understood as data that the user wants to query in the user query interface by inputting certain (or some) data identifiers. For example, the data identifiers can be data models and data indicators. For example, the user wants to query the relevant content of the income indicator in the market performance on X day of X month of 2020 (i.e. the data to be queried), then after displaying the user query interface in the client, the user can select the data identifiers of the data model as "market performance", the time range as "X day of X month of 2020-X day of X month of 2020", and the income indicator as "performance consumption" in the user query interface, and then the client can obtain the three data identifiers of "market performance", "X day of X month of 2020-X day of X month of 2020" and "performance consumption" selected by the user.

[0063] S202, constructing a permission query function containing the data identifiers, and generating a query request.

[0064] In one embodiment, the query request comprises a permission query function, which is used to indicate the data identifier of the data to be queried selected by the user of the client and the user cluster to which the user belongs. For example, the client can generate a permission template function according to the data index selected by the user, and specifically, the permission template function can be f-permission, and the user cluster can be the department or the institution (such as the A company branch) to which the user belongs.

[0065] S203, sending a query request to the server, so that the server converts the permission query function into a condition query function, the server generates a blank query interface based on the condition query function, and the server finds the query data matched with the condition query function in the database of the server based on the data identifier, the server fills the query data into the blank query interface to obtain the query result.

[0066] In one embodiment, the condition query function comprises a data identifier. As known from the foregoing, the query request comprises a permission query function, so that after the client sends the query request to the server, the server can parse the query request to obtain the permission query function, and then the server converts the permission query function to obtain a condition query function comprising a condition query statement, and generates a blank query interface based on the condition query function, which will be used to display the query result. Specifically, the server finds the data corresponding to the data identifier in the database (or data warehouse) of the server based on the data identifier included in the condition query function, and fills the data obtained by the query into the blank query interface, so that the blank query interface can display the final query result.

[0067] Exemplarily, the conditional query function can be a SQL (Structured Query Language) function with-condition. Assuming that user 1 is in department a of company A and intends to query the employee information (employee name, department to which the employee belongs, and position information) of department b stored in the data warehouse, wherein department b includes employee A, employee B, and employee C. Then, the data to be queried is "employee information of department b", and the data identifiers are "employee name", "department to which the employee belongs", and "position information". Then, the server searches for the name of employee A, the name of employee B, and the name of employee C according to the data identifier "employee name", and assumes that "A, B, C" is obtained. Similarly, the server also searches for the department to which employee A corresponds, the department to which employee B corresponds, and the department to which employee C corresponds according to the data identifier "department to which the employee belongs", and assumes that "department b, department b, department b" is obtained. In addition, the server also searches for the position to which employee A corresponds, the position to which employee B corresponds, and the position to which employee C corresponds according to the data identifier "position information", and assumes that "position 1, position 2, position 3" is obtained. After the data to be queried is obtained, the server fills the data obtained by the above query into the blank query interface to obtain the query result.

[0068] S204, receiving the query result sent by the server and displaying the query result.

[0069] After the server obtains the query result, the client receives the query result sent by the server and displays the filled query interface. Exemplarily, in the above example, the query result can be as shown in Figure 3b .

[0070] The embodiment of the application obtains the query authority of the client and the data to be queried by constructing the authority query function containing the data identifier and generating the query request, and further enables the server to generate the conditional query function containing the data identifier (i.e., the data identifier of the data to be queried) based on the authority query function, to realize the security management of the data through the rewriting of the query language (or SQL rewriting), to effectively ensure the security of the data, and then the server searches based on the conditional query function to generate the query result, so that the client can accept and display the query result sent by the server, to improve the efficiency of the data authority management while ensuring the security of the data.

[0071] Please refer to Figure 4 , Figure 4 is a schematic diagram of another data processing method provided by the embodiment of the application, which can be applied to a server. As shown in Figure 4 , the method comprises the following steps:

[0072] S401, in response to a query operation of a user, obtaining data to be queried.

[0073] In one embodiment, the specific embodiment in step S401 can refer to the description of step S201, which will not be repeated here.

[0074] S402, constructing a permission query function containing the data identifier, and generating a query request.

[0075] In one embodiment, the query request includes the permission query function and the client identifier of the client, and the permission query function includes the data identifier of the data to be queried. In a specific embodiment, one client can correspond to one user, and the client identifier can also identify the user using the client; the permission query function can be understood as a function indicating the server to query the data within the permission range of the client. For example: when the client 1 can only query the data in the data table 1, but the query request initiated includes the data to be queried including the data of the data table 2, the permission query function is used to instruct the server to query the data in the data table 1.

[0076] S403, sending the query request.

[0077] Specifically, the client sends the above query request to the server.

[0078] S404, converting the permission query function into a conditional query function.

[0079] In one embodiment, the permission query function further includes the permission information of the user cluster to which the user corresponding to the client identifier belongs. Then, the server can obtain the query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster to which the user corresponding to the client identifier belongs. In a specific embodiment, the query permission information can include user authorization information and cross-cluster permission information of the user cluster, and then when the server obtains the query permission information of the user, the user authorization information of the user corresponding to the client identifier can be obtained first, and then the cross-cluster permission information of the user cluster is obtained based on the permission information of the user cluster corresponding to the user and based on the user cluster associated with the data to be queried.

[0080] In an embodiment, the permission information of the user cluster can be understood as the permission information of the department to which the user belongs. Then, the user authorization information in the query permission information of the user can be obtained according to the permission information of the department to which the user belongs and the user information corresponding to the client identifier, for example, according to the department permission information and the user category. For example, it is assumed that the employee information includes the employee name, the department to which the employee belongs, the position information, and the length of service. The data processing system of a company stipulates that the user of department 1 can query the employee information of department 2 (that is, the permission information of the user cluster of department 1 is “can query the employee information of department 2”). In addition, the employee information that can be queried by the user of category a is “employee name” and “department to which the employee belongs”. If user A is an employee of category a in department 1, then the user authorization information corresponding to user A is “can query the employee name and the department to which the employee belongs in department 2”.

[0081] In an embodiment, the cross-cluster permission information can also be understood as the cross-department permission information. Then, the cross-cluster permission information in the query permission information of the user can be obtained according to the department involved in the to-be-queried data and the department to which the user corresponding to the client that initiates the query request belongs. For example, it is assumed that company A has department 1 and department 2. Data table 1 includes the user data (employee name and position information) of department 2. User A belongs to department 1. Then, when user A selects to query the data in data table 1, since data table 1 stores the user data of department 2 (that is, the associated user cluster is “department 2”), user A belongs to department 1. Therefore, the cross-cluster permission information (or cross-department permission information) can be understood as the permission relationship between department 1 and department 2 (for example, department 1 can query part of the data of department 2, and department 2 can query all the data of department 1).

[0082] In an embodiment, after obtaining the query permission information of the user, the server can filter the first data identifier that matches the query permission information of the user from the data identifiers, and convert the permission query function into a conditional query function after obtaining the first data identifier. It can be understood that the conditional query function includes the first data identifier. In specific embodiments, the “first data identifier” can be understood as the identifier corresponding to the data that the user corresponding to the client that initiates the query request has the query permission in the to-be-queried data. It can be seen that “matches the query permission information of the user” means that the data is within the query permission range of the user and the data belongs to the to-be-queried data. Then, it can be further understood that filtering the first data identifier that matches the query permission information of the user from the data identifiers means selecting the data that the client has the query permission from the to-be-queried data corresponding to the client, and taking the data identifier corresponding to the data as the first data identifier.

[0083] For example, assuming that a company includes department 1 and department 2, employee information includes employee name, department, position information and length of service, and the query permission information corresponding to user A is "queryable employee name and department in department 2". When user A wants to query "employee name" and "employee position" in department 2, the data identifiers included in the permission query function generated by the client corresponding to user A are "employee name" and "employee position". Since user A cannot query "employee position", the data matching the query permission information is only "employee name". Therefore, the first data identifier after screening is "employee name", i.e., the condition query function only includes "employee name".

[0084] S405, generating a blank query interface based on the condition query function.

[0085] In an embodiment, the blank query interface can include a join cross-department permission table, which can include data identifiers of data to be queried. The server can first parse the condition query function into an abstract syntax tree (AST), which is a tree representation of the abstract syntax structure of the source code. Each node on the tree represents a structure in the source code. In the embodiment of the application, the nodes in the abstract syntax tree can be used to identify the specific location of the query data (such as database location, table location, column location). For example, it can be used to identify that data 1 is in column C of table B in database A. As can be seen, in a specific embodiment, the abstract syntax tree includes the node identifier of at least one node of the query data corresponding to the first data identifier. The node can be understood as a hierarchy, i.e., database, table, column. For example, if query data 1 is located in database A table B, then query data 1 corresponds to two nodes, namely database A and table B.

[0086] In an embodiment, after the server generates the abstract syntax tree according to the conditional query function, the validity of the first data identifier can be verified based on the abstract syntax tree to determine whether the second data identifier can be filtered out in the first data identifier. If the second data identifier can be filtered out, it is considered that the validity verification of the first data identifier is passed, triggering the execution of the "blank query interface generated based on the conditional query function". Specifically, the server verifies the validity of the node identifier of each node of the query data corresponding to the first data identifier, which can be understood as: the server verifies whether the library / table / column field in the abstract syntax tree exists to verify whether the query data corresponding to the first data identifier exists. If the query data corresponding to the first data identifier exists, it means that the verification is passed, and the server takes the data identifier of the query data as the second data identifier (i.e., the second data identifier is obtained according to the node corresponding to the verified node identifier), and then updates the conditional query function including the first data identifier to the conditional query function including the second data identifier, or it can be understood that the abstract syntax tree after the filtering node is rewritten as a new conditional query function.

[0087] For example, assuming that there is an A library in the data processing system, the A library includes a table B and a table C, and the table C includes a column C. If the first data identifier includes "data 1" and "data 2", and the first data identifier "data 1" corresponds to three nodes, which are a library node corresponding to "field A", a table node corresponding to "field B", and a column node corresponding to "field C"; the first data identifier "data 2" corresponds to two nodes, which are a library node corresponding to "field A" and a table node corresponding to "field B". Then, according to the three nodes of the first data identifier "data 1", the search path of "data 1" is "A library→table B→column C", and it can be seen that the query data corresponding to "data 1" does not exist (because there is no column C in table B); according to the two nodes of the second data identifier "data 2", the search path of "data 2" is "A library→table B", and it can be seen that the query data corresponding to "data 2" exists, and then the second data identifier "data 2" can be obtained. Since the second data identifier is filtered out in the first data identifier "data 1" and "data 2", the server can determine that the verification is passed, and then modify the conditional query function 1 including the first data identifier "data 1" and "data 2" to the conditional query function 2 including the second data identifier "data 2", and generate a blank query interface according to the conditional query function 2.

[0088] S406, based on the data identifier, find the query data matching the conditional query function in the database of the server, and fill the query data into the blank query interface to obtain a query result.

[0089] In one embodiment, the server finds the query data corresponding to the second data identifier in the database corresponding to the server based on the rewritten conditional query function (i.e., the conditional query function including the second data identifier), and then fills the query data corresponding to each data identifier into the grid corresponding to each data identifier to obtain the query result.

[0090] In specific embodiments, the blank query interface includes at least one grid to be filled, and one or more grids to be filled in the at least one grid to be filled correspond to one data identifier. It can be understood that the grid to be filled can be generated according to the first data identifier. If user A needs to query "employee name" and "department", the blank query interface generated by the server can include one or more grids to be filled corresponding to "employee name", and one or more grids to be filled corresponding to "department". For example, the data identifier "employee name" corresponds to multiple grids to be filled, which can be blank grids to be filled with employee names such as employee a, employee b, and employee c.

[0091] S407, sends the query result to the client to enable the client to display the query result.

[0092] In one embodiment, when the server obtains the query result, the server returns the query result to the client that sent the query request to enable the client to load and display the query result.

[0093] S408, receives the query result sent by the server and displays the query result.

[0094] In one embodiment, when the server generates the query result, the server sends the query result to the client that initiated the query request, and the client loads and displays the query result.

[0095] Embodiments of the present application rewrite the permission query function and the conditional query function, so that the server can filter the data to be queried based on the query permission information of the user and the data identifier of the data to be queried, and then the server finds based on the conditional query function after filtering the data identifier to generate the query result. The client receives and displays the query result sent by the server, effectively ensuring the security of the data, and without adjusting the organization structure of the data warehouse in the data query process, improving the efficiency of data permission management.

[0096] Based on the data processing method shown in Figure 2 and Figure 4 Embodiments of the present application provide another schematic diagram of a data processing method, please refer to Figure 5 , which comprises:

[0097] S501, a user selects data to be queried.

[0098] In one embodiment, the user can complete the input of the data to be queried by clicking in the user query interface described above.

[0099] S502, generating a template function with permissions.

[0100] In one embodiment, the specific embodiments of step S502 can be referred to the description of step S202, and the embodiments of the present application will not be repeated here.

[0101] S503, parsing the template function with permissions into an abstract syntax tree.

[0102] In one embodiment, the server can first convert the template function with permissions into a conditional query function, and then obtain the abstract syntax tree corresponding to the template function with permissions based on the conditional query function. The specific embodiments can be referred to the description of step S404, and will not be repeated here.

[0103] S404, validity verification.

[0104] In one embodiment, as can be understood from the foregoing embodiments, the validity verification is to verify the first data identifier in the conditional query function, which can be referred to the description of step S405, and will not be repeated here.

[0105] S505, replacing the template function with permissions with a join cross-department permission table.

[0106] In one embodiment, after the server obtains the template function with permissions (or: permission query function), the permission query function can be replaced with a join cross-department permission table. In specific embodiments, the server can first convert the permission query function into a conditional query function, and then convert the conditional query function into a join table to achieve the above-mentioned "replacing the permission query function with a join cross-department permission table". The method of converting the conditional query function into a join table can be referred to the detailed description in step S405, and will not be repeated here.

[0107] S506, cross-department permission conversion.

[0108] In one embodiment, after the server obtains the join cross-department permission table described above, a new conditional query function can be generated based on the data identifiers existing in the join cross-department permission table. In the new conditional query function, the query permission information of the user corresponding to the client identifier has been updated. It can be understood that the queryable data corresponding to the updated query permission information is the data corresponding to the second data identifier.

[0109] S507, generating a rewritten query statement.

[0110] In one embodiment, when the server completes the cross-department authority conversion and obtains a new conditional query function, a query statement (e.g., an SQL statement) can be generated based on the new conditional query function, so that the server can execute the query statement to perform a data query operation.

[0111] In step S508, the query operation is performed in the data warehouse by using the rewritten query statement.

[0112] In one embodiment, the specific implementation of step S508 can refer to the description of steps S405 and S406, which will not be repeated here.

[0113] By rewriting the authority query function and the conditional query function, the server can filter the to-be-queried data based on the user's query authority information and the data identifier of the to-be-queried data, and then perform a search based on the conditional query function after filtering the data identifier to generate a query result. The client receives and displays the query result sent by the server, effectively ensuring the security of the data, and the organization structure of the data warehouse does not need to be adjusted in the data query process, thereby improving the efficiency of data authority management.

[0114] Based on the description of the above data processing method embodiment, the present embodiment also discloses a data processing apparatus, which can be a computer program (including program code) running in the above-mentioned client. The data processing apparatus can execute Figure 2 the method shown in the above-mentioned method, Figure 4 steps S401, S402 and S408 in the above-mentioned method, and can execute Figure 5 step S502 in the above-mentioned method. Please refer to Figure 6 , the data processing apparatus can include a first acquisition unit 601, a first processing unit 602, a first sending unit 603 and a first receiving unit 604.

[0115] The first acquisition unit 601 is configured to acquire a data identifier of to-be-queried data in response to a query operation of a user.

[0116] The first processing unit 602 is configured to construct an authority query function containing the data identifier and generate a query request, wherein the query request includes the authority query function.

[0117] The first sending unit 603 is used to send the query request to the server, so that the server converts the permission query function into a conditional query function. The conditional query function includes the data identifier. The server generates a blank query interface based on the conditional query function, and the server searches for query data matching the conditional query function in the server's database based on the data identifier. The server fills the query data into the blank query interface to obtain the query result.

[0118] The first receiving unit 604 is used to receive the query result sent by the server and display the query result.

[0119] According to one embodiment of the present invention, Figure 2 and Figure 4 The steps S401, S402, S403, and S408 shown, and Figure 5 The various steps involved in the data processing method shown in step S502 can be derived from... Figure 6 This is performed by each unit in the data processing apparatus shown. For example, Figure 2 The aforementioned step S201 can be performed by Figure 6 The first acquisition unit 601 in the data processing device shown executes step S202, which can be performed by... Figure 6 The first processing unit 602 in the data processing device shown executes step S203, which can be performed by... Figure 6 The first transmitting unit 603 in the data processing device shown executes step S204, which can be performed by... Figure 6 The first receiving unit 604 in the data processing device shown performs the operation; for example, Figure 4 The step S401 shown can be performed by Figure 6 The first acquisition unit 601 in the data processing device shown is responsible for executing step S402; step S402 can be performed by... Figure 6 The first processing unit 602 in the data processing device shown executes step S403, which can be performed by... Figure 6 The first transmitting unit 603 in the data processing device shown executes step S408, which can be performed by... Figure 6 The data processing apparatus shown is executed by the first receiving unit 604; for example, Figure 5 The step S502 shown can be performed by Figure 6 The first processing unit 602 in the data processing device shown executes the operation.

[0120] According to another embodiment of the present invention, Figure 6The units in the data processing apparatus shown are divided based on logical functions. The units can be combined into one or several other units respectively or all, or some of the units can be further split into multiple units with smaller functions to form, which can achieve the same operation without affecting the implementation of the technical effects of the embodiments of the present application. In other embodiments of the present application, the data processing apparatus can also include other units. In actual applications, these functions can also be assisted by other units, and can be achieved by cooperation of multiple units.

[0121] According to another embodiment of the present application, the data processing apparatus shown in Figure 2 or Figure 4 the steps S401, S402, S403 and S408 shown, and Figure 5 the steps involved in the corresponding method shown in step S502, a computer program (including program code) of each step can be constructed as Figure 6 the data processing apparatus shown in , and the data processing method of the embodiments of the present application is implemented. The computer program can be recorded on, for example, a computer storage medium, loaded into the above-mentioned data processing apparatus through the computer storage medium, and run in it.

[0122] In the embodiments of the present application, the first processing unit is configured to construct a permission query function containing data identification and generate a query request, so that the server can obtain the query permission of the client sent by the first sending unit and the data to be queried, and further, the server can generate a condition query function containing the data identification of the data to be queried based on the permission query function, thereby realizing the security management of data through the rewriting of query language (or SQL rewriting), effectively ensuring the security of the data, and enabling the server to search based on the condition query function to generate a query result, so that the first receiving unit can receive and display the query result sent by the server, thereby improving the efficiency of data permission management while ensuring the security of the data.

[0123] Based on the description of the above-mentioned data processing method embodiments, the present application further discloses another data processing apparatus, which can be a computer program (including program code) running in the above-mentioned server. The data processing apparatus can execute Figure 4 the steps S404 to S407 in the method shown, and can execute Figure 5 the steps S503 to S508 in the method shown. Please refer to Figure 7The data processing apparatus can include a second receiving unit 701, a second processing unit 702, and a second sending unit 703.

[0124] The second receiving unit 701 is configured to receive a query request sent by a client, wherein the query request includes an authority query function, and the authority query function includes a data identifier of data to be queried.

[0125] The second processing unit 702 is configured to convert the authority query function into a conditional query function, wherein the conditional query function includes the data identifier.

[0126] The second processing unit 702 is further configured to generate a blank query interface based on the conditional query function.

[0127] The second processing unit 702 is further configured to search for query data matching the conditional query function in a database of a server based on the data identifier, and fill the query data into the blank query interface to obtain a query result.

[0128] The second sending unit 703 is configured to send the query result to the client, so that the client displays the query result.

[0129] In an embodiment, the query request further includes a client identifier of the client, and the authority query function further includes authority information of a user cluster to which a user corresponding to the client identifier belongs; the second processing unit 702 converts the authority query function into a conditional query function, and the conditional query function includes the data identifier and is specifically configured to perform the following steps:

[0130] Obtain query authority information of the user corresponding to the client identifier based on the client identifier and the authority information of the user cluster to which the user corresponding to the client identifier belongs.

[0131] Filter a first data identifier matching the query authority information from the data identifier.

[0132] Convert the authority query function into the conditional query function, and the conditional query function includes the first data identifier.

[0133] In another embodiment, after the second processing unit 702 converts the authority query function into the conditional query function, and the conditional query function includes the first data identifier, the second processing unit 702 is further specifically configured to perform the following steps:

[0134] Parse the conditional query function into an abstract syntax tree.

[0135] Verify validity of the first data identifier based on the abstract syntax tree.

[0136] If the verification is passed, triggering execution of the generation of the blank query interface based on the conditional query function.

[0137] In yet another embodiment, the abstract syntax tree comprises a node identifier of at least one node of the query data corresponding to the first data identifier; the second processing unit 702 performs validity verification on the first data identifier based on the abstract syntax tree, specifically performing:

[0138] validity verification on the node identifier of each node of the query data corresponding to the first data identifier, to determine whether the second data identifier is filtered out from the first data identifier, the second data identifier being obtained according to the node corresponding to the node identifier passed the verification;

[0139] Before the if the verification is passed, triggering execution of the generation of the blank query interface based on the conditional query function, further comprising:

[0140] If the second data identifier is filtered out from the first data identifier, it is determined that the verification is passed, and the conditional query function comprising the first data identifier is updated to a conditional query function comprising the second data identifier.

[0141] In yet another embodiment, the second processing unit 702 obtains the query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster, specifically for performing:

[0142] obtaining the user authorization information of the user corresponding to the client identifier;

[0143] obtaining the cross-cluster permission information of the user cluster based on the permission information of the user cluster and the user cluster associated with the to-be-queried data, the query permission information comprising the user authorization information of the user and the cross-cluster permission information of the user cluster.

[0144] In yet another embodiment, the blank query interface comprises at least one to-be-filled grid, and one or more to-be-filled grids of the at least one to-be-filled grid correspond to one data identifier; the second processing unit 702 fills the query data into the blank query interface to obtain a query result, specifically performing:

[0145] filling the query data corresponding to each data identifier into the to-be-filled grid corresponding to each data identifier to obtain the query result.

[0146] According to one embodiment of the present application, Figure 4 the steps S404 to S407 in the data processing method shown, and Figure 5The steps S503 to S508 in the data processing method shown can be performed by Figure 7 The units in the data processing apparatus shown can be executed by Figure 4 The steps S404 to S406 can be executed by Figure 7 The step S407 can be executed by Figure 7 The step S407 can be executed by

[0147] According to another embodiment of the present application, Figure 7 The units in the data processing apparatus shown are divided based on logical functions, and the units can be combined into one or several other units respectively or all, or some of the units can be further split into multiple units with smaller functions to form, which can achieve the same operation without affecting the implementation of the technical effects of the embodiments of the present application. In other embodiments of the present application, the data processing apparatus can also include other units, and these functions can also be assisted by other units in actual application, and can be realized by multiple units.

[0148] According to another embodiment of the present application, the data processing apparatus shown can be constructed by running a computer program (including program code) capable of performing the steps S404 to S407 and Figure 4 The steps S503 to S508 shown in the method shown can be performed by Figure 5 The steps S503 to S508 shown in the method shown can be performed by Figure 7 The data processing apparatus shown in the method shown in the embodiment of the present application, and the data processing method of the present application. The computer program can be recorded on, for example, a computer storage medium, and loaded into the above-mentioned data processing device through the computer storage medium, and run in it.

[0149] In the embodiment of the present application, the data processing apparatus receives the query authority of the client and the data to be queried sent by the client through the second receiving unit, further, the second processing unit can generate a conditional query function containing the data identifier of the data to be queried based on the authority query function, and the second processing unit can search based on the conditional query function, and generate a query result, so that the second sending unit can send the query result to the client, which realizes the security management of data through the rewriting of query language (or: SQL rewriting), effectively guarantees the security of data, and improves the efficiency of data authority management.

[0150] Based on the description of the method embodiments and the device embodiments, the embodiments of the present application further provide a terminal. Please refer to Figure 8 The terminal includes a processor 801, an input interface 802, an output interface 803, and a computer storage medium 804, and the processor 801, the input interface 802, the output interface 803, and the computer storage medium 804 in the terminal are connected through a bus or other means.

[0151] The computer storage medium 804 is a memory device in the terminal, used for storing programs and data. It can be understood that the computer storage medium 804 herein can include a built-in storage medium in the terminal, and of course can also include an extended storage medium supported by the terminal. The computer storage medium 804 provides a storage space that stores an operating system of the terminal. In addition, one or more computer programs suitable for being loaded and executed by the processor 801 are also stored in the storage space. It should be noted that the computer storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory; optionally, it can also be at least one computer storage medium located away from the aforementioned processor. The processor 801 (or CPU (Central Processing Unit, Central Processor)) is the computing core and control core of the terminal, which is suitable for implementing one or more computer programs, and specifically suitable for loading and executing one or more computer programs to implement corresponding method processes or corresponding functions.

[0152] In one embodiment, the terminal can perform the steps performed by the client in the above embodiments, that is, one or more computer programs stored in the computer storage medium 804 can be loaded and executed by the processor 801 to implement the steps S401, S402, S403, and S408 shown in Figure 2 and Figure 4 , and implement the step S502 shown in Figure 5 In a specific implementation, one or more computer programs in the computer storage medium 804 are loaded and executed by the processor 801:

[0153] In response to a query operation of a user, a data identifier of data to be queried is acquired; an authority query function containing the data identifier is constructed, and a query request is generated, the query request including the authority query function; the query request is sent to a server, so that the server converts the authority query function into a condition query function, the condition query function including the data identifier, the server generates a blank query interface based on the condition query function, and the server searches for query data matching the condition query function in a database of the server based on the data identifier, the server fills the query data into the blank query interface to obtain a query result; the query result sent by the server is received, and the query result is displayed.

[0154] In the embodiment of the application, the terminal constructs the authority query function containing the data identifier and generates the query request, so that the server acquires the query authority of the client in the terminal and the data to be queried, further, the server can generate the condition query function containing the data identifier of the data to be queried based on the authority query function, the security of the data is effectively ensured by rewriting the query language (or SQL rewriting) to safely manage the data, then the server searches based on the condition query function to generate the query result, so that the client can receive and display the query result sent by the server, the efficiency of the data authority management is improved while the security of the data is ensured.

[0155] Based on the description of the method embodiment and the device embodiment, an embodiment of the application provides a server. Please refer to Figure 9 The server includes a processor 901, an input interface 902, an output interface 903 and a computer storage medium 904, and the processor 901, the input interface 902, the output interface 903 and the computer storage medium 904 in the server are connected through a bus or other means.

[0156] The computer storage medium 904 is a memory device in the server used to store programs and data. It is understood that the computer storage medium 904 can include the server's built-in storage medium, or it can include extended storage media supported by the server. The computer storage medium 904 provides storage space for the server's operating system. Furthermore, this storage space also contains one or more computer programs suitable for loading and execution by the processor 901. It should be noted that the computer storage medium can be high-speed RAM or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer storage medium located remotely from the aforementioned processor. The processor 901 (or CPU (Central Processing Unit)) is the server's computing and control core, suitable for implementing one or more computer programs, specifically suitable for loading and executing one or more computer programs to achieve corresponding method flows or functions.

[0157] In one embodiment, the server can perform the steps described in the above embodiments, that is, the processor 901 loads and executes one or more computer programs stored in the computer storage medium 904 to achieve the aforementioned related... Figure 4 Steps S404 to S407 shown, and Figure 5 Steps S503 to S508 are shown. In specific implementation, one or more computer programs in the computer storage medium 904 are loaded and executed by the processor 901:

[0158] The system receives a query request from a client, the query request including a permission query function, the permission query function including a data identifier of the data to be queried; converts the permission query function into a conditional query function, the conditional query function including the data identifier; generates a blank query interface based on the conditional query function; searches the server's database for query data matching the conditional query function based on the data identifier, and fills the blank query interface with the query data to obtain a query result; and sends the query result to the client so that the client can display the query result.

[0159] In one implementation, the query request further includes the client identifier of the client, and the permission query function further includes permission information of the user cluster to which the user corresponding to the client identifier belongs; when the processor 901 executes the conversion of the permission query function into a conditional query function, wherein the conditional query function includes the data identifier, it specifically performs the following:

[0160] obtain the query permission information of the user corresponding to the client identifier based on the client identifier and permission information of a user cluster to which the user corresponding to the client identifier belongs;

[0161] filter a first data identifier from the data identifiers, the first data identifier matching the query permission information;

[0162] convert the permission query function into the condition query function, the condition query function including the first data identifier.

[0163] In yet another implementation, the processor 901, after converting the permission query function into the condition query function, the condition query function including the first data identifier, is further configured to perform:

[0164] parse the condition query function into an abstract syntax tree;

[0165] verify the validity of the first data identifier based on the abstract syntax tree;

[0166] if the verification is passed, trigger execution of the generation of the blank query interface based on the condition query function.

[0167] In yet another implementation, the abstract syntax tree includes a node identifier of at least one node of the query data corresponding to the first data identifier; and the processor 901, when verifying the validity of the first data identifier based on the abstract syntax tree, is specifically configured to perform:

[0168] verify the validity of the node identifier of each node of the query data corresponding to the first data identifier to determine whether to filter a second data identifier from the first data identifier, the second data identifier being obtained according to the node corresponding to the node identifier that passes the verification;

[0169] Before the if the verification is passed, trigger execution of the generation of the blank query interface based on the condition query function, the method further includes:

[0170] if the second data identifier is filtered from the first data identifier, it is determined that the verification is passed, and the condition query function including the first data identifier is updated to a condition query function including the second data identifier.

[0171] In yet another implementation, the processor 901, when obtaining the query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster, is specifically configured to perform:

[0172] obtain user authorization information of the user corresponding to the client identifier;

[0173] Based on the permission information of the user cluster and the user cluster associated with the to-be-queried data, cross-cluster permission information of the user cluster is obtained, and the query permission information includes user authorization information of the user and the cross-cluster permission information of the user cluster.

[0174] In yet another implementation, the blank query interface includes at least one to-be-filled grid, and one or more to-be-filled grids in the at least one to-be-filled grid correspond to one data identifier; the processor 901 fills the query data into the blank query interface to obtain a query result, and specifically includes:

[0175] The query data corresponding to each data identifier is filled into the to-be-filled grid corresponding to the data identifier to obtain the query result.

[0176] In the embodiment of the application, the server receives the query request sent by the client, acquires the query permission and the to-be-queried data, further, the processor of the server generates a conditional query function including the data identifier of the to-be-queried data based on the permission query function, realizes the security management of the data through the rewriting (or called: SQL rewriting) of the query language, effectively guarantees the security of the data, then the processor performs the search based on the conditional query function, can generate and send the query result, improves the efficiency of the data permission management while guaranteeing the security of the data.

[0177] The embodiment of the application further provides a computer storage medium, which stores the computer program of the data processing method, and when one or more processors load and execute the computer program, the description of the data processing method in the embodiment can be realized, and details are not repeated here. The description of the beneficial effects of the same method is not repeated here. It can be understood that the computer program can be deployed on one or more devices capable of communicating with each other to execute.

[0178] It should be noted that, according to an aspect of the present application, a computer program product or computer program is also provided, which includes a computer program stored in a computer readable storage medium. The processor in the terminal reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the terminal executes:

[0179] In response to a query operation of a user, a data identifier of data to be queried is acquired; an authority query function containing the data identifier is constructed, and a query request is generated, the query request including the authority query function; the query request is sent to a server, so that the server converts the authority query function into a condition query function, the condition query function including the data identifier, the server generates a blank query interface based on the condition query function, and the server finds query data matching the condition query function in a database of the server based on the data identifier, the server fills the query data into the blank query interface to obtain a query result; the query result sent by the server is received, and the query result is displayed.

[0180] It should be noted that, according to another aspect of the present application, a computer program product or computer program is also provided, which includes a computer program stored in a computer readable storage medium. A processor in a server reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the server performs:

[0181] A query request sent by a client is received, the query request including an authority query function, the authority query function including a data identifier of data to be queried; the authority query function is converted into a condition query function, the condition query function including the data identifier; a blank query interface is generated based on the condition query function; query data matching the condition query function is found in a database of the server based on the data identifier, and the query data is filled into the blank query interface to obtain a query result; the query result is sent to the client, so that the client displays the query result.

[0182] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by computer program related hardware, and the computer program can be stored in a computer storage medium. When the computer program is executed, the processes of the above-mentioned embodiments can be included. The computer storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM).

[0183] The above disclosure is only part of the embodiments of the present application, and of course cannot limit the scope of the present application. Those skilled in the art can understand that all or part of the processes of the above-mentioned embodiments can be implemented, and equivalent changes made according to the claims of the present application still fall within the scope of the present application.

Claims

1. A data processing method, characterized by, The method is applied to a client and includes: In response to a query operation of a user, obtaining a data identifier of data to be queried; Constructing an authority query function containing the data identifier and generating a query request, the query request including the authority query function; Sending the query request to a server to enable the server to convert the authority query function into a conditional query function, the conditional query function including the data identifier, the server generating a blank query interface based on the conditional query function, and the server searching for query data matching the conditional query function in a database of the server based on the data identifier, the server filling the query data into the blank query interface to obtain a query result; Receiving the query result sent by the server and displaying the query result; The query request further includes a client identifier of the client, and the authority query function further includes authority information of a user cluster to which a user corresponding to the client identifier belongs; the server converts the authority query function into the conditional query function by obtaining query authority information of the user corresponding to the client identifier based on the client identifier and the authority information of the user cluster to which the user corresponding to the client identifier belongs; the server filters a first data identifier matching the query authority information from the data identifier; and the server converts the authority query function into the conditional query function, the conditional query function including the first data identifier.

2. A data processing method, characterized by, The method is applied to a server and includes: Receiving a query request sent by a client, the query request including an authority query function, the authority query function including a data identifier of data to be queried; Converting the authority query function into a conditional query function, the conditional query function including the data identifier; Generating a blank query interface based on the conditional query function; Searching for query data matching the conditional query function in a database of the server based on the data identifier and filling the query data into the blank query interface to obtain a query result; Sending the query result to the client to enable the client to display the query result; The query request further includes a client identifier of the client, and the authority query function further includes authority information of a user cluster to which a user corresponding to the client identifier belongs; the converting of the authority query function into the conditional query function includes: Obtaining query authority information of the user corresponding to the client identifier based on the client identifier and the authority information of the user cluster to which the user corresponding to the client identifier belongs; Filtering a first data identifier matching the query authority information from the data identifier; Converting the authority query function into the conditional query function, the conditional query function including the first data identifier.

3. The method of claim 2, wherein, After the converting of the authority query function into the conditional query function, the method further includes: Parsing the conditional query function into an abstract syntax tree; Validating the first data identifier based on the abstract syntax tree; and Displaying the query result. If the verification is passed, execution of the generation of the blank query interface based on the conditional query function is triggered.

4. The method of claim 3, wherein, The abstract syntax tree comprises node identifiers of at least one node of the query data corresponding to the first data identifier; The validity verification of the first data identifier based on the abstract syntax tree comprises: The node identifiers of the nodes of the query data corresponding to the first data identifier are verified for validity to determine whether a second data identifier is filtered out from the first data identifier, the second data identifier being obtained according to the node corresponding to the node identifier that passes the verification; Before the execution of the generation of the blank query interface based on the conditional query function is triggered if the verification is passed, the method further comprises: If the second data identifier is filtered out from the first data identifier, it is determined that the verification is passed, and the conditional query function comprising the first data identifier is updated to a conditional query function comprising the second data identifier.

5. The method of claim 2, wherein, The query permission information of the user corresponding to the client identifier is obtained based on the client identifier and the permission information of the user cluster, comprising: User authorization information of the user corresponding to the client identifier is obtained; The cross-cluster permission information of the user cluster is obtained based on the permission information of the user cluster and the user cluster associated with the to-be-queried data, and the query permission information comprises the user authorization information of the user and the cross-cluster permission information of the user cluster.

6. The method of claim 2, wherein, The blank query interface comprises at least one to-be-filled grid, and one or more to-be-filled grids in the at least one to-be-filled grid correspond to one data identifier; The query data is filled into the blank query interface to obtain a query result, comprising: The query data corresponding to each data identifier is filled into the to-be-filled grid corresponding to the data identifier to obtain the query result.

7. A data processing apparatus, characterized by, The device is applied to a client, comprising: A first obtaining unit is configured to obtain data identifiers of to-be-queried data in response to a query operation of a user; A first processing unit is configured to construct a permission query function comprising the data identifiers and generate a query request, the query request comprising the permission query function; A first sending unit is configured to send the query request to a server, so that the server converts the permission query function into a conditional query function, the conditional query function comprising the data identifiers, the server generates a blank query interface based on the conditional query function, and the server finds query data matching the conditional query function in a database of the server based on the data identifiers, the server fills the query data into the blank query interface to obtain a query result; A first receiving unit is configured to receive the query result sent by the server and display the query result. The query request further includes a client identifier of the client, and the permission query function further includes permission information of a user cluster to which a user corresponding to the client identifier belongs; the server converts the permission query function into a conditional query function by obtaining query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster to which the user corresponding to the client identifier belongs; the server filters a first data identifier matching the query permission information from the data identifier; and the server converts the permission query function into the conditional query function, and the conditional query function includes the first data identifier.

8. A data processing apparatus, characterized by, The device is applied to a server and includes: a second receiving unit configured to receive a query request sent by a client, the query request including a permission query function, and the permission query function including a data identifier of data to be queried; a second processing unit configured to convert the permission query function into a conditional query function, and the conditional query function including the data identifier; the second processing unit is further configured to generate a blank query interface based on the conditional query function; the second processing unit is further configured to find query data matching the conditional query function in a database of the server based on the data identifier, and fill the query data into the blank query interface to obtain a query result; a second sending unit configured to send the query result to the client, so that the client displays the query result; The query request further includes a client identifier of the client, and the permission query function further includes permission information of a user cluster to which a user corresponding to the client identifier belongs; the second processing unit is further configured to obtain query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster to which the user corresponding to the client identifier belongs; filter a first data identifier matching the query permission information from the data identifier; and convert the permission query function into the conditional query function, and the conditional query function includes the first data identifier.

9. A computer storage medium, characterized in that The computer storage medium stores one or more computer programs, and the one or more computer programs are adapted to be loaded and executed by the processor to implement the data processing method in any one of claims 1 or 2-6.

10. A computer program product comprising a computer program stored in a computer storage medium, characterized in that, The processor of the client reads the computer program from the computer storage medium, and the processor executes the computer program to implement the data processing method in any one of claims 1 or 2-6.

Images