Data access method and device, electronic equipment and storage medium

Abstract

The application provides a data access method and device, electronic equipment and storage medium. The method first receives a data access request of a target user for target data, then determines an access permission level of the target user according to the data access request, determines a target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to a preset mapping relationship between the user and the data security classification rule and the data access request, and then obtains a target security level of the target data under each target data security classification rule. The access permission level of the target user and each target security level of the target data are matched, and it is judged whether the target user has access permission to the target data according to the matching result. If yes, the target data is returned to the target user. The application realizes differentiated access of the same permission level user to the data, meets the complex scene demand, and the efficiency is significantly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data access method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the increasing emphasis on data security by the country, various laws and regulations have been issued, and financial institutions are increasingly focusing on compliance and security when promoting business. Before use, data needs to be marked with a security level, and users are given access permission levels. All users with a certain permission level can only access data with a security level that is not higher than the corresponding security level. If you want to access high-level data, you need to apply for it and go through an audit.

[0003] Currently, when the business department processes data access, the marking of security levels, the application for access permissions, and the review of access permissions are all completed manually, which makes the workload large, the work efficiency low, the accuracy low, and the system management lacking. In addition, when marking the security level of data, all data is classified according to a single security classification rule, and the access permission level of all users who need to obtain data matches the security level. However, in actual scenarios, due to the complexity of work requirements, users with the same permission level also have different data access needs. Some users only need to access low-security-level data, while others may need to access some high-security-level data. At this time, if the permission level of the latter is directly increased, there will still be some high-security-level data that cannot be accessed by the user, and arbitrarily increasing the permission level will increase the risk of leakage. If the user's level is not increased, the user will need to apply for permission every time they want to access high-security-level data, and then go through a manual review to obtain the corresponding data and perform permission recovery after querying. This approach requires an audit and permission recovery process every time the data is queried. In actual scenarios, there may be multiple users who need to access some high-security-level data, and different users need different high-security-level data, or the same user needs different high-security-level data each time. The need for separate audits and permission recovery every time makes the workload of auditors large and inefficient.

[0004] Therefore, the current data access method has the technical problem of being unable to meet the needs of complex scenarios and being inefficient, and needs to be improved. SUMMARY

[0005] The embodiments of the present application provide a data access method, device, electronic equipment and storage medium to alleviate the technical problem of the current data access method being unable to meet the needs of complex scenarios and being inefficient.

[0006] To solve the above technical problems, the embodiment of the present application provides the following technical solutions.

[0007] The present application provides a data access method, comprising:

[0008] receiving a data access request of a target user for target data;

[0009] According to the data access request, determining the access permission level of the target user, and according to the preset mapping relationship between the user and the data security classification rule and the data access request, determining the target data security classification rule in which the target user has access permission from a plurality of different data security classification rules;

[0010] Obtaining the target security level of the target data under each target data security classification rule;

[0011] Matching the access permission level of the target user and the target security level of the target data, and determining whether the target user has access permission to the target data according to the matching result;

[0012] If yes, return the target data to the target user.

[0013] Meanwhile, the embodiment of the present application also provides a data access device, comprising:

[0014] The receiving module is used for receiving a data access request of a target user for target data;

[0015] The determining module is used for determining the access permission level of the target user according to the data access request, and determining the target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to the preset mapping relationship between the user and the data security classification rule and the data access request;

[0016] The obtaining module is used for obtaining the target security level of the target data under each target data security classification rule;

[0017] The matching module is used for matching the access permission level of the target user and the target security level of the target data, and determining whether the target user has access permission to the target data according to the matching result;

[0018] The returning module is used for returning the target data to the target user if yes.

[0019] The present application also provides an electronic device comprising a memory and a processor; the memory stores an application program, and the processor is used for running the application program in the memory to execute the steps in the data access method of any one of the above.

[0020] The embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the data access method.

[0021] Beneficial effects: the present application provides a data access method, device, electronic equipment and storage medium, the method first receives a data access request of a target user for target data, then determines the access permission level of the target user according to the data access request, determines the target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to the preset mapping relationship between the user and the data security classification rule and the data access request, obtains the target security level of the target data under each target data security classification rule, and matches the access permission level of the target user and each target security level of the target data, judges whether the target user has access permission to the target data according to the matching result, if yes, returns the target data to the target user. The present application sets a plurality of different data security classification rules, so that the security levels of the same data under different data security classification rules are not completely the same, the preset mapping relationship is constructed, so that different users with the same access permission level have access permission to different data security classification rules, then the same target data can only have access permission to a part of users and does not have access permission to another part of users, that is, the same target data has different security levels for different users, so that the differentiated acquisition of the data by the users with the same permission level is realized, the complex scene requirements are met, and it is no longer necessary to perform permission audit and permission recovery on the user who wants to access high security level data each time, so that the efficiency is significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] The technical scheme and other beneficial effects of the present application will be apparent through the following detailed description of the specific embodiments of the present application combined with the drawings.

[0023] Figure 1 is the application scenario of the data access method provided by the embodiment of the present application.

[0024] Figure 2 is the first flowchart of the data access method provided by the embodiment of the present application.

[0025] Figure 3 is the interface diagram of the configuration interface in the embodiment of the present application.

[0026] Figure 4 is the interface diagram of the query interface in the embodiment of the present application.

[0027] Figure 5A second flowchart of a data access method provided by an embodiment of the present application.

[0028] Figure 6 A structure diagram of a data access device provided by an embodiment of the present application.

[0029] Figure 7 A structure diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0031] The embodiments of the present application provide a data access method, a data access device, an electronic device and a computer readable storage medium, wherein the data access device can be integrated in an electronic device, which can be a server or a terminal or the like.

[0032] Please refer to Figure 1 , Figure 1 A scene diagram in which the data access method provided by the embodiments of the present application is applied, which can include terminals and servers, and the terminals, the servers and the terminals and the servers are connected and communicated through various gateways in the Internet or the like, and the application scene includes a user terminal 11 and a server 12; wherein the user terminal 11 can be a device with human-computer interaction function; the server 12 includes a local server and / or a remote server or the like.

[0033] The user terminal 11 and the server 12 are located in a wireless network or a wired network to realize data interaction between the two, wherein:

[0034] The server 12 first receives a data access request for target data sent by a target user on the user terminal 11, then determines an access permission level of the target user according to the data access request, determines a target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to a preset mapping relationship between the user and the data security classification rule and the data access request, acquires a target security level of the target data under each target data security classification rule, matches the access permission level of the target user and each target security level of the target data, and finally judges whether the target user has access permission to the target data according to the matching result, and if so, returns the target data to the user terminal 11 where the target user is located.

[0035] It should be noted that,Figure 1 The system scenario diagram shown is only an example, and the server and scenario described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, as the system evolves and new business scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. The following are described in detail respectively. It should be noted that the sequence of the following embodiment descriptions does not constitute a limitation on the preferred sequence of the embodiments.

[0036] Please refer to Figure 2 , Figure 2 is a first flow diagram of a data access method provided by the embodiments of the present application, which specifically includes the following steps.

[0037] S1: receiving a data access request of a target user for target data.

[0038] The data in the present application refers to data contained in a financial system, such as customer information, transaction information, institution information, and various types of data, which can be stored in corresponding databases. The user refers to a person who has access requirements for some or all data, specifically referring to a financial institution internal staff. When the target user has access requirements for the target data, the target user needs to send a data access request for the target data to the server, and the server receives the request and responds.

[0039] In one embodiment, before S1, it further includes: receiving a configuration operation for a plurality of different data security classification rules; in response to the configuration operation, generating a plurality of data security classification rules; based on a preset audit condition, auditing the plurality of data security classification rules; when the audit is passed, classifying the data based on the plurality of data security classification rules to obtain the security level of the data under different data security classification rules.

[0040] For all the data mentioned above, in order to ensure the security of the data, the data needs to be classified first, and the access permission of the customer is classified at the same time. The data with a higher security level can only be accessed by the user with a higher access permission level, while the data with a lower security level can be accessed by the user with a higher and lower access permission level. For example, the transaction institutions and transaction dates of multiple transactions have a lower security level, and both the user with a low access permission level and the user with a high access permission level in the bank can access them, while the customer information and transaction amount information involved in each transaction can only be accessed by the user with a high access permission level, and the user with a low access permission level cannot access them. Through the data classification and access permission classification, the security of the data can be improved, and information leakage can be prevented.

[0041] Before a user initiates an access request, the data is first classified according to preset data security classification rules. These rules, developed internally by financial institutions in accordance with relevant laws and regulations, specify the classification objectives, scope, and basis. In this embodiment, the data has multiple different data security classification rules, and the classification objectives, scope, and basis for each rule are not entirely equal. Therefore, the same data will have different security levels under different data security classification rules. For example, data security classification rule S targets all data in databases 2 to 4, with a classification scope of S1 to S5, where the data security level decreases sequentially from S1 to S5, based on the sensitivity of the data fields. Data security classification rule Q targets all data in databases 1 to 5, with a classification scope of Q1 to Q5, where the data security level decreases sequentially, based on the sensitivity of the business scope to which the data belongs. For data 'a' in database 3, its security level might be S3 under data security classification rule S, but Q2 under data security classification rule Q.

[0042] In this application embodiment, data can be analyzed from multiple different dimensions to construct multi-dimensional data security classification rules. For example, classification can be based on field sensitivity, with data having field 1 in one level and data having field 2 in another level; or, classification can be based on business sensitivity, with data belonging to business 1 in one level and data belonging to business 2 in another level, and so on.

[0043] In this embodiment of the application, the user first performs configuration operations for multiple different data security classification rules on the configuration interface, such as... Figure 3 As shown, during configuration, a data security classification rule table can be built first. This table contains elements such as rule category (first-level, second-level, third-level, etc.), rule name (the name set in the system for the current rule), rule level (the classification of data within the current rule), and matching mode or matching condition (full matching mode, incremental matching mode, etc. when data matches the rule). Then, based on this table, each element is configured sequentially on the interface. The server responds to this configuration operation, generating multiple data security classification rules. To ensure the accuracy of the final data classification, these generated data security classification rules need to be reviewed based on preset review conditions. Upon approval, these rules are published in the corresponding systems. Then, based on multiple data security classification rules, different security classifications are applied to the data to obtain the data's security level under different rules. For example... Figure 4As shown, the data security classification rules can be selected first, and then all data in the current system can be queried (full mode) or data with a security level of null can be queried (incremental mode). Based on the data security classification rules, the selected data is automatically matched, and the corresponding security level under the current data security classification rule is marked for the data.

[0044] S2: According to the data access request, the access permission level of the target user is determined, and the target data security classification rule with access permission of the target user is determined from a plurality of different data security classification rules according to the preset mapping relationship between the user and the data security classification rule and the data access request.

[0045] Each user will be assigned a corresponding access permission level before initiating an access request. The access permission level is used to limit the user's access permission to data of different security levels. When the access permission level of a certain user is level 2, it can access all data in the system with a security level of 2 or below. Each user has its corresponding access permission level, and when the target user initiates a data access request, the access permission level of the target user can be determined according to the user identifier corresponding to the data access request, and the preset mapping relationship between all users and data security classification rules is obtained.

[0046] The preset mapping relationship is used to indicate which data security classification rules the user can access (data marked with security level by these data security classification rules), and which data security classification rules the user cannot access (data not marked with security level by these data security classification rules), for example, the system has three data security classification rules S, Q and P, and a certain user has a mapping relationship with data security classification rules S and Q, which means it can only access data marked by data security classification rules S and Q. If a certain data is only marked by data security classification rule P, it cannot be accessed by the user. After obtaining the preset mapping relationship, the identity of the target user can be determined according to the data access request, and then from the preset mapping relationship containing all users and all data security classification rules, the target data security classification rule with mapping relationship with the target user can be determined, and the target user has access permission to these target data security classification rules.

[0047] In an embodiment, before S2, further comprising: obtaining role information and business information of the plurality of users; and establishing a preset mapping relationship between each user and each data security classification rule according to the role information and the business information of each user. In establishing the preset mapping relationship, the role information and the business information of each user can be referred to simultaneously, the role information is used to represent the working role of each user in the organization, such as sales, manager, operation, etc., and the business information is used to represent the business category that each user needs to be responsible for, such as report summary, information release, transaction accounting, etc. In theory, if two roles are the same, the business they are responsible for will also be consistent, but in actual scenarios, personnel reuse often occurs, and two identical roles may also appear one responsible for a single business and the other responsible for multiple businesses, therefore, the role information and the business information of each user can be considered comprehensively to determine the data security classification rules closely related to each user from the plurality of data security classification rules. For example, when the role and the business of a certain user represent the restriction conditions of the data required to be accessed by the user for work, and the restriction conditions are only related to the business responsible by the user, only a preset mapping relationship needs to be established between the user and the data security classification rule based on business sensitivity, and if the role and the business of a certain user represent the restriction conditions of the data required to be accessed by the user for work, and the restriction conditions are related to both the business responsible by the user and the fields of the data involved, then a preset mapping relationship needs to be established between the user and both the business data security classification rule and the field business data security classification rule.

[0048] S3: obtaining a target security level of the target data under each target data security classification rule.

[0049] The data security classification rules established based on different conditions have different division standards for the sensitivity of data, and therefore the same data has independent security levels under different data security classification rules. These independent security levels can be the same level (for example, the security levels of S2 and Q2 are both level 2), or different levels (for example, S2 is level 2 and Q3 is level 3, and the security level of S2 is higher than that of Q3). After determining the target data security classification rules of the target user having access permission in the above steps, the target security level of the target data under each target data security classification rule is obtained, for example, the security level of the target data is level 2 in the target data security classification rule based on business sensitivity, and the security level of the target data is level 3 in the target data security classification rule based on field sensitivity, and therefore the target security level of the target data is represented by S2 and Q3 respectively.

[0050] It should be noted that the target data security classification rules of the target user are at least one, i.e. can be only one, at this time the target data can be marked only by the target data security classification rule, or can be two or more, at this time if the target data is only marked under multiple target data security classification rules, multiple security levels can be obtained, but the target data can be marked only under part of the target data security classification rules, at this time only part of the security levels can be obtained.

[0051] S4: Matching the access permission level of the target user and each target security level of the target data, and judging whether the target user has the access permission of the target data according to the matching result.

[0052] When the security levels of all data in the system include levels 1 to 5, the access permission levels of each user can also be levels 1 to 5, and the security level of the data accessible by each user is not higher than the access permission level of the user. The access permission level of the target user is matched with each target security level of the target data, and if the matching result indicates that there is a target security level not higher than the access permission level of the target user, it is judged that the target user has the access permission of the target data. For example, the access permission level of the target user is level 3, represented by K3, the target security level of the target data in the target data security classification rule based on business sensitivity is level 2, represented by S2, and the security level in the target data security classification rule based on field sensitivity is level 3, represented by Q3. After matching, since K3 is less than S2 but not less than Q3, it is indicated that the target user has the access permission of the target data.

[0053] In an embodiment, S4 specifically includes: determining the lowest target security level from each target security level of the target data; matching the access permission level of the target user and the lowest target security level; and if the matching result represents that the access permission level is not less than the lowest target security level, it is judged that the target user has the access permission of the target data.

[0054] When the target security levels of the target data include multiple target security levels, as long as one target security level is not less than the access permission level, it is indicated that the target user has the access permission of the target data. Therefore, the lowest target security level can be determined from the multiple target security levels first, and only it is matched with the access permission level, if it is not higher than the access permission level, it is judged that the access permission is obtained, if it is higher than the access permission, the second lower target security level in the order from low to high is matched with the access permission level, and so on, until the target security level higher than the access permission is found, or the matching of the highest target security level and the access permission is completed.

[0055] Specifically, assuming that there are a business m and a business n, according to a data security classification rule formulated according to business sensitivity, the security level of data involved in the business m is level 3, the security level of data involved in the business n is level 2, and according to a data security classification rule formulated according to field sensitivity, a certain account involved in all businesses has only part of the digits at level 3 and the other part of the digits at level 2, the access permission level of the target user 1 and the target user 2 is K3, and for the target user 1, only the access permission for the field data security classification rule is provided, and for the target user 2, the access permission for the above two data security classification rules is provided. When the target data requested is a certain account in the business m, for the target user 1 and the target user 2, only part of the digits in the account can be obtained under the field data security classification rule, but the target user 2 has a preset mapping relationship with the business data security classification rule, and under the rule, the security level of data involved in the business m is not lower than the access permission level, so the target user 2 can obtain the remaining part of the digits of the account to obtain the complete account. In the above manner, two users with the same access permission level can access different data contents.

[0056] In the prior art, each data is classified according to a single standard, such as classification according to a field, so that each data has a unique security level, and users with the same access permission level can only access data with the same security level. When some users need to obtain data with a high security level and need to bear some additional work, a manual review process needs to be performed, and this time the review is only open to the permission of the data requested this time, and the next time the user may request new data and the permission needs to be opened again, so that the efficiency is low and the applicable scene is single.

[0057] In the present application, the data is classified according to different data security classification rules in advance, as long as the user is mapped to a certain data security classification rule, all data marked based on the data security classification rule can be directly accessed after pre-audit as long as the security level is not higher than the access permission level of the user, and repeated manual review is not required, so that the efficiency is high. Since multiple different data security classification rules are provided, the security level of the same data under different data security classification rules is not completely the same, by constructing a preset mapping relationship, different users with the same access permission level have access permission for different data security classification rules, so that the same target data can have access permission for only part of the users and does not have access permission for the other part of the users, that is, the security level of the same target data for different users is different, so that the differentiated access of the same permission level user to the data is realized, and the complex scene requirement is met.

[0058] S5: Yes, return the target data to the target user.

[0059] After matching, if the target user has access rights to the target data, the target data can be returned to the target user, and the target user can perform subsequent other work based on the target data.

[0060] In an embodiment, after S4, further comprising: if no, generating and sending an access right audit request for the target data to an audit user; updating the access rights of the target user to the target data according to the access right audit response returned by the audit user. If it is found that the target user does not have access rights to the target data after matching, the manual audit mode is started, an access right audit request for the target data is generated and sent to the audit user, and the audit user will decide whether to relax the access rights of the target user to the target data according to the working condition of the user and the preset audit standard after receiving the request. If it can be relaxed, an access right audit response is returned, and the server relaxes the access rights of the target user to the target data according to the response, so that the target user can have access rights to the target data and successfully obtain the target data. In the present application, only when all the data under the security level rules requested by the user cannot be obtained by the user, manual audit is required. Therefore, compared with the prior art, manual audit is required every time, the process is simplified, and the efficiency is improved.

[0061] In an embodiment, after the step of updating the access rights of the target user to the target data according to the access right audit response returned by the audit user, further comprising: obtaining first access right audit data of a plurality of users of the same access right level in a first historical time period; determining overstep data corresponding to the access right audit request of the plurality of users according to the first access right audit data, and determining first overstep data whose request proportion is greater than a first threshold; determining a first data security classification rule corresponding to the first overstep data from a plurality of different data security classification rules, and reducing the security level of the first overstep data under the first data security classification rule.

[0062] The first historical time period can be one month or several months from the current day, or tens of days from the current day, or other past time periods. The length and period of the first historical time period can be selected as needed. The first access right audit data refers to the audit data generated in the manual audit stage after the access right level and the security level of the data do not match after the plurality of users of the same access right level in the first historical time period initiate an access request and are found to be inconsistent by pre-audit. The audit data specifically can include the type of requested data, the security level of the data under each data security classification rule, the target data security classification rule that forms a mapping relationship with the requesting user, and other information. The data transferred to the manual audit stage is referred to as overstep data, indicating that the user currently does not have access rights to the data.

[0063] For each batch of users belonging to the same level, the first cross-level data with a request proportion greater than the first threshold value is determined by counting all cross-level data of the batch of users in the first historical time period. The first cross-level data is the most requested cross-level data of all users in the same access level. First, determine which data security classification rules the first cross-level data has annotations, and determine these data security classification rules as the first data security classification rules. Then, reduce the security level of the first cross-level data under the first data security classification rules. The existence of the first cross-level data indicates that the current data security classification rules are inaccurate, resulting in an excessively high security level of the first cross-level data, more requests and manual audits for the first cross-level data, and waste of resources. By reducing the security level of the first cross-level data, subsequent requests for the data will not enter the manual audit stage, improving efficiency.

[0064] In an embodiment, after the step of updating the access permission of the target user to the target data according to the access permission audit response returned by the audit user, the method further comprises: obtaining second access permission audit data of the same target user in a second historical time period; determining cross-level data corresponding to the access permission audit request of the target user according to the second access permission audit data, and determining second cross-level data with a request proportion greater than a second threshold value; determining the lowest non-target security level from each non-target security level of the second cross-level data, and determining the second data security classification rule corresponding to the lowest non-target security level; updating the second data security classification rule as the target security level of the target user.

[0065] The second historical time period can be one month or several months from the current day, or tens of days from the current day, or other past time periods. The length and period of the second historical time period can be selected as needed. The first access permission audit data refers to the audit data generated in the manual audit stage after the access request of a target user is initiated, the access permission level is found to be inconsistent with the security level of the data by pre-audit, and the data is transferred to the manual audit stage. The first access permission audit data can include the type of requested data, the security level of the data under each data security classification rule, the target data security classification rule mapped with the requesting user, and other information. The data transferred to the manual audit stage is referred to as cross-level data, indicating that the user currently does not have access to the data.

[0066] For the same target user, all their out-of-level data within the second historical time period are statistically analyzed. This identifies the second out-of-level data whose request ratio exceeds a second threshold. The second out-of-level data is the out-of-level data requested most frequently by the target user. First, it is determined under which data security classification rules the second out-of-level data is labeled, and which target data security classification rules correspond to the target user. Then, the rules that label the second out-of-level data but do not belong to the target data security classification rules are identified as non-target data security classification rules. The security level of the second out-of-level data under these non-target data security classification rules is the non-target security level. All non-target security levels are sorted, and the lowest level is the lowest non-target security level. The non-target data security classification rule corresponding to the lowest non-target security level is the second data security classification rule. Finally, the second data security classification rule is updated to the target user's target security level.

[0067] The existence of a second, over-the-top data indicates that the current data security classification rules are somewhat inaccurate. This results in the second, over-the-top data having an excessively high security level under all current target data security classification rules. Consequently, every request for the second, over-the-top data requires manual review, leading to a waste of resources. After updating the second data security classification rule, which was originally a non-target security classification rule, to a target security classification rule, the subsequent access permission level for this data will match the security level under the second data security classification rule, thus avoiding the manual review stage and improving efficiency.

[0068] like Figure 5 The diagram shown is a second flowchart of the data access method provided in this application embodiment. The flowchart mainly includes:

[0069] 101: Target user login platform.

[0070] 102: The server receives a data access request for the target data sent by the target user.

[0071] 103: The server verifies whether the target user has permission to access the target data in the system. The verification process refers to the specific steps in the above embodiments.

[0072] If permissions are granted, execute step 104: Target user accesses the target data. Step 107: End.

[0073] If you do not have permission, execute 105: The server will automatically remind the data administrator that there is an overstepping request.

[0074] 106: Manual review to determine whether the application for bypassing the proper channels can be approved.

[0075] If the review is approved, proceed to step 104; if the review is not approved, proceed to step 107.

[0076] In this embodiment, the above process provides relevant personnel with a systematic and automated data security level management platform. Users can use the system to perform application review, data security query, and rule application, eliminating the workload of manual data processing and improving the security, compliance, and efficiency of data viewing. Furthermore, the automated rule application efficiently tags data, accelerating the data viewing needs of account managers or other departments and improving data empowerment efficiency. In addition, this application, by integrating online application, system pre-approval, and online manual approval, systematically verifies whether users have exceeded their authority in applying and automatically reminds data administrators of pending approval items. All these operations are logged, ensuring the security, compliance, and traceability of data viewing and data capability reuse.

[0077] As can be seen from the above embodiments, the data access method of this application sets multiple different data security classification rules, so that the security level of the same data is not completely the same under different data security classification rules. By constructing a preset mapping relationship, different users with the same access permission level have access permissions to different data security classification rules. Thus, the same target data can only be accessed by some users and not by others. That is, the security level of the same target data is different for different users, thereby realizing differentiated access to data by users with the same access permission level, meeting the needs of complex scenarios, and eliminating the need to review and revoke permissions for users who want to access high-security-level data every time, thus significantly improving efficiency.

[0078] Based on the methods described in the above embodiments, this embodiment will be further described from the perspective of a data access device. Please refer to [link / reference]. Figure 6 The data access device may include:

[0079] The receiving module 110 is used to receive data access requests from the target user for target data;

[0080] The determining module 120 is used to determine the access permission level of the target user based on the data access request, and to determine the target data security classification rule that the target user has access permission from multiple different data security classification rules based on the preset mapping relationship between the user and the data security classification rule and the data access request.

[0081] The acquisition module 130 is used to acquire the target security level of the target data under each target data security classification rule;

[0082] Matching module 140 is used to match the access permission level of the target user and the target security level of the target data, and determine whether the target user has access permission to the target data based on the matching result;

[0083] The returning module 150 is configured to return the target data to the target user if yes.

[0084] In an embodiment, the data access apparatus further comprises:

[0085] The first receiving module is configured to receive a configuration operation for a plurality of different data security classification rules.

[0086] The first generating module is configured to generate a plurality of data security classification rules in response to the configuration operation.

[0087] The auditing module is configured to audit the plurality of data security classification rules based on a preset auditing condition.

[0088] The obtaining module is configured to obtain a security level of the data under different data security classification rules based on the plurality of data security classification rules when the auditing passes.

[0089] In an embodiment, the data access apparatus further comprises:

[0090] The first obtaining module is configured to obtain role information and business information of a plurality of users.

[0091] The establishing module is configured to establish a preset mapping relationship between each user and each data security classification rule according to the role information and the business information of each user.

[0092] In an embodiment, the matching module 140 comprises:

[0093] The determining sub-module is configured to determine a lowest target security level from each target security level of the target data.

[0094] The matching sub-module is configured to match an access permission level of the target user and the lowest target security level.

[0095] The judging sub-module is configured to judge that the target user has an access permission for the target data if the matching result represents that the access permission level is not less than the lowest target security level.

[0096] In an embodiment, the data access apparatus further comprises:

[0097] The second generating module is configured to generate and send an access permission auditing request for the target data to an auditing user if no.

[0098] The first updating module is configured to update the access permission of the target user for the target data according to an access permission auditing response returned by the auditing user.

[0099] In an embodiment, the data access apparatus further comprises:

[0100] The second obtaining module is configured to obtain first access permission review data of a plurality of users of the same access permission level in a first historical time period;

[0101] The first determining module is configured to determine overstep data corresponding to access permission review requests of the plurality of users according to the first access permission review data, and determine first overstep data with a request proportion greater than a first threshold value;

[0102] The second determining module is configured to determine a first data security classification rule corresponding to the first overstep data from a plurality of different data security classification rules, and reduce data security classification of the first overstep data under the first data security classification rule.

[0103] In an embodiment, the data access apparatus further comprises:

[0104] The third obtaining module is configured to obtain second access permission review data of the same target user in a second historical time period;

[0105] The third determining module is configured to determine overstep data corresponding to access permission review requests of the target user according to the second access permission review data, and determine second overstep data with a request proportion greater than a second threshold value;

[0106] The fourth determining module is configured to determine a lowest non-target security level from the non-target security levels of the second overstep data, and determine a second data security classification rule corresponding to the lowest non-target security level;

[0107] The second updating module is configured to update the second data security classification rule as a target security level of the target user.

[0108] Compared with the prior art, the data access apparatus provided by the application sets a plurality of different data security classification rules, so that the security levels of the same data under different data security classification rules are not completely the same. By constructing a preset mapping relationship, different users of the same access permission level have access permissions to different data security classification rules, so that the same target data can only have access permissions for a part of users and does not have access permissions for another part of users, i.e., the security levels of the same target data for different users are different, thereby realizing differentiated access of the same permission level user to data, meeting complex scene requirements, and no longer needing to perform permission review and permission recovery for users who want to access high security level data each time, so that the efficiency is significantly improved.

[0109] Correspondingly, the embodiments of the application also provide an electronic device, such as Figure 7As shown, the electronic device can include a radio frequency (RF) circuit 701, a memory 702 including one or more computer readable storage media, an input unit 703, a display unit 704, a sensor 705, an audio circuit 706, a WiFi module 707, a processor 708 including one or more processing cores, and a power supply 709, etc. Those skilled in the art can understand that Figure 7 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than shown, or combine certain components, or different component arrangements. Among them:

[0110] The radio frequency circuit 701 can be used for receiving and sending signals in the process of receiving or calling information. In particular, after receiving the downlink information of the base station, it is processed by one or more processors 708. In addition, the data related to the uplink is sent to the base station. The memory 702 can be used to store software programs and modules, and the processor 708 can execute various functional applications and data access by running the software programs and modules stored in the memory 702. The input unit 703 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to customer settings and function control.

[0111] The display unit 704 can be used to display information input by the customer or information provided to the customer and various graphical customer interfaces of the server, which can be composed of graphics, text, icons, video and any combination thereof.

[0112] The electronic device can also include at least one sensor 705, such as a light sensor, a motion sensor, and other sensors. The audio circuit 706 includes a speaker, which can provide an audio interface between the customer and the electronic device.

[0113] WiFi belongs to short-range wireless transmission technology. The WiFi module 707 can help the customer to send and receive emails, browse web pages, and follow streaming media, etc. It provides customers with wireless broadband Internet access. Although Figure 7 The WiFi module 707 is shown, but it can be understood that it does not belong to the necessary structure of the electronic device, and can be omitted as needed without changing the essence of the application.

[0114] The processor 708 is the control center of the electronic device, which connects all parts of the mobile phone through various interfaces and lines, executes various functions and processes data of the electronic device by running or executing software programs and / or modules stored in the memory 702, and calling data stored in the memory 702, and thus monitors the whole mobile phone.

[0115] The electronic device also includes a power supply 709 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 708 through a power management system, so that the power management system can manage charging, discharging, and power consumption management, and the like.

[0116] Although not shown, the electronic device can also include a camera, a Bluetooth module, and the like, which will not be described here. In the present embodiment, the processor 708 in the server will load one or more executable files corresponding to the processes of the application program into the memory 702 according to the following instructions, and run the application program stored in the memory 702 by the processor 708, so as to realize the following functions:

[0117] receiving a data access request of a target user for target data;

[0118] According to the data access request, determining the access permission level of the target user, and determining the target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to a preset mapping relationship between the user and the data security classification rule and the data access request;

[0119] Obtaining the target security level of the target data under each target data security classification rule;

[0120] Matching the access permission level of the target user and the target security level of the target data, and determining whether the target user has access permission to the target data according to the matching result;

[0121] If yes, returning the target data to the target user.

[0122] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the detailed description above, which will not be described here.

[0123] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by instructions controlling related hardware, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0124] To this end, an embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to realize the following functions:

[0125] receiving a data access request of a target user for target data;

[0126] According to the data access request, a data access permission level of the target user is determined, and a target data security classification rule in which the target user has access permission is determined from a plurality of different data security classification rules according to a preset mapping relationship between the user and the data security classification rule and the data access request;

[0127] A target security level of the target data under each target data security classification rule is obtained.

[0128] The data access permission level of the target user and the target security level of the target data are matched, and it is determined whether the target user has access permission to the target data according to a matching result.

[0129] If yes, the target data is returned to the target user.

[0130] The above describes in detail a data access method, device, electronic equipment and computer readable storage medium provided by the embodiments of the present application. The principles and implementation manners of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the technical solutions of the present application and the core idea thereof. Those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data access method, characterized by, The method comprises the following steps: receiving a data access request of a target user for target data; determining an access permission level of the target user according to the data access request, determining a target data security classification rule in which the target user has access permission from a plurality of different data security classification rules according to a preset mapping relationship between users and data security classification rules and the data access request; obtaining a target security level of the target data under each target data security classification rule; matching the access permission level of the target user and the target security level of the target data, and determining whether the target user has access permission for the target data according to the matching result; if yes, returning the target data to the target user; wherein, after the step of determining whether the target user has access permission for the target data according to the matching result, the method further comprises the following steps: if no, generating and sending an access permission review request for the target data to an audit user; updating the access permission of the target user for the target data according to the access permission review response returned by the audit user; wherein, after the step of updating the access permission of the target user for the target data according to the access permission review response returned by the audit user, the method further comprises the following steps: obtaining second access permission review data of the same target user in a second historical time period; determining overstep data corresponding to the access permission review request of the target user according to the second access permission review data, and determining second overstep data whose request proportion is greater than a second threshold value; determining a lowest non-target security level from each non-target security level of the second overstep data, and determining a second data security classification rule corresponding to the lowest non-target security level; updating the second data security classification rule as the target security level of the target user.

2. The data access method of claim 1, wherein, Before the step of receiving a data access request of a target user for target data, the method further comprises the following steps: receiving a configuration operation for a plurality of different data security classification rules; generating a plurality of data security classification rules in response to the configuration operation; auditing the plurality of data security classification rules based on a preset audit condition; when the audit is passed, performing different security classification on data based on the plurality of data security classification rules to obtain the security level of the data under different data security classification rules.

3. The data access method of claim 1, wherein, Before the step of determining the access permission level of the target user according to the data access request, the method further comprises the following steps: obtaining role information and business information of a plurality of users; establishing a preset mapping relationship between each user and each data security classification rule according to the role information and the business information of each user.

4. The data access method of claim 1, wherein, The step of matching the access permission level of the target user and the target security level of the target data, and determining whether the target user has access permission for the target data according to the matching result, comprises the following steps: determining a lowest target security level from each target security level of the target data; matching the access permission level of the target user and the lowest target security level; If the matching result represents that the access permission level is not less than the minimum target security level, it is determined that the target user has access permission to the target data.

5. The data access method of claim 1, wherein, After the step of updating the access permission of the target user to the target data according to the access permission audit response returned by the audit user, the method further comprises: obtaining first access permission audit data of a plurality of users of the same access permission level in a first historical time period; determining, according to the first access permission audit data, overstep data corresponding to the access permission audit request of the plurality of users, and determining first overstep data whose request proportion is greater than a first threshold value; determining, from a plurality of different data security classification rules, a first data security classification rule corresponding to the first overstep data, and reducing the security level of the first overstep data under the first data security classification rule.

6. A data access device, characterized by comprises: a receiving module configured to receive a data access request of a target user for target data; a determining module configured to determine an access permission level of the target user according to the data access request, determine, from a plurality of different data security classification rules, a target data security classification rule for which the target user has access permission according to a preset mapping relationship between a user and a data security classification rule and the data access request; an obtaining module configured to obtain a target security level of the target data under each target data security classification rule; a matching module configured to match the access permission level of the target user and each target security level of the target data, and determine whether the target user has access permission to the target data according to a matching result; a returning module configured to, if yes, return the target data to the target user; a second generating module configured to, if no, generate and send an access permission audit request for the target data to an audit user; a first updating module configured to update the access permission of the target user to the target data according to an access permission audit response returned by the audit user; a third obtaining module configured to obtain second access permission audit data of the same target user in a second historical time period; a third determining module configured to determine, according to the second access permission audit data, overstep data corresponding to the access permission audit request of the target user, and determine second overstep data whose request proportion is greater than a second threshold value; a fourth determining module configured to determine a minimum non-target security level from each non-target security level of the second overstep data, and determine a second data security classification rule corresponding to the minimum non-target security level; a second updating module configured to update the second data security classification rule as a target security level of the target user.

7. An electronic device, comprising: The memory stores an application program, and the processor is configured to run the application program in the memory to execute the steps in the data access method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium and is executed by the processor to implement the steps in the data access method of any one of claims 1 to 5.

Images