A system and method for fine-grained permission management of a drilling and completion database
By introducing a local database encryption/decryption module and a behavior permission management module into the drilling and completion database system, the problem of insufficient permission management capabilities was solved, enabling fine-grained control at the data level, avoiding data entry conflicts and accidental modifications, and ensuring compatibility with existing technologies.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CNOOC ENERGY TECHNOLOGY & SERVICES LTD
- Filing Date
- 2022-07-29
- Publication Date
- 2026-05-19
AI Technical Summary
The drilling and completion database system lacks sufficient access control capabilities, resulting in data entry conflicts and an inability to manage access permissions in a granular manner. Existing technologies can only achieve database-level access control.
It employs a local database encryption/decryption module and a behavior permission management module, and performs encrypted storage and user behavior management through the client to achieve fine-grained permission control, a permission management mode that does not rely on the database itself.
It achieves data-level access control, eliminates the possibility of accidental modification when multiple users collaboratively fill in data, enables fine-grained control of data access permissions, is compatible with existing technologies, and is easy to migrate.
Smart Images
Figure CN115357875B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of petroleum technology, and in particular to a fine-grained permission management system for drilling and completion databases. Background Technology
[0002] Database systems used in the drilling and completion field, such as drilling and completion operation databases or drilling and completion engineering databases, typically employ a database management system comprising both a local database and a network database. Local databases often use Access; network databases often use MySQL, Oracle, or SQL Server. Due to limitations in the network environment at drilling and completion operation sites, the general process for users to submit data is as follows: first, log in to the network database on the client using the network database's account and password; export the data file from the network database; import the data into the local database; fill in and modify data using the local database; and finally, synchronize the data to the network database by exporting the data file or using other upload methods.
[0003] The drilling and completion database system uses multiple database management systems (DBMS) to manage the same set of data. However, these DBMSs have varying levels of access control capabilities, creating a "weakest link" effect. This means the system's access control capability is ultimately dependent on the DBMS with the weakest access control capability—the local database's access control. Therefore, current access control in drilling and completion database systems only allows for database-level access control.
[0004] In practical use, the data entry for the drilling and completion database system is a collaborative process involving multiple users. For example, the database system requires drilling engineers to enter drilling data, and completion engineers to enter completion data. Since the database is built around wells, and completion data itself depends on drilling data, drilling and completion data are often designed to reside in the same database, or even the same table. This leads to data entry conflicts during the actual entry process. For instance, a completion engineer might accidentally modify drilling data, or a drilling engineer might accidentally modify completion data while adding data.
[0005] Furthermore, in practical use, there is also the problem of insufficient granular management of data access permissions. For example, a technician needs to query the drilling and completion fluid data of a certain well, but the current technical solution can only control access permissions at the database level. Once authorized, not only can they access the drilling and completion fluid data of this well, but also other data of this well and all data of other wells. For data confidentiality, currently, it can only be controlled manually, that is, authorized personnel query the data and then provide feedback to the technician. Summary of the Invention
[0006] The purpose of this invention is to provide a fine-grained access control system for drilling and completion databases, which includes a local database encryption / decryption module and a behavior access control module. It does not rely on the database's own access control mode, but uses the local database encryption / decryption module to encrypt and decrypt the local database, thereby achieving fine-grained control over data access permissions.
[0007] Another objective of this invention is to provide a fine-grained permission management method for drilling and completion databases, which achieves fine-grained permission management of drilling and completion databases by encrypting the local database and managing user behavior permissions.
[0008] To achieve the above objectives, the present invention adopts the following technical solution, including: a client and a server;
[0009] The client includes:
[0010] The main program is used to load and call various modules within the client.
[0011] The local database encryption / decryption module is used to encrypt and decrypt local databases.
[0012] The client-side user authentication module is used to verify user identity during login.
[0013] The database connection module is used to connect to databases and provides data interfaces for accessing and manipulating network databases and local databases;
[0014] The behavior permission management module is used to manage user behavior;
[0015] The user interface module provides the user interface, including the user login interface, data display interface, and operation interface.
[0016] The client update module is used to update various modules of the client, as well as update user behavior permissions;
[0017] The server includes:
[0018] The network database module provides network databases and a network database management system.
[0019] The client management module is used to manage client applications, client users, and client user behavior permissions.
[0020] Furthermore, a user behavior permission table is set up within the behavior permission management module, which is used to obtain the corresponding behavior permissions of a user by reading the user behavior permission table.
[0021] Furthermore, the client management module includes functions such as creating new users, deleting users, configuring user authentication information, and generating user identity configuration files; the client management module is responsible for managing the user behavior permission table, including adding, modifying, and deleting user behavior permissions within the user behavior permission table, and is also responsible for exporting the user behavior permission table; the client management module is responsible for generating encrypted client configuration files containing local and network database addresses, accounts, and passwords, and is also responsible for exporting the database configuration files.
[0022] Furthermore, the client management module is responsible for generating client upgrade files and providing online upgrade services to enable client upgrades.
[0023] A fine-grained permission management method for drilling and completion databases, characterized in that it is applied to the fine-grained permission management system for drilling and completion databases described in any of the above-mentioned embodiments, and includes the following steps:
[0024] S1. Set up the main program, local database encryption / decryption module, client user authentication module, database connection module, behavior permission management module, user interface module, and client update module within the client;
[0025] S2. Provides encrypted storage of the local database through the local database encryption / decryption module;
[0026] S3. Do not grant client users account passwords for local databases and network databases. Instead, verify client user identities independently through the client user authentication module to decouple client users from database accounts.
[0027] S4. Access the network database and the encrypted local database through the database connection module; the network database address, account, and password are encrypted and stored internally in the database connection module.
[0028] S5. Allows users to access data in the database indirectly only through the user interface module provided by the client;
[0029] S6. Manage user behavior through the established rules of the behavior permission management module;
[0030] S7. When the network database address, account password, user behavior permission rules, and various client modules need to be updated, the server is responsible for making the changes and pushing the updates; the client update module is used to update the client.
[0031] Further, in step S1, the main program includes the following steps:
[0032] S101. Load the local database encryption / decryption module, client user authentication module, database connection module, behavior permission management module, user interface module, and client update module;
[0033] S102. Call the user interface module to display the user login interface;
[0034] S103. The user enters user authentication information and selects the type of database to connect to;
[0035] S104. Call the client user authentication module to authenticate the user.
[0036] S105. After successful identity verification, obtain the user's corresponding action permissions;
[0037] S106. Call the database connection module and connect to the selected database according to the user's selection;
[0038] S107. Call the user interface module to display data and the operation interface;
[0039] S108, Waiting for user operation;
[0040] S109. Call the behavior permission processing module to process the user's behavior according to the user's behavior permissions.
[0041] Furthermore, in step S4, the database connection module includes the following steps when connecting to a network database or a local database and initializing the data interface:
[0042] S401. Obtain the database type selected by the user for connection;
[0043] S402. If the user chooses to connect to the local database, the local database encryption / decryption module is invoked.
[0044] S403, Decrypt the local database;
[0045] S404, Read local database account and password;
[0046] S405, Connect to the local database;
[0047] S406. If the user chooses to connect to the network database, read the network database account and password;
[0048] S407, Connect to network database;
[0049] S408, Initialize data interface.
[0050] Furthermore, in step S6, the behavior permission management module, when managing user behavior permissions, includes the following steps:
[0051] S601, Read the user behavior permission table;
[0052] S602, Obtain user identity;
[0053] S603, Obtain user behavior permissions;
[0054] S604, Waiting for the system to connect to the database;
[0055] S605, Waiting for user action;
[0056] S606. Process user behavior according to user behavior permissions.
[0057] The behavior permission management module processes user behavior based on user behavior permissions, including the following steps:
[0058] S6061. Verify whether the action requested by the user is within the user's authorized permissions.
[0059] S6062. If the user has the corresponding permission, then execute the action;
[0060] S6063. If the user does not have the corresponding permission, the action will be refused.
[0061] Furthermore, in step S7, the client update module updates the client in the following ways: when connected to the network, it updates by automatically downloading the update file; when there is no network, it updates by importing an offline upgrade package.
[0062] Furthermore, in step S7, the client and server jointly manage the update of the identity configuration file and the user behavior permission table, as follows:
[0063] S701, User Application;
[0064] S702, The server administrator receives the application;
[0065] S703: Administrators generate user identity configuration files and user behavior permission tables through the server.
[0066] S704, The administrator sends relevant files to the user, or pushes updates over the network;
[0067] S705, the user receives the relevant file, or the client receives the update push;
[0068] S706, Users import relevant files, or the client downloads updates;
[0069] S707, client update;
[0070] S708, the client completes the update after restarting.
[0071] The beneficial effects of this invention are: by encrypting the local database and simultaneously managing user behavior permissions on the client side, it no longer relies on the database's own permission management mode, thus achieving fine-grained permission management of the drilling and completion database system, i.e., data-level permission management; through data-level permission management, it eliminates the possibility of accidentally modifying other people's data items when multiple users collaboratively fill in data, and achieves fine-grained control over data access permissions; at the same time, it does not require adding any fields to the drilling and completion database, is fully compatible with existing technologies, and is easy to migrate. Attached Figure Description
[0072] Figure 1 This is a schematic diagram of a fine-grained permission management system for drilling and completion databases according to the present invention.
[0073] Figure 2 This is a schematic diagram of a fine-grained permission management method for drilling and completion databases according to the present invention.
[0074] Figure 3 This is a flowchart of the main program in this invention.
[0075] Figure 4 This is a flowchart of the user authentication module in this invention.
[0076] Figure 5 This is a flowchart of the database connection module in this invention.
[0077] Figure 6 This is a flowchart of the permission management module in this invention.
[0078] Figure 7 This is a flowchart illustrating how user behavior is processed based on user permissions in this invention.
[0079] Figure 8 This is a schematic diagram of the overall process of the system client in this invention. Detailed Implementation
[0080] The invention will now be described in further detail with reference to the accompanying drawings, so that those skilled in the art can implement it based on the description.
[0081] It should be understood that terms such as “having,” “comprising,” and “including” as used herein do not exclude the presence or addition of one or more other elements or combinations thereof.
[0082] like Figure 1As shown, the fine-grained permission management system for drilling and completion databases of the present invention includes: a client 100 and a server 200; the client 100 includes: a main program 110, used to add various modules within the client 100; a local database encryption / decryption module 120, used to encrypt and decrypt the local database; a client user authentication module 130, used to verify user identity during login; a database connection module 140, used to connect to the database and provide data interfaces for accessing and operating the network database and the local database; a behavior permission management module 150, used to manage user behavior and behavior permissions; a user interface module 160, used to provide a user interface, including a user login interface, a data display interface, and an operation interface; and a client update module 170, used to update various modules of the client and update user behavior permissions; the server 200 includes: a network database module 210, used to provide a network database and a network database management system; and a client management module 220, used to manage client applications, manage client users, and manage client user behavior permissions.
[0083] In another embodiment, a user behavior permission table is provided in the behavior permission management module 150, which is used to obtain the corresponding behavior permissions of the user by reading the user behavior permission table.
[0084] In another embodiment, the client management module 220 includes functions such as creating new users, deleting users, configuring user authentication information, and generating user identity configuration files; the client management module is responsible for generating the user behavior permission table, which includes functions such as adding user behavior permissions, modifying user behavior permissions, deleting user behavior permissions, and exporting the client user behavior permission table; the client management module is also responsible for generating an encrypted client configuration file containing local and network database addresses, accounts, and passwords, and for exporting the database configuration file.
[0085] In another embodiment, the client management module 220 is responsible for generating client upgrade files and providing online upgrade services to enable client upgrades.
[0086] like Figure 2 As shown, a fine-grained permission management method for drilling and completion databases, applied to any of the above-described fine-grained permission management systems for drilling and completion databases, includes the following steps:
[0087] S1. Set up the main program, local database encryption / decryption module, client user authentication module, database connection module, behavior permission management module, user interface module, and client update module within the client;
[0088] S2. Provides encrypted storage of the local database through the local database encryption / decryption module;
[0089] S3. Do not grant client users account passwords for local databases and network databases. Instead, verify client user identities independently through the client user authentication module to decouple client users from database accounts.
[0090] S4. Access the network database and the encrypted local database through the database connection module; the network database address, account, and password are encrypted and stored internally in the database connection module.
[0091] S5. Allows users to access data in the database indirectly only through the user interface module provided by the client;
[0092] S6. Manage user behavior through the established rules of the behavior permission management module;
[0093] S7. When the network database address, account password, user behavior permission rules, and various client modules need to be updated, the server is responsible for making the changes and pushing the updates; the client update module is used to update the client.
[0094] like Figure 3 As shown, in step S1, the main program 110 includes the following steps:
[0095] S101. Load the local database encryption / decryption module 120, client user authentication module 130, database connection module 140, behavior permission management module 150, user interface module 160 and client update module 170;
[0096] S102, Call the user interface module 160 to display the user login interface;
[0097] S103. The user enters user authentication information and selects the type of database to connect to;
[0098] S104. Call the client user authentication module 130 to authenticate the user;
[0099] S105. After successful identity verification, obtain the user's corresponding action permissions;
[0100] S106. Call the database connection module 140 and connect to the selected database according to the user's selection;
[0101] S107. Call the user interface module 160 to display the data display and operation interface;
[0102] S108, Waiting for user operation;
[0103] S109. Call the behavior permission processing module 150 to process the user's behavior according to the user's behavior permissions.
[0104] like Figure 4 As shown, in S104, the steps for verifying the user's identity through the client user authentication module 130 are as follows:
[0105] S1041. The user enters their username and password on the login screen;
[0106] S1042. Read the client username and password file;
[0107] S1043. Verify whether the username and password match;
[0108] S1044. If the username and password match, the verification is successful and the user's identity is returned.
[0109] S1045. If the username and password do not match, the verification fails and a prompt is displayed, waiting for the user to re-enter the information.
[0110] like Figure 5 As shown, in step S4, the database connection module 140 includes the following steps when connecting to a network database or a local database and initializing the data interface:
[0111] S401. Obtain the database type selected by the user for connection;
[0112] S402. If the user chooses to connect to the local database, the local database encryption / decryption module is invoked.
[0113] S403, Decrypt the local database;
[0114] S404, Read local database account and password;
[0115] S405, Connect to the local database;
[0116] S406. If the user chooses to connect to the network database, read the network database account and password;
[0117] S407, Connect to network database;
[0118] S408, Initialize data interface.
[0119] like Figure 6 As shown, in step S6, the behavior permission management module 150 performs the following steps when managing user behavior permissions:
[0120] S601, Read the user behavior permission table;
[0121] S602, Obtain user identity;
[0122] S603, Obtain user behavior permissions;
[0123] S604, Waiting for the system to connect to the database;
[0124] S605, Waiting for user action;
[0125] S606. Process user behavior according to user behavior permissions.
[0126] like Figure 7 As shown, the behavior permission management module processes user behavior based on user behavior permissions, including the following steps:
[0127] S6061. Verify whether the action requested by the user is within the user's authorized permissions.
[0128] S6062. If the user has the corresponding permission, then execute the action;
[0129] S6063. If the user does not have the corresponding permission, the action will be refused.
[0130] In step S7, the client update module updates the client in the following ways: when connected to the network, it updates by automatically downloading the update file; when there is no network, it updates by importing an offline upgrade package.
[0131] Step S7 also includes the following steps for the client and server to jointly manage the identity profile and user behavior permission table:
[0132] S701, User Application;
[0133] S702, The server administrator receives the application;
[0134] S703: Administrators generate user identity configuration files and user behavior permission tables through the server.
[0135] S704, The administrator sends relevant files to the user, or pushes updates over the network;
[0136] S705, the user receives the relevant file, or the client receives the update push;
[0137] S706, Users import relevant files, or the client downloads updates;
[0138] S707, client update;
[0139] S708, the client completes the update after restarting.
[0140] The overall process of client 100 is as follows Figure 8 As shown.
[0141] In summary, the present invention provides a fine-grained permission management system 1 for drilling and completion databases. By encrypting the local database and simultaneously managing user behavior permissions on the client side, it eliminates reliance on the database's own permission management mode, achieving fine-grained permission management of the drilling and completion database system, i.e., data-level permission management. Through data-level permission management, the possibility of accidental modification of others' data items when multiple users collaboratively fill in data is eliminated, and fine-grained control of data access permissions is achieved. At the same time, it does not require adding any fields to the drilling and completion database, is fully compatible with existing technologies, and is easy to migrate.
[0142] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and illustrations shown and described herein.
Claims
1. A fine-grained permission management method for drilling and completion databases, characterized in that, Includes the following steps: The fine-grained access control system for drilling and completion databases includes a client and a server. The client includes: The main program is used to load and call various modules within the client. The local database encryption / decryption module is used to encrypt and decrypt local databases. The client-side user authentication module is used to verify user identity during login. The database connection module is used to connect to databases and provides data interfaces for accessing and manipulating network databases and local databases; The behavior permission management module is used to manage user behavior; The user interface module provides the user interface, including the user login interface, data display interface, and operation interface. The client update module is used to update various modules of the client, as well as update user behavior permissions; The server includes: The network database module provides network databases and a network database management system. The client management module is used to manage client applications, client users, and client user behavior permissions. S1. Set up the main program, local database encryption / decryption module, client user authentication module, database connection module, behavior permission management module, user interface module, and client update module within the client; S2. Provides encrypted storage of the local database through the local database encryption / decryption module; S3. Do not grant client users account passwords for local databases and network databases. Instead, verify client user identities independently through the client user authentication module to decouple client users from database accounts. S4. Access the network database and the encrypted local database through the database connection module; the network database address, account, and password are encrypted and stored internally in the database connection module. S5. Allows users to access data in the database indirectly only through the user interface module provided by the client; S6. Manage user behavior through the established rules of the behavior permission management module; S7. When the network database address, account password, user behavior permission rules, and various client modules need to be updated, the server is responsible for making the changes and pushing the updates. Client updates are implemented through a client update module.
2. The fine-grained permission management method for drilling and completion databases as described in claim 1, characterized in that, In step S1, the main program includes the following steps: S101. Load the local database encryption / decryption module, client user authentication module, database connection module, behavior permission management module, user interface module, and client update module; S102. Call the user interface module to display the user login interface; S103. The user enters user authentication information and selects the database type to connect to; S104. The client user authentication module is invoked to authenticate the user. S105. After successful identity verification, obtain the user's corresponding action permissions; S106. Call the database connection module and connect to the selected database according to the user's selection; S107. Call the user interface module to display data and the operation interface; S108, Waiting for user operation; S109. Call the behavior permission processing module to process the user's behavior according to the user's behavior permissions.
3. The fine-grained permission management method for drilling and completion databases as described in claim 1, characterized in that, The database connection module includes the following steps when connecting to a network database or a local database and initializing the data interface: S401. Obtain the database type selected by the user for connection; S402. If the user chooses to connect to the local database, the local database encryption / decryption module is invoked. S403, Decrypt the local database; S404, Read local database account and password; S405, Connect to the local database; S406. If the user chooses to connect to the network database, read the network database account and password; S407, Connect to network database; S408, Initialize data interface.
4. The fine-grained permission management method for drilling and completion databases as described in claim 1, characterized in that, In step S6, the behavior permission management module manages user behavior permissions, including the following steps: S601, Read the user behavior permission table; S602, Obtain user identity; S603, Obtain user behavior permissions; S604, Waiting for the system to connect to the database; S605, Waiting for user action; S606. Process user behavior according to user behavior permissions; The behavior permission management module processes user behavior based on user behavior permissions, including the following steps: S6061. Verify whether the action requested by the user is within the user's authorized permissions. S6062. If the user has the corresponding permission, then execute the action; S6063. If the user does not have the corresponding permission, the action will be refused.
5. The fine-grained permission management method for drilling and completion databases according to claim 1, characterized in that, In step S7, the client update module updates the client in the following ways: when connected to the network, it updates by automatically downloading the update file; when there is no network, it updates by importing an offline upgrade package.
6. The fine-grained permission management method for drilling and completion databases according to claim 1, characterized in that, In step S7, the client and server jointly manage the update of the identity configuration file and the user behavior permission table, as follows: S701, User Application; S702, The server administrator receives the application; S703: Administrators generate user identity configuration files and user behavior permission tables through the server. S704, The administrator sends relevant files to the user, or pushes updates over the network; S705, the user receives the relevant file, or the client receives the update push; S706, Users import relevant files, or the client downloads updates; S707, client update; S708, the client completes the update after restarting.