Method and system for implementing graph function based on permission control, electronic device and storage medium

Abstract

The application relates to a permission control-based graph function implementation method, system, electronic device and storage medium, wherein the permission control-based graph function implementation method comprises the following steps: configuring Traverse permissions for a user in advance, including implicit permissions and explicit permissions; in the case that the user is assigned with the implicit permissions, the user is not exposed to query content in a query process; in the case that the user is assigned with the explicit permissions, all information except attributes of specified points and / or specified edges is read for the user when performing path query. According to the application, the Traverse permissions correspond to the access ability of a graph structure instead of the access ability of graph attributes, so that the graph function is implemented, the influence on graph features such as in-degree and out-degree is avoided, and the connectivity of an original graph and the correctness of GraphView information are preserved.

Description

Technical Field

[0001] This application relates to the field of distributed graph database technology, and in particular to methods, systems, electronic devices, and storage media for implementing graph functionality based on access control. Background Technology

[0002] With the increasing amount of information in modern society, large-scale graph technology is widely used, and depth query has become a frequent practical need. Depth query refers to querying paths with a large number of hops, aiming to find whether one or more paths exist between two points in the graph, thus enabling further graph analysis. For example, if there are many nodes between the starting point and the destination point, how to get from the starting point to the destination, and what points and edges are involved, this is a depth query, often used to find the shortest path, all paths, etc. Currently, there are numerous depth query techniques. The mainstream approach is to perform a bidirectional breadth-first search (BFS) from the starting point to the destination, and introduce indexes. These methods can significantly shorten query time and improve depth query performance on large-scale datasets. However, the meaning of these indexes differs from that of the underlying graph data. For example, the in-degree and out-degree of a point are important features; introducing a reachable index will change and increase the in-degree and out-degree of that point. Furthermore, when combined with a GraphView, the permission issues of the GraphView become more pronounced.

[0003] GraphView can meet the common needs of multi-team collaboration. Based on the same large graph, different teams can see different parts of the data. Displaying subgraph data through GraphView facilitates business analysis for business personnel. GraphView data can come from multiple graphs, vertices, or edges, and is dynamically generated without altering the data in the database. Business personnel don't need to worry about the graph structure or association conditions behind the GraphView; they only need to use the filtered result set that meets the criteria. This concept is similar to a View in an RDBMS, but there are technical differences: In an RDBMS, a view is logically based on rows and columns in a table, which is logically very natural; however, in a graph, connectivity (reachability) is extremely important (imagine a chain of infectious diseases). Restricting access to only some vertices and edges will severely damage the connectivity of the original graph (preventing access to patients in the chain of infection), leading to incorrect information in the GraphView.

[0004] Currently, no effective solution has been proposed for the problem that graph data queries in related technologies can affect graph features and even severely damage the connectivity of the original graph, leading to information errors. Summary of the Invention

[0005] This application provides a method, system, electronic device, and storage medium for implementing graph functions based on access control, in order to at least solve the problem in related technologies that graph data queries can affect graph features and even severely damage the connectivity of the original graph, leading to information errors.

[0006] In a first aspect, embodiments of this application provide a method for implementing graph functionality based on access control. This method pre-configures Traverse permissions for users, including implicit and explicit permissions; the method includes:

[0007] When a user has been assigned implicit permissions, the query content is not exposed to the user during the query process;

[0008] When a user is assigned explicit permissions, all information except attributes for the specified points and / or edges is read when a path query is performed.

[0009] In some embodiments, when performing a path query, the process reads all information for the user, excluding attributes, for a specified point and / or edge. This process includes: when performing a path query, reading the ID and Tag of the point that meets the permission conditions, and the Edge type and Rank of the edge for the user.

[0010] In some embodiments, the method pre-computes the data of the entire graph offline in batches, and constructs a Referral Edge every target number of hops for use in query paths;

[0011] If the user is assigned implicit permissions, the method further includes: performing a path query based on the Referral Edge to accelerate the depth query, and decoding the Referral Edge into the corresponding point and / or edge when returning the query results.

[0012] In some embodiments, after the Referral Edge is constructed, all Referral Edges and their corresponding point-edge mappings are stored on the hard disk, and all Referral Edge records are sorted in order on the hard disk; the first field of the Referral Edge storage format records the user's Traverse permissions for the Referral Edge.

[0013] In some embodiments, the method is applied to a Graph View;

[0014] Pre-grant or deny user attribute permissions and Traverse permissions for points that meet specified characteristics. When implementing Graph View, for all Referral Edge records, restrict access to users only if they have the corresponding Traverse permission.

[0015] In some embodiments, when a new point and / or edge is written to the database system, or when a point and / or edge is modified, the Referral Edge within the target hop distance range is updated based on the new point and / or edge or the modified point and / or edge.

[0016] Secondly, embodiments of this application provide a graph functionality implementation system based on access control, the system comprising:

[0017] The first preset module is used to configure Traverse permissions for users, including implicit permissions and explicit permissions;

[0018] The execution module is used to prevent the query content from being exposed to the user during the query process when the user has been granted implicit permissions; and to read all information except attributes of the specified point and / or edge when performing a path query when the user has been granted explicit permissions.

[0019] In some embodiments, the system further includes: a second preset module for offline batch calculation of data for the entire graph, constructing a Referral Edge every target hop count for use in query paths;

[0020] The execution module is also used to perform path queries based on the ReferralEdge when the user has been assigned implicit permissions, in order to accelerate deep queries, and to decode the Referral Edge into the corresponding point and / or edge when returning the query results.

[0021] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the permission-controlled graph function implementation method.

[0022] Fourthly, embodiments of this application provide a storage medium storing a computer program, wherein the computer program is configured to execute the permission-controlled graph function implementation method at runtime.

[0023] Compared to related technologies where graph data queries can affect graph features and even severely disrupt the connectivity of the original graph, leading to information errors, the graph functionality implementation method based on access control provided in this application configures Traverse permissions for users, including implicit and explicit permissions. When a user is assigned implicit permissions, the query content is not exposed to the user during the query process. When a user is assigned explicit permissions, all information except attributes of the specified points and / or edges is read for the user when performing path queries. Thus, Traverse permissions correspond to the ability to access the graph structure, rather than the ability to access graph attributes. Therefore, when implementing graph functionality, it avoids affecting graph features such as in-degree and out-degree, while preserving the connectivity of the original graph and the correctness of the GraphView information.

[0024] Furthermore, this application embodiment also calculates the data of the entire graph offline in batches, constructs a Referral Edge every target hop count, and performs path queries based on the Referral Edge when the user is assigned implicit permissions. When the query results are returned, the Referral Edge is decoded into the corresponding points and / or edges, thereby reducing the number of iterations in the graph depth query process. As a result, the amount of data to be read decreases exponentially, significantly reducing the memory usage in this process and speeding up the query speed of depth queries. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 This is a schematic diagram of the application environment for the graph function implementation method based on access control according to an embodiment of this application;

[0027] Figure 2 This is a flowchart of a graph function implementation method based on access control according to the first embodiment of this application;

[0028] Figure 3 This is a schematic diagram illustrating the use of Referral Edge to accelerate queries according to the second embodiment of this application;

[0029] Figure 4 This is a flowchart of a graph function implementation method based on access control according to the second embodiment of this application;

[0030] Figure 5 This is a flowchart illustrating the graph dataset based on the third embodiment of this application;

[0031] Figure 6This is a flowchart illustrating the graph dataset after introducing Traverse permissions according to the third embodiment of this application;

[0032] Figure 7 This is a schematic diagram of the internal structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application. Furthermore, it is understood that although the efforts made in such a development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, modifications to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0034] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0035] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application means two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The terms “first,” “second,” “third,” etc., used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0036] The access control-based graph functionality implementation method provided in this application can be applied to, for example... Figure 1 In the application environment shown, Figure 1 This is a schematic diagram of the application environment for the graph function implementation method based on access control according to an embodiment of this application, such as... Figure 1 As shown, terminal 102 and server 104 communicate via a network. Server 104 pre-configures Traverse permissions for users, including implicit and explicit permissions. After receiving a query request from terminal 102, the server performs a path query. When the user is granted implicit permissions, server 104 does not expose the query content to the user during the query process; when the user is granted explicit permissions, server 104 reads all information for the specified point and / or edge, excluding attributes, when performing a path query. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0037] Mainstream graph databases primarily divide permissions into read and write permissions, which are further subdivided, for example: Readspace: read the graph space; Read schema: read the graph space schema, such as tag, edge type, attribute name, etc.; Read data: read attributes on vertices or edges; Write space: create or delete graph space; Write schema: create, modify, or delete schema; Write data: add, modify, or delete attribute data on vertices or edges. Roles combine these read and write permissions and assign them to different accounts for use by business personnel. This satisfies business needs while ensuring data security. Permission implementation is generally achieved through a dedicated authentication module that records the corresponding relationships. This can be either self-developed or rely on external services; no specific limitation is made here.

[0038] This embodiment provides a method for implementing graph functionality based on access control. Before the method is executed, two types of Traverse permissions need to be added, and Traverse permissions need to be pre-configured for users, including implicit permissions and explicit permissions. Implicit permissions are internal Traverse permissions that are not perceived by users, while explicit permissions are Traverse permissions that are available to users. Figure 2 This is a flowchart of a graph function implementation method based on access control according to the first embodiment of this application, as follows: Figure 2 As shown, the process includes the following steps:

[0039] Step S201: When a user is assigned implicit permissions, the query content is not exposed to the user during the query process; that is, implicit permissions are only used internally and are not exposed to the user.

[0040] In step S202, when a user is granted explicit permissions, all information except attributes of a specified point and / or edge is read for the user during path query. That is, the explicit Traverse permission allows the authorized role to read information of the specified point and edge except attributes (specifically, the point's ID and Tag, and the edge's Edge type and Rank). In particular, if more granular GraphView control is required, other permissions that can be granted to the user can be added to control whether attributes can be viewed, or even whether specific query statements can be used.

[0041] Through the aforementioned steps S201 to S202, compared to the problem in related technologies where graph data queries can affect graph features and even severely damage the connectivity of the original graph, leading to information errors, the graph function implementation method based on permission control provided in this application embodiment can be implemented based on an existing permission implementation framework, making development simple. This method configures Traverse permissions for users, including implicit and explicit permissions. When a user is assigned implicit permissions, only the actual vertex and edge content in the graph database is displayed when querying a path, without displaying the index content, thereby improving query speed without exposing the internal index to the user. When a user is assigned explicit permissions, when executing a path query, all information except attributes of the specified vertex and / or edge is read for the user. Thus, the Traverse permission corresponds to the access capability of the graph structure, rather than the access capability of graph attributes (this is the Read Data, Write Data permission), thereby avoiding the impact on graph features such as in-degree and out-degree when implementing graph functions, while preserving the connectivity of the original graph and the correctness of the GraphView information. Furthermore, when querying the GraphView, only the data with permissions is displayed, improving security.

[0042] It's worth noting that the implementation of Traverse permissions can reuse the authentication module functionality of the existing graph database system, simply adding a new permission type. For example, if the original graph database system uses a table to record the permission relationships between roles, Traverse permissions would simply add two records to the original system table, corresponding to implicit and explicit permissions respectively, making development relatively simple. Furthermore, in some systems' permission designs, in addition to the usual grant and revoke operations, there is also a deny operation. Traverse permissions can also be designed and implemented accordingly, without further limitation here.

[0043] In some embodiments, implicit permissions also include allowing the system to use Referral Edges to accelerate depth queries when performing path lookups. Therefore, before executing the graph functionality implementation method based on permission control, it is necessary to pre-calculate the entire graph data offline in batches, constructing a Referral Edge every target hop count for use in path lookups. Regarding the implementation and updating of Referral Edges, when depth queries are known, the mainstream method is to perform a bidirectional breadth-first traversal (BFS) from the start and end points, and a depth-first traversal (DFS) when memory is limited. To accelerate this process, the constructed Referral Edges can be stored on disk, trading disk space for memory space and time. This is a very suitable solution given the current availability of cheap disk space. The initialization steps include: offline batch calculation of the entire graph data using graph computation methods, constructing a Referral Edge every 2 or 3 hops (i.e., calculating which two points are exactly 2 or 3 hops apart), and then storing all Referral Edges and their corresponding point-edge mappings on disk. The specific calculation method can use the Label Propagation Algorithm (LPA), which is not limited here. The 2-hop and 3-hop values ​​here are examples; larger values ​​are also possible. Using these Referral Edges can speed up the query process, and the Referral Edges are then decoded into the corresponding point edges when the results are returned.

[0044] For example, Figure 3 This is a schematic diagram illustrating the use of Referral Edge to accelerate queries according to the second embodiment of this application, as shown below. Figure 3 As shown, the original BFS scheme, when querying the path from A to F, requires simultaneous queries from both A and F: (A->B, G, F<-E), (B->C, G->H, E<-D), (C->D, H->I, D<-C), requiring 3 iterations to obtain the resulting path. Using Referral Edge: (A->B, G, D, I, F<-E), (B->C, E, G->H, D->E, D<-E), only 2 iterations are needed to obtain the resulting path. Because in graph depth-first search, reducing one iteration exponentially decreases the amount of data to be read, significantly reducing memory usage (compared to the N+1 hops of the original graph, Referral Edge requires far less data) and improving query speed.

[0045] In some of these embodiments, Figure 4 This is a flowchart of a graph function implementation method based on access control according to the second embodiment of this application, as follows: Figure 4 As shown, when a user is assigned implicit permissions, the process includes the following steps:

[0046] Step S401: Perform a path query based on the Referral Edge to accelerate the depth query. When returning the query result, decode the Referral Edge into the corresponding point and / or edge.

[0047] Through the above step S401, this embodiment of the application calculates the data of the entire graph offline in batches, constructs a Referral Edge every target hop count, and performs path query based on the Referral Edge when the user is assigned implicit permissions. When the query result is returned, the Referral Edge is decoded into the corresponding point and / or edge, thereby reducing the number of iterations in the graph depth query process. As a result, the amount of data to be read decreases exponentially, significantly reducing the memory usage in this process and speeding up the query speed of depth query.

[0048] Considering the need for real-time CRUD operations in database systems, this application also provides an online update method for ReferralEdge. In some embodiments, if a new point or edge is written, or a point or edge is modified, only the Referral Edge within a 3-hop range of the point or edge needs to be updated. Taking a 3-hop Referral Edge as an example: if a new point is added, no update is needed for the Referral Edge. If an edge is added (including adding a point and an edge): obtain the start and end points corresponding to the edge, and obtain all points within their respective 3-hop ranges. Treat these points and their adjacent edges as a subgraph, and perform the same calculations as the initialization steps. Since this subgraph is usually much smaller than the full graph, the calculation process is usually faster. Add the calculated Referral Edge to the original graph. The principle for deleting points and edges is similar. In addition, a common engineering optimization method is to first log a batch of updates and mark the involved point set as "dirty," and then periodically perform a calculation on this batch of updates.

[0049] In some embodiments, the storage format of the Referral Edge is as follows:

[0050]

[0051] The first field, Type, represents the type. In the graph structure, edge Type is 1. For ReferralEdge, Type is 2 (implicit Traverse permission) and 3 (explicit Traverse permission). All ReferralEdge records are restricted to requiring the corresponding Traverse permission for access. A list of permissions can be obtained from the permission system.

[0052]

[0053] Since `Type` is the first field, and all records are ordered on disk, scanning can be conveniently performed based on permissions: During normal queries, the records on disk are traversed, and the first field determines whether to continue traversing. For example, when querying outgoing edges of a point in a graph, because they are stored sequentially, scanning continues when `Type` is 1, and stops when `Type` is 2. This has a negligible impact on the performance of normal queries. During depth queries, `ReferralEdge` queries are allowed. When `Type` is 2, scanning can continue until all outgoing edges are scanned, and then `ReferralEdge` is decoded when the result is returned. Finally, it should be added that for distributed systems, since an edge may exist on two servers, the sign of `Type` can be used to indicate whether the starting point points to the ending point or vice versa.

[0054] In some embodiments, explicit traverse permissions can control the vertex and edge information that a user can read. This does not involve any attribute information (attribute permissions are controlled by Read data / Write data). For example, if user A is only granted traverse permissions for vertices with the tag "tag1", then user A can read vertices with tag1 but cannot read vertices with other tags. Similarly, which types of edges user A can read (and whether they exist) is determined by the edge traverse permissions. If user B is only granted traverse permissions for edges of a specific edge type E, then user B can read all edges of type E but cannot read edges of other types; and which vertices user B can read is determined by the vertex traverse permissions.

[0055] For example, Figure 5 This is a flowchart illustrating the graph dataset based on the third embodiment of this application. Figure 6 This is a flowchart illustrating the graph dataset after introducing Traverse permissions according to the third embodiment of this application, as shown below. Figure 5 As shown, the letter on a point is its ID, while tag1 and tag2 next to the point are its tags. By creating a GraphView (the specific operation statements are determined by the corresponding graph database and are not limited here), user A can only access a portion of the data:

[0056] 1. Deny all permissions for edge_type2;

[0057] 2. Grant all permissions to edge_type1 (including READ, Write Data, Traverse);

[0058] 3. Grant (Grant)edge_type3 the traverse permission;

[0059] 4. Grant all permissions (including READ, Write Data, and Traverse) to point ABCF;

[0060] 5. Grant traverse permission to point DE;

[0061] like Figure 6 As shown, by introducing the Traverse permission, GraphView does not destroy the connectivity of the graph (it only knows that there is a path, but user A cannot know the specific content of DE, thus protecting the privacy of DE).

[0062] In conjunction with the permission-controlled graph functionality implementation methods in the above embodiments, this application embodiment can provide a storage medium for implementation. The storage medium stores a computer program; when executed by a processor, the computer program implements any of the permission-controlled graph functionality implementation methods in the above embodiments.

[0063] In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, memory, a network interface, a display screen, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a permission-based graph function implementation method. The display screen may be a liquid crystal display (LCD) or an e-ink display. The input device may be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0064] In one embodiment, Figure 7 This is a schematic diagram of the internal structure of an electronic device according to an embodiment of this application, such as... Figure 7 As shown, an electronic device is provided, which can be a server, and its internal structure diagram can be as follows. Figure 7As shown, the electronic device includes a processor, a network interface, internal memory, and non-volatile memory connected via an internal bus. The non-volatile memory stores the operating system, computer programs, and a database. The processor provides computing and control capabilities, the network interface communicates with external terminals via a network connection, the internal memory provides an environment for the operation of the operating system and computer programs, the computer programs are executed by the processor to implement a permission-based graph function implementation method, and the database stores data.

[0065] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0066] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0067] Those skilled in the art should understand that, for the sake of brevity, not all possible combinations of the various technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should all be considered to be within the scope of this specification.

[0068] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for implementing graph functionality based on access control, characterized in that, Pre-configure Traverse permissions for users, including implicit and explicit permissions; the method includes: When a user is assigned implicit permissions, the query content is not exposed to the user during the query process. When querying the path, only the actual vertex and edge content in the graph database is displayed, and the index content is not displayed. When a user is assigned explicit permissions, when performing a path query, all information except attributes for the specified point and / or edge is read for the user. Through the implicit permissions and the explicit permissions, Traverse permissions correspond to the ability to access graph structures, rather than the ability to access graph attributes, so as not to destroy the connectivity of the original graph or change the in-degree and out-degree of the points when implementing graph functions. When performing a path query, the system reads all information for the specified point and / or edge except for attributes. The process includes: when performing a path query, the system reads the ID and Tag of the point that meets the permission conditions, and the Edge type and Rank of the edge for the user. The method employs a label propagation algorithm to pre-calculate the entire graph data offline in batches, determining which two points have a distance equal to the target hop count. A Referral Edge is constructed every target hop count for use in querying paths. When the user is assigned implicit permissions, the method further includes: performing path queries based on the Referral Edge to accelerate depth queries, and decoding the Referral Edge into the corresponding points and / or edges when returning query results.

2. The method according to claim 1, characterized in that, Once the Referral Edge is constructed, all Referral Edges and their corresponding point-edge mappings are stored on the hard disk. All Referral Edge records are sorted in order on the hard disk. The first field of the Referral Edge storage format records the user's Traverse permissions for the Referral Edge.

3. The method according to claim 2, characterized in that, Applied to Graph View; Pre-grant or deny user attribute permissions and Traverse permissions for points that meet specified characteristics. When implementing Graph View, for all Referral Edge records, restrict access to users only if they have the corresponding Traverse permission.

4. The method according to claim 1, characterized in that, If a new point and / or edge is written to the database system, or if a point and / or edge is modified, the Referral Edge within the target jump distance range is updated based on the new point and / or edge or the modified point and / or edge.

5. A graph functionality implementation system based on access control, characterized in that, The system includes: The first preset module is used to configure Traverse permissions for users, including implicit permissions and explicit permissions; The execution module is used to prevent the user from exposing the query content during the query process when the user has been granted implicit permissions. When querying the path, only the actual vertex and edge content in the graph database is displayed, and the index content is not displayed. When the user has been granted explicit permissions, when executing the path query, all information except attributes of the specified vertex and / or edge is read for the user. Through the implicit permissions and the explicit permissions, Traverse permissions correspond to the ability to access graph structures, rather than the ability to access graph attributes, so as not to destroy the connectivity of the original graph or change the in-degree and out-degree of the points when implementing graph functions. When performing a path query, the system reads all information for the specified point and / or edge except for attributes. The process includes: when performing a path query, the system reads the ID and Tag of the point that meets the permission conditions, and the Edge type and Rank of the edge for the user. The second preset module is used to use the label propagation algorithm to calculate the data of the entire graph offline in batches, calculate which two points have a distance of exactly the target hop count, and build a Referral Edge every target hop count for use in querying paths; The execution module is also used to perform path queries based on the Referral Edge when the user has been assigned implicit permissions, in order to accelerate deep queries, and decode the Referral Edge into the corresponding point and / or edge when returning the query results.

6. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the permission-based graph function implementation method according to any one of claims 1 to 4.

7. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the graph function implementation method based on access control as described in any one of claims 1 to 4 when it runs.

Images