Method and apparatus for data access control

Abstract

A method, device, equipment and storage medium for data access control are provided. The method described herein comprises: receiving a data query request for characterizing a first user's request for target data; obtaining a business data access capability attribute corresponding to the first user and obtaining a business security attribute corresponding to the target data; calling a data access security model to determine a data query processing strategy corresponding to the data query request according to the business data access capability attribute of the first user and the business security attribute of the target data; and calling the data query processing strategy to process the target data and generating a response message for feedback. According to the fact of the present disclosure, by providing a response to the request based on the business data access capability attribute of the user and the business security attribute of the target data, the access of the user to the data can be effectively controlled.

Description

Technical Field

[0001] The various implementations of this disclosure relate to the field of computers, and more specifically, to methods, apparatus, devices, and computer storage media for data access control. Background Technology

[0002] For enterprises, the business data they need to maintain is extremely complex. Due to the complexity of internal workflows, the business data that different business owners need to handle may be the same or different. Even the data that a business owner needs to handle may differ at different times. Currently, access to data by business owners is mostly handled using a static, one-size-fits-all approach, which cannot adapt to actual business needs. Therefore, more flexible, secure, and controllable data access controls are needed. Summary of the Invention

[0003] In a first aspect of this disclosure, a method for data access control is provided. The method includes: receiving a data query request, the data query request representing a first user requesting target data; obtaining a business data access capability attribute corresponding to the first user and a business security attribute corresponding to the target data; wherein the business data access capability attribute represents the user's ability to access data within the business environment they are responsible for based on their business attributes; the business security attribute represents an identification attribute used to classify data based on business security requirements; determining a data query processing strategy corresponding to the data query request by invoking a data access security model based on the first user's business data access capability attribute and the target data's business security attribute; and processing the target data by invoking the data query processing strategy and generating a response message for feedback.

[0004] In a second aspect of this disclosure, an apparatus for data access control is provided. The apparatus includes: a receiving unit configured to receive a data query request, the data query request representing a first user requesting target data; an acquiring unit configured to acquire a business data access capability attribute corresponding to the first user and a business security attribute corresponding to the target data; wherein the business data access capability attribute represents the user's ability to access data within the business environment they are responsible for based on their business attributes; and the business security attribute represents an identification attribute used to classify data based on business security requirements; a determining unit configured to, based on the first user's business data access capability attribute and the target data's business security attribute, invoke a data access security model to determine a data query processing strategy corresponding to the data query request; and a responding unit configured to, invoke the data query processing strategy to process the target data and generate a response message for feedback.

[0005] In a third aspect of this disclosure, an electronic device is provided, comprising: a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to a first aspect of this disclosure.

[0006] In a fourth aspect of this disclosure, a computer-readable storage medium is provided having one or more computer instructions stored thereon, wherein the one or more computer instructions are executed by a processor to implement the method according to a first aspect of this disclosure.

[0007] In a fifth aspect of this disclosure, a computer program product is provided, comprising one or more computer instructions, wherein the one or more computer instructions are executed by a processor to implement the method according to a first aspect of this disclosure. Attached Figure Description

[0008] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram of an example environment for implementing some embodiments of the present disclosure is shown;

[0010] Figure 2 A flowchart of a method for data access control according to some embodiments of the present disclosure is shown;

[0011] Figure 3 Example block diagrams of an apparatus for data access control according to some embodiments of the present disclosure are shown; and

[0012] Figure 4 A block diagram of an example device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0013] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0014] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0015] As mentioned above, business owners need to access business data based on business needs. For example, operations or development personnel can access business data to develop and maintain applications. Customer service personnel can access business data to resolve user issues. However, depending on the specific business, the business owner's access to business data needs to be controlled more flexibly and securely. For example, it is necessary to prevent business owners from accessing user data unrelated to their business, thereby better protecting user data.

[0016] This disclosure provides an example embodiment of a method for data access control. The method includes: receiving a data query request characterizing a first user requesting target data; obtaining a business data access capability attribute corresponding to the first user and a business security attribute corresponding to the target data; determining a data query processing strategy corresponding to the data query request by invoking a data access security model based on the first user's business data access capability attribute and the target data's business security attribute; and processing the target data using the data query processing strategy and generating a response message for feedback.

[0017] In this way, by providing responses to requests based on the user's business data access capabilities and the target data's business security attributes, user access to data can be effectively controlled. For example, access to business data by the person in charge of the business can be effectively controlled.

[0018] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0019] Figure 1 A schematic diagram of an example environment 100 implementing some embodiments of the present disclosure is shown. For example... Figure 1 As shown, in environment 100, the request initiator 110 (hereinafter referred to as the initiator) can send a request to gateway 120 to query business data from data center 130. The request initiator 110 can be an internal employee of the enterprise, such as a business manager. Depending on the specific business, the request initiator 110 can be an operations staff member, such as a customer service representative. The request initiator 110 can also be a product development or operations staff member, such as a software developer.

[0020] Data center 130 is used to store business data. Business data may include user data of the enterprise's products. User data may include data of natural person users. User data may also include user data of entities other than natural persons. For example, user data may include enterprise user data, institutional user data, etc. Alternatively or additionally, business data may also include other data related to the business, such as the source code of software products.

[0021] Data center 130 may be geographically located in the same country as the requesting party 110. Data center 130 may also be geographically located in a different country from the requesting party 110. For example, the requesting party 110 may be operations personnel at the headquarters of a multinational corporation. Data center 130 may be a data center of a subsidiary of a multinational corporation located in another country, and this data center stores user data from that country.

[0022] Communication between the request initiator 110 and the data center 130 can be achieved via gateway 120. Gateway 120 can receive requests from initiator 110 and forward them to data center 130. Gateway 120 can also receive query results returned from data center 130 and forward them to request initiator 110 as a response to the request.

[0023] Gateway 120 can also process received requests and query results. For example, gateway 120 can verify the security credentials of the request initiator 110 and obtain some information about the initiator 110, such as the office location of an employee. Gateway 120 can also identify the request initiator 110 based on the received request. Gateway 120 can also determine whether to forward the request to data center 130 based on the identification of the request initiator 110. Gateway 120 can also modify the query results received from data center 130 and provide the modified query results to the request initiator 110.

[0024] It should be understood that gateway 120 is merely illustrative. For example, some embodiments of this disclosure can be implemented in scenarios involving direct database queries. In such scenarios, some functions of gateway 120 can be implemented by the management or control module of data center 130.

[0025] The following will refer to Figures 2 to 4 This section will describe in detail the principles and aspects of data access control.

[0026] Figure 2 A flowchart of an example method 200 for data access control according to some embodiments of the present disclosure is shown. Method 200 can, for example, be implemented in... Figure 1 The gateway is implemented at 120 locations.

[0027] In box 202, a data query request is received, which represents a first user requesting target data. The first user can be a business manager, such as an operations and maintenance personnel or customer service personnel. In the following text, the terms "first user" and "request initiator 110" can be used interchangeably. The target data can be business-related data, such as business-related user data.

[0028] From the perspective of business data security level, business data can be classified into public data, non-public data, identifiable data, non-identifiable data, temporary data, permanent data, etc.

[0029] Public data generally refers to data that is permitted to be publicly disclosed according to business requirements, or data that users specify as permitted to be publicly disclosed. For example, in typical social media applications, user usernames, nicknames, and personal signatures are usually set to be publicly available data. Alternatively or additionally, public data may include data that can be obtained from sources outside of Data Center 130. Anyone can access this public data without requesting it from Data Center 130.

[0030] Conversely, non-public data generally refers to data that is not permitted to be disclosed by business operations or by users. For example, for e-commerce platforms, user address information is generally not disclosed by users. This type of data is only used to meet business needs such as order placement, and can generally be defined as non-public data.

[0031] For business purposes, data center 130 can store non-public data. Data center 130 can provide non-public data to employees to enable product functionality. For example, data center 130 can store users' real names and phone numbers for authentication purposes when users log in.

[0032] Identifiable data refers to data that can identify or locate a natural person, entity, or account. Identifiable data can include personally identifiable information (PII). Examples of identifiable data include an individual's name or username, user identifier, company name, stock code, etc. Identifiable data can also include data that effectively narrows down the identification scope, such as a birthdate. Although a birthdate cannot uniquely identify a natural person, it can significantly narrow down the identification scope.

[0033] Identifiable data can include identifiers. Identifiers can uniquely identify a natural person, entity, or account. Identifiers can be a combination of letters, numbers, and symbols. Examples of identifiers can include user identifiers (uid) and personal identification numbers. In internet products, user data can be uniquely associated with a uid.

[0034] Unidentifiable data refers to data that cannot be identified or located to a natural person, entity, or account. Examples include the number of views, likes, and comments on a user's videos.

[0035] Temporary data refers to data that is valid only for a limited time period or under specific conditions. Examples include temporary links and login passwords. Temporary data can include user data whose association with a user expires outside a threshold time period, such as temporary user IDs. In some implementations, temporary UIDs can be assigned to users for operations staff to use to query user data. This way, operations staff can only query that user's data within a predetermined time period. Once the temporary UID expires, operations staff will no longer be able to query that user's data.

[0036] Conversely, permanent data can refer to data that remains valid beyond a predetermined period. Permanent data can include user data whose association with a user does not expire beyond a threshold time period. Examples of permanent data can include a user's permanent UID. For instance, all user data since account creation can be uniquely associated with a UID, and that UID remains valid until the account is deactivated.

[0037] It should be understood that the classification and definition of business data can vary depending on the specific application. For example, in some implementations, a user's UID can be displayed as public data on their personal page along with their username. In other implementations, the user's UID is stored as non-public data in data center 130 and cannot be publicly accessed.

[0038] In box 204, obtain the business data access capability attribute corresponding to the first user and the business security attribute corresponding to the target data. The business data access capability attribute is used to characterize the user's access capability to data within the business environment they are responsible for, based on the user's business attributes. The business data access capability attribute can indicate whether the initiator 110's access to the data is restricted or indicate the level of restriction.

[0039] The relevant information in the request can be used to determine the corresponding business data access capability attributes of the request initiator 110. If the request initiator 110 is determined to be an employee with restricted access to data center 130, gateway 120 may analyze the request first instead of directly forwarding it to data center 130.

[0040] The determination of the business data access capability attribute of the request initiator 110 depends on the specific business scenario. In some implementations, gateway 120 can determine the business data access capability attribute of the request initiator 110 based on the business type. For example, since customer service requires direct communication with users, gateway 120 can identify customer service personnel who directly interact with customers as initiators 110 with unrestricted access. As another example, since product developers do not need to know real user information, gateway 120 can identify product developers as initiators 110 with restricted access.

[0041] Alternatively or additionally, gateway 120 can determine the business data access capability attributes of the requesting party 110 based on geographical factors. For example, gateway 120 can determine whether the requesting party 110's access to data center 130 is restricted based on the nationality, geographical location, and geographical location of data center 130. For example, due to data sovereignty protection requirements, gateway 120 can identify employees geographically located in a different country than data center 130 as restricted requesting parties 110.

[0042] Alternatively or additionally, gateway 120 may determine the business data access capability attributes of the requesting party 110 based on the management of data center 130. For example, gateway 120 may identify an employee who is not from the same country as the management of data center 130 as a restricted access requesting party 110. The management of data center 130 may determine this in accordance with the data security and privacy compliance requirements of the country or region where data center 130 is located.

[0043] Business security attributes are used to characterize the identifying attributes of data based on business security requirements. Business security attributes may include or indicate one or more of the following: public level, identifiable level, and time level. In some implementations, if the requesting party 110 is identified as an employee with restricted access to data center 130, gateway 120 may determine the business security attributes of the requested target data.

[0044] In some implementations, gateway 120 can determine the business security attributes of the target data based on its public access level. As mentioned above, the public access level can indicate how easily the target data can be obtained from channels outside the data center 130. For example, the public access level of public data can be higher than that of non-public data.

[0045] Alternatively or additionally, gateway 120 may determine the business security attributes of the target data based on its identifiability level. The identifiability level indicates whether the target data can identify a user, natural person, or entity. For example, the identifiability level of identifiable data can be higher than that of non-identifiable data.

[0046] Alternatively or additionally, gateway 120 can determine the business security attributes of the target data based on the time level of the target data. The time level can indicate whether the association between user data and user will become invalid within a threshold time period. For example, the time level of permanent data can be higher than that of temporary data.

[0047] In some implementations, target data can be categorized based on public access level, identifiability level, and time level. The business security attributes of the target data can be determined based on this categorization. These business security attributes can include the results of the categorization. For example, target data whose public access level and identifiability level both exceed a threshold can be determined to be both public and identifiable. Similarly, target data whose public access level exceeds a threshold and whose identifiability level is below a threshold can be determined to be both public and unidentifiable.

[0048] The business security attributes of target data whose public level is below a threshold and whose identifiability level exceeds a threshold can be determined as non-public and identifiable. The business security attributes of target data whose public level is below a threshold and whose identifiability level is below a threshold can be determined as non-public and non-identifiable. Furthermore, the business security attributes of target data whose public level, identifiability level, and time level all exceed a threshold can be determined as public, identifiable, and permanent.

[0049] In box 206, based on the first user's business data access capability attributes and the target data's business security attributes, the data access security model is invoked to determine the data query processing strategy corresponding to the data query request. Gateway 120 can utilize the data access security model to determine different data query processing strategies.

[0050] In some implementations, the data query request includes the user identifier of the first user and keywords (hereinafter referred to as query keywords) used to query the target data. The data access security model can determine the corresponding data query processing strategy based on the first user's business data access capability attributes and the business security attributes of the target data. Data query processing strategies can include anonymization strategies, data pass-through strategies, and data isolation strategies. Anonymization strategies are used to anonymize part or all of the target data. Data pass-through strategies are used for the direct exchange of target data. Data isolation strategies are used to isolate the target data, that is, to prohibit access to the target data.

[0051] In some implementations, when the first user's business data access capability attribute identifies the first user as having restricted data access rights, and the query keyword is the authorized public information of the second user (hereinafter also referred to as the target user), and the target data's business security attribute identifies the target data as non-public, the data access security model can determine the data query processing strategy as a data isolation strategy, that is, prohibiting the first user from querying the target data. For example, it can prevent the initiator 110 from using the target user's username to query the target user's non-public browsing history. This can better protect user data.

[0052] In some implementations, data access security models can determine data query processing strategies based on query rules between query keywords and target data. Query rules can specify the target data that can be queried for specific types or specific query keywords. Query rules can be set according to business requirements.

[0053] In some implementations, query keywords and target data can be associated with the same user. In other words, initiator 110 uses user A's first user data as the query keyword to query user A's second user data. For example, initiator 110 uses user A's username to query user A's browsing history.

[0054] In this implementation, the data access security model can determine the data query processing strategy based on the business security attributes of the query keywords and the target data. For example, when both the business security attributes of the query keywords and the target data are public, the data query processing strategy can be determined as a data pass-through strategy. In this way, mutual querying between public data can be achieved.

[0055] In box 208, the data query processing strategy is invoked to process the target data and generate a response message for feedback. The details of data access control for different strategies will be described in detail below.

[0056] In some implementations, a data query strategy can be invoked to process the target data and generate a response message. Furthermore, a validity period can be configured for specific data within the target data contained in the response message, and this validity period is used to indicate the effective usage period of the specified data in the business logic. For example, a validity period can be configured for a retrieved password. This way, the initiator (110) can only use the retrieved password within the validity period, thus protecting the target data.

[0057] In some implementations, the response to the data query processing strategy is a data pass-through strategy, which can generate and send a response message containing the target data based on the target data. For example, gateway 120 can forward a request to data center 130; receive the queried target data from data center 130; and send a response containing the target data to initiator 110.

[0058] In some implementations, when the business security attribute of the target data is public and the business security attribute of the query keyword used to query the target data in the request is public, the data access security model can determine that the data query processing strategy is a data pass-through strategy. In this case, gateway 120 can send a response including the target data to initiator 110.

[0059] Alternatively or additionally, when the business security attributes of the target data are non-public and temporary, and the business security attributes of the query keywords are non-public and unidentifiable, the data access security model can determine the data query processing strategy as a data pass-through strategy. In this case, gateway 120 can send a response including the target data to initiator 110. For example, initiator 110 can use the user's search history as the query keyword to query the data center 130 for the user's temporary UID. In this way, initiator 110 can quickly locate the user uniquely associated with the temporary UID to resolve issues related to that user. Simultaneously, because a temporary UID is used instead of a permanent UID, initiator 110 will not be able to locate any user using the temporary UID after a threshold period. In this way, user data can be protected while allowing internal staff to quickly handle issues.

[0060] Alternatively or additionally, if the business security attributes of the target data are non-public and temporary, and the business security attributes of the query keyword are also non-public and temporary, the data access security model can determine that the data query processing strategy is a data pass-through strategy. In this case, gateway 120 can send a response including the target data to initiator 110. For example, initiator 110 can use the first temporary UID as the query keyword to query data center 130 for the user's second temporary UID.

[0061] The first and second temporary UIDs can be temporary identifiers assigned to users based on different business needs. The first temporary UID can be a unique identifier associated with operational business, while the second temporary UID can be a unique identifier associated with product development and maintenance business. There is a corresponding mapping relationship between the first and second temporary UIDs and the permanent UID. For example, when customer service personnel report a user-related issue to the engineering team, the engineering team receives the first temporary UID, not the user's permanent UID. The engineering team can use the first temporary UID to query the data center (130) for the second temporary UID associated with product development and maintenance business. The engineering team can then use the second temporary UID to locate the user-related issue and resolve it.

[0062] Alternatively or additionally, if the business security attributes of the query keyword are non-public and temporary, and the business security attributes of the target data are non-public and unidentifiable, the data access security model can determine that the data query processing strategy is a data pass-through strategy. In this case, gateway 120 can send a response including the target data to initiator 110. For example, initiator 110 can use the aforementioned first temporary UID as the query keyword to query data center 130 for non-public and unidentifiable user data related to the user's problem, such as the user's recharge records.

[0063] This method, by having customer service and product development / maintenance personnel use temporary UIDs to handle corresponding business, prevents internal employees from misattributing user issues to actual users or individuals. Furthermore, customer service and product development / maintenance personnel cannot use temporary UIDs to track user behavior data, thus better protecting user data.

[0064] In some implementations, in response to an anonymization strategy in the data query processing, the data to be protected within the target data can be anonymized, and a response message can be generated based on the anonymized target data. The data to be protected within the target data can be a part or all of the target data.

[0065] For example, gateway 120 can forward a request to data center 130; receive the queried target data from data center 130; anonymize the target data to generate anonymous data, the anonymous data having a lower identifiability level than the target data; and send a response including the anonymous data to initiator 110.

[0066] Anonymizing target data can be done using any suitable method. For example, statistical techniques, cryptographic techniques, suppression techniques, pseudonymization techniques, generalization techniques, permutation techniques, and randomization techniques can be used to generate anonymized data. It should be understood that, depending on the specific definition, anonymization can also be called de-identification, pseudonymization, etc. Anonymous data can be deconstructed. Alternatively, anonymized data may not be deconstructable.

[0067] When the business security attributes of the target data are non-public and identifiable, gateway 120 can anonymize the target data to reduce its identifiability. In this way, the initiator 110 cannot obtain the non-public identifiable data, thereby protecting the target data.

[0068] For example, when the initiator 110 uses non-public and unidentifiable data, such as search history, to query the corresponding user's real name, the gateway 120 can anonymize the real name. Otherwise, the initiator 110 can associate the user's behavior with the corresponding natural person.

[0069] Alternatively or additionally, when the business security attribute of the target data is non-public while the business security attribute of the query keyword is public, gateway 120 can anonymize the target data to reduce its identifiability level. In this way, the restricted initiator 110 cannot use public data as a query keyword to obtain non-public data, thereby achieving access control over the target data.

[0070] For example, when the initiator 110 uses publicly available data, such as a username, to query the corresponding user's real name, the gateway 120 can anonymize the user's real name. Otherwise, the initiator 110 can associate the user with a natural person.

[0071] Alternatively or additionally, when the business security attribute of the target data is public while the business security attribute of the query keyword is non-public and unidentifiable, gateway 120 may anonymize the target data to reduce its identifiability. This prevents the initiator 110 from tracking the account by associating user behavior data with the account.

[0072] For example, when initiator 110 uses non-public and unidentifiable data, such as search history, to query a corresponding username, gateway 120 can anonymize the username. Otherwise, initiator 110 can associate the user's behavior with the user.

[0073] Alternatively or additionally, when the business security attribute of the target data is public while the business security attribute of the query keyword is non-public, temporary, or identifiable, gateway 120 may anonymize the target data to reduce its identifiability level. This prevents the initiator 110 from combining temporarily identifiable data with public data to locate users, accounts, or entities.

[0074] For example, when initiator 110 uses a temporary UID to query the corresponding username, gateway 120 can anonymize the username. Otherwise, initiator 110 can associate the temporary UID with the user, thereby locating the user to the data associated with the temporary UID.

[0075] In some implementations, in response to a data query processing strategy that is a data isolation strategy, a response message can be generated and sent back to indicate that the data query request is not permitted. For example, gateway 120 can send a response to the request initiator 110 indicating that the request has not been approved.

[0076] In some implementations, since anonymous data may cause semantic ambiguity in the program, gateway 120 may send a response indicating that the request was not approved to the request initiator 110 instead of sending anonymous data to the initiator 110.

[0077] For example, when the business security attribute of the query keyword is public and identifiable, while the business security attribute of the target data is non-public, the gateway 120 can send a response indicating that the request has not been approved to the request initiator 110, instead of sending anonymous data to the initiator 110.

[0078] Alternatively or additionally, when the business security attribute of the query keyword is public and unidentifiable while the business security attribute of the target data is non-public and unidentifiable, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0079] Alternatively or additionally, when the business security attribute of the query keyword is public and unidentifiable while the business security attribute of the target data is non-public, temporary and identifiable, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0080] Alternatively or additionally, when the business security attribute of the query keyword is non-public and unidentifiable while the business security attribute of the target data is public and unidentifiable, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0081] Alternatively or additionally, when the business security attribute of the query keyword is non-public and unidentifiable, while the business security attribute of the target data is public and the target data is a permanent identifier, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0082] Alternatively or additionally, when the business security attribute of the query keyword is non-public and the query keyword is a temporary identifier, and the business security attribute of the target data is public and unidentifiable, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0083] Alternatively or additionally, when the business security attribute of the query keyword is non-public and the query keyword is a temporary identifier, and the business security attribute of the target data is public and the target data is a permanent identifier, the gateway 120 may send a response indicating that the request has not been approved to the requesting party 110, instead of sending anonymous data to the requesting party 110.

[0084] Additionally, when the business security attribute of the query keyword is non-public and identifiable, gateway 120 can directly send a response indicating that the request was not approved to the request initiator 110, without forwarding the request to data center 130. In this way, it can prevent the initiator 110 from using non-public and identifiable user data obtained from other channels for querying.

[0085] The above reference Figure 2 The principles and details of data access control are described in detail. It should be understood that the query rules between the query keywords and target data described above are merely exemplary, and the query rules can vary depending on specific business needs.

[0086] Embodiments of this disclosure also provide corresponding apparatus for implementing the above methods or processes. Figure 3 A schematic structural block diagram of a data access control apparatus 300 according to some embodiments of the present disclosure is shown.

[0087] like Figure 3As shown, the device 300 includes: a receiving unit 310 configured to receive a data query request, the data query request representing a first user requesting target data; an acquisition unit 320 configured to acquire the business data access capability attribute corresponding to the first user and the business security attribute corresponding to the target data; wherein, the business data access capability attribute represents the user's ability to access data in the business environment under their responsibility based on the user's business attributes; the business security attribute represents the identification attribute for classifying data based on business security requirements; a determining unit 330 configured to determine the data query processing strategy corresponding to the data query request by invoking a data access security model based on the first user's business data access capability attribute and the business security attribute of the target data; and a response unit 340 configured to process the target data by invoking the data query processing strategy and generate a response message for feedback.

[0088] In some implementations, the response unit 340 is configured to: when the data query processing strategy corresponding to the data query request is an anonymization strategy, anonymize the data to be protected in the target data, and generate a response message based on the anonymized target data for feedback.

[0089] In some implementations, the response unit 340 is configured to generate a response message based on the target data and provide feedback when the data query processing strategy corresponding to the data query request is a data pass-through strategy. The response message contains the target data.

[0090] In some implementations, the response unit 340 is configured to generate and provide feedback when the data query processing strategy corresponding to the data query request is a data isolation strategy. The response message is used to indicate that the data query request is not allowed.

[0091] In some implementations, the data query request includes the user identifier of the first user and the keyword used to query the target data, and the determining unit 330 is configured to: when the business data access capability attribute of the first user identifies the first user as having restricted data access rights, the keyword used to query the target data is the authorized public information of the second user, and the business security attribute of the target data identifies the target data as non-public, the data access security model is invoked to determine that the data query processing strategy corresponding to the data query request is a data isolation strategy, and the data isolation strategy is used to prohibit the first user from querying the target data.

[0092] In some implementations, the response unit 340 is configured to: invoke a data query strategy to process the target data and generate a response message, and configure a validity period for specified data in the target data contained in the response message and send back a response message, wherein the validity period is used to indicate the validity period of the specified data in the business.

[0093] Figure 4 A schematic block diagram of an example device 400 that can be used to implement embodiments of the present disclosure is shown. For example, a gateway 120 according to an embodiment of the present disclosure can be implemented by device 400. As shown, device 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 402 or loaded from storage unit 408 into random access memory (RAM) 403. Various programs and data required for the operation of device 400 may also be stored in RAM 403. CPU 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0094] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0095] The various processes and handling described above, such as method 200, can be executed by processing unit 401. For example, in some embodiments, method 200 can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by CPU 401, one or more actions of method 200 described above can be performed.

[0096] This disclosure can be a method, apparatus, system, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0097] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0098] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0099] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0100] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0101] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0102] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0104] Various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for data access control, characterized by, include: Receive a data query request, wherein the data query request is used to indicate that a first user requests target data using query keywords; The system obtains the business data access capability attribute corresponding to the first user, the first business security attribute corresponding to the target data, and the second business security attribute corresponding to the query keyword; wherein, the business data access capability attribute is used to characterize the user's ability to access data in the business environment under their responsibility based on the user's business attributes; each of the first and second business security attributes is used to characterize the identification attribute for classifying data based on business security requirements; Based on the first user's business data access capability attributes, the first business security attributes of the target data, and the second business security attributes of the query keywords, a data access security model is invoked to determine the data query processing strategy corresponding to the data query request from multiple data query processing strategies. These multiple data query processing strategies include at least one of the following: anonymization strategy, data pass-through strategy, and data isolation strategy, wherein: When the first business security attribute of the target data is non-public and temporary, and the business security attribute of the query keyword is non-public and unidentifiable, the data access security model is used to determine the data query processing strategy as the data pass-through strategy; and The data query processing strategy is invoked to process the target data and generate a response message for feedback.

2. The method according to claim 1, characterized in that, The step of invoking the data query processing strategy to process the target data and generate a response message for feedback includes: When the data query processing strategy corresponding to the data query request is the anonymization strategy, the data to be protected in the target data is anonymized, and a response message is generated based on the anonymized target data for feedback.

3. The method according to claim 1, characterized in that, The step of invoking the data query processing strategy to process the target data and generate a response message for feedback includes: When the data query processing strategy corresponding to the data query request is the data pass-through strategy, a response message is generated and fed back based on the target data, and the response message contains the target data.

4. The method according to claim 1, characterized in that, The step of invoking the data query processing strategy to process the target data and generate a response message for feedback includes: When the data query processing strategy corresponding to the data query request is the data isolation strategy, a response message is generated and fed back. The response message is used to indicate that the data query request is not allowed.

5. The method according to claim 1, characterized in that, The data query request includes the user identifier of the first user; Based on the first user's business data access capability attributes, the first business security attribute of the target data, and the second business security attribute of the query keyword, the data access security model is invoked to determine the data query processing strategy corresponding to the data query request, including: When the first user's business data access capability attribute identifies the first user as having restricted data access rights, and the keyword used to query the target data is the authorized public information of the second user, and one of the business security attributes of the first business security attribute of the target data and the second business security attribute of the query keyword identifies the target data as non-public, the data access security model is invoked to determine the data query processing strategy corresponding to the data query request as the data isolation strategy. The data isolation strategy is used to prohibit the first user from querying the target data.

6. The method according to claim 1, characterized in that, The step of invoking the data query processing strategy to process the target data and generate a response message for feedback includes: The data query strategy is invoked to process the target data and generate a response message. A validity period is configured for the specified data in the target data contained in the response message, and the response message is fed back. The validity period is used to indicate the validity period of the specified data in the business.

7. A device for data access control, characterized in that, include: The receiving unit is configured to receive a data query request, the data query request being used to represent a first user requesting target data using query keywords; The acquisition unit is configured to acquire the business data access capability attribute corresponding to the first user, the first business security attribute corresponding to the target data, and the second business security attribute corresponding to the query keyword; wherein, the business data access capability attribute is used to characterize the user's ability to access data in the business environment under their responsibility based on the user's business attributes; each of the first and second business security attributes is used to characterize the identification attribute for classifying data based on business security requirements; The determining unit is configured to, based on the first user's business data access capability attribute, the first business security attribute of the target data, and the second business security attribute of the query keyword, invoke a data access security model to determine the data query processing strategy corresponding to the data query request from multiple data query processing strategies. The multiple data query processing strategies include at least one of the following: anonymization strategy, data pass-through strategy, and data isolation strategy, wherein: When the first business security attribute of the target data is non-public and temporary, and the business security attribute of the query keyword is non-public and unidentifiable, the data access security model is used to determine the data query processing strategy as the data pass-through strategy; and The response unit is configured to invoke the data query processing strategy to process the target data and generate a response message for feedback.

8. The apparatus according to claim 7, characterized in that, The response unit is configured as follows: When the data query processing strategy corresponding to the data query request is the anonymization strategy, the data to be protected in the target data is anonymized, and a response message is generated based on the anonymized target data for feedback.

9. The apparatus according to claim 7, characterized in that, The response unit is configured as follows: When the data query processing strategy corresponding to the data query request is the data pass-through strategy, a response message is generated and fed back based on the target data, and the response message contains the target data.

10. The apparatus according to claim 7, characterized in that, The response unit is configured as follows: When the data query processing strategy corresponding to the data query request is the data isolation strategy, a response message is generated and fed back. The response message is used to indicate that the data query request is not allowed.

11. The apparatus according to claim 7, characterized in that, The data query request includes the user identifier of the first user, and the determining unit is configured to: When the first user's business data access capability attribute identifies the first user as having restricted data access rights, and the keyword used to query the target data is the authorized public information of the second user, and one of the business security attributes of the first business security attribute of the target data and the second business security attribute of the query keyword identifies the target data as non-public, the data access security model is invoked to determine the data query processing strategy corresponding to the data query request as the data isolation strategy. The data isolation strategy is used to prohibit the first user from querying the target data.

12. The apparatus according to claim 7, characterized in that, The response unit is configured as follows: The data query strategy is invoked to process the target data and generate a response message. A validity period is configured for the specified data in the target data contained in the response message, and the response message is fed back. The validity period is used to indicate the validity period of the specified data in the business.

13. An electronic device, comprising: Memory and processor; The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 6.

14. A computer-readable storage medium having stored thereon one or more computer instructions, wherein the one or more computer instructions are executed by a processor to implement the method according to any one of claims 1 to 6.

Images