A Hive permission control method, device, equipment and readable storage medium

Abstract

The present application discloses a method, apparatus, device, and readable storage medium for controlling Hive permissions. The method includes: constructing a server for executing Hive permission control; after the server receives an operation request for a Hive table initiated by a user on a client, calling a corresponding parsing terminal to parse the operation type of the operation request based on the type of the client; if the operation type meets the preset type, triggering a first operation permission identification event for the operation request to identify whether the user meets the operation dimension of the Hive table; if the operation request passes the verification of the first operation permission identification event, allowing the user to perform the operation corresponding to the operation request on the Hive table; in response to the user completing the operation, triggering a second operation permission identification event for the operation to update the operation dimension of the Hive table. The present application can perform comprehensive and efficient field-level fine-grained management of Hive permission requests initiated by different types of clients.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, device, and readable storage medium for controlling Hive permissions. Background Art

[0002] Hive is a data warehouse tool based on Hadoop (a distributed system infrastructure). It maps structured data files into database tables and provides complete SQL (Structured Query Language) query functionality. It can convert SQL statements into MapReduce (a programming model) tasks for execution. Currently, there are various methods for managing Hive table permissions, including Hive default authorization, SQL-based Hive authorization, and Range & Sentry.

[0003] However, the above methods all have defects and problems to varying degrees in actual applications. For example, they cannot achieve comprehensive and fine-grained permission control. Some methods also restrict user operations or are incompatible with a large number of security components, resulting in many defects such as inability to directly use, difficulty in reuse and expansion. Summary of the Invention

[0004] The embodiments of the present application provide a Hive permission control method, apparatus, system, electronic device, and computer storage medium, which can perform comprehensive and efficient field-level fine-grained management of Hive permission requests initiated by different types of clients.

[0005] A first aspect of an embodiment of the present application provides a method for controlling Hive permissions, the method comprising:

[0006] Build a server for executing Hive permission control;

[0007] After receiving an operation request for a Hive table initiated by a user on a client, the server calls a corresponding parser to parse the operation type of the operation request according to the type of the client;

[0008] If the operation type meets the preset type, triggering a first operation permission identification event for the operation request to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents a mapping relationship between the field of the Hive table and the permission of the user;

[0009] If the operation request passes the verification of the first operation permission identification event, allowing the user to perform the operation corresponding to the operation request on the Hive table;

[0010] In response to the user completing the operation, a second operation permission identification event is triggered for the operation to update the operation dimension of the Hive table.

[0011] Optionally, the server for executing Hive permission control is constructed, including:

[0012] Obtain the basic service framework required to build the server;

[0013] Obtaining Hive source code for writing the Hive table and a metadata repository for storing the Hive source code;

[0014] Adding a permission identification interface in the Hive source code, wherein the permission identification interface is used to identify the operation request or the field type of the operation and trigger the corresponding event logic;

[0015] Configuring a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger the first operation authority identification event, and the second event listener is used to trigger the second operation authority identification event;

[0016] Deploy the modified Hive source code, the metadata library, the first event listener, and the second event listener to the basic service framework to build the server.

[0017] Optionally, the preset type includes a modification operation and a query operation on the Hive table, and if the operation type meets the preset type, triggering a first operation permission identification event for the operation request includes:

[0018] Obtaining a dimension type of the operation dimension, where the dimension type includes a full table dimension and a field dimension. The full table dimension represents a mapping relationship between all fields of the Hive table and the user's permissions, and the field dimension represents a mapping relationship between some fields of the Hive table and the user's permissions.

[0019] According to the dimension type corresponding to the operation type, query the first dimension value of the full table dimension or the second dimension value of the field dimension;

[0020] According to the permission mapping relationship, it is determined whether the user matches the first dimension value or the second dimension value. If so, the operation request passes the verification of the first operation permission identification event.

[0021] Optionally, the operation type includes a first operation type of creating a Hive table and creating a metadata database, and the method further includes:

[0022] If the operation type is the first operation type, verifying the path information carried by the operation request through the first event listener;

[0023] If the path information verification passes, the user is allowed to perform the operation of the first operation type; if the path information verification fails, abnormal verification information of the operation request is returned.

[0024] Optionally, in response to the user completing the operation, triggering a second operation permission identification event for the operation to update the operation dimension of the Hive table includes:

[0025] Identifying, by the second event listener, the operation type and dimension type corresponding to the operation request;

[0026] An update operation on the operation dimension is performed according to the operation type and the dimension type.

[0027] Optionally, the method further includes:

[0028] Receiving and verifying the user's request to add or modify the operation dimension;

[0029] If the addition request or the modification request is verified to be successful, the dimension value of the operation dimension is updated.

[0030] Accordingly, a second aspect of an embodiment of the present application provides a device for controlling Hive permissions, the device comprising:

[0031] The server-side building unit is used to build a server for executing Hive permission control;

[0032] An operation request parsing unit, configured to, after the server receives an operation request for a Hive table initiated by a user on a client, call a corresponding parsing terminal to parse the operation type of the operation request according to the type of the client;

[0033] a first event triggering unit, configured to trigger a first operation permission identification event for the operation request if the operation type meets a preset type, so as to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents a mapping relationship between a field of the Hive table and the permission of the user;

[0034] an operation verification unit, configured to allow the user to perform the operation corresponding to the operation request on the Hive table if the operation request passes the verification of the first operation permission identification event;

[0035] A second event triggering unit is configured to trigger a second operation permission identification event for the operation in response to the user completing the operation, so as to update the operation dimension of the Hive table.

[0036] Optionally, the server-side construction unit includes:

[0037] A basic service framework acquisition subunit is used to acquire the basic service framework required to build the server;

[0038] A data acquisition subunit, configured to acquire the Hive source code for writing the Hive table and a metadata repository for storing the Hive source code;

[0039] An interface configuration subunit, configured to add a permission identification interface to the Hive source code, wherein the permission identification interface is used to identify the operation request or the field type of the operation and trigger corresponding event logic;

[0040] a listener configuration subunit, configured to configure a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger the first operation authority identification event, and the second event listener is used to trigger the second operation authority identification event;

[0041] The data deployment subunit is used to deploy the modified Hive source code, the metadata library, the first event listener and the second event listener to the basic service framework to build the server.

[0042] A third aspect of an embodiment of the present application provides an electronic device, including:

[0043] processors and storage media;

[0044] The processor is used to implement each instruction;

[0045] The storage medium is used to store a plurality of instructions, and the instructions are used by the processor to load and execute the above-mentioned Hive permission control method.

[0046] A fourth aspect of the embodiments of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for loading by a processor to execute the steps in any one of the Hive permission control methods provided in the embodiments of the present application.

[0047] A fifth aspect of the embodiments of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements any of the Hive permission control methods provided in the embodiments of the present application.

[0048] It can be seen that this application identifies whether the user meets the operation dimension of the Hive table, and the operation dimension can characterize the mapping relationship between the fields of the Hive table and the user's permissions. Therefore, the method of this application can realize Hive table field-level authentication and complete fine-grained control of data permissions, thereby ensuring the comprehensiveness of permission control. At the same time, this method directly manages permissions through the operation dimension after receiving user operations from different types of clients, without the need to restrict client operations. This not only ensures the integrity of user operations, but also enables permission management compatible with Hive operation requests initiated by different types of clients.

[0049] Furthermore, this method implements Hive permission control by invoking internal components such as the first and second event listeners on the Hive server. This allows for compatibility with the permission control methods implemented by these internal components when reusing Hive, supporting Hive reuse and expansion. Therefore, this method provides fine-grained data permission control while fully protecting the integrity of user operations, achieving comprehensive and effective permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 This is a schematic diagram of an application scenario of the data classification system provided in an embodiment of the present application;

[0052] Figure 2 This is a flowchart of a method for controlling Hive permissions provided in an embodiment of the present application;

[0053] Figure 3 This is a schematic diagram of Hive permission control performed by the server provided in an embodiment of the present application;

[0054] Figure 4 Schematic diagram of the operation dimensions of the Hive table provided in the embodiment of the present application;

[0055] Figure 5 is a schematic diagram of the relationship between the operation dimension and the dimension value provided in the embodiment of the present application;

[0056] Figure 6 This is a schematic diagram of the structure of the Hive permission control device provided in an embodiment of the present application;

[0057] Figure 7 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0059] It should be noted that although there are currently multiple solutions for Hive table permission management, they all have varying degrees of defects and problems in actual applications. This article introduces the advantages and disadvantages of the following three Hive table permission management methods.

[0060] First, consider the legacy Hive authorization model. This model, based on an authorization scheme similar to the SQL standard, provides access control using grant and revoke statements. By creating views and granting permissions to the views (rather than granting permissions to the tables they depend on), fine-grained access control, known as column-level permissions, is provided. This solution provides a control system based on table and table field permissions.

[0061] Legacy mode is the most basic authorization scheme. It's not designed to prevent malicious users from accessing or manipulating unauthorized data, but rather to help users avoid unexpected operations. It lacks a comprehensive access control model, leaving many security vulnerabilities unaddressed. For example, many commands lack authorization confirmation; users are allowed to execute DFS commands, user-defined functions, and shell commands. However, these specialized operations are likely to bypass client-side security mechanisms. Therefore, this method fails to achieve comprehensive permission control, resulting in missed detections and making it difficult to ensure Hive data security.

[0062] The second permission management model is SQL Standards-Based Hive Authorization. Like Hive's default authorization mechanism, SQL Standards-Based Hive Authorization requires authorization confirmation during the SQL statement compilation phase. This authorization model is fully compatible with the SQL authorization model and does not introduce backward compatibility issues for existing users, leading to its widespread adoption. This solution provides a table-level permission control system.

[0063] To ensure the security of the SQL-based Hive authorization model, the client also needs to be secure. Therefore, this model is restrictive. It limits some client-side operations that may pose unsafe risks. For example, user access must be through HiveServer2 only, and user code and non-SQL commands are restricted. Therefore, this method restricts user operations and cannot guarantee the integrity of user operations. In addition, this method does not support authorization at the table level, but only at the table level, which cannot achieve fine-grained permission control.

[0064] Finally, there's the Range&Sentry permission management model. Range&Sentry is third-party open source software that provides policy-based permission management. Specifically, you add a Hive Service, then add custom policies for the service, such as access granularity like Database, Table, and Column, and then add group or user access permissions like Select, Create, and Drop.

[0065] Although Ranger & Sentry can implement column-level permission management, it is incompatible with a large number of security components and cannot be used directly. In addition, it cannot support Spark reuse of Hive table authentication, making it difficult to reuse and expand.

[0066] Based on this, embodiments of the present application provide a method, apparatus, device, and readable storage medium for controlling Hive permissions. The device may be an electronic device, and the readable storage medium may be a computer-readable storage medium. The Hive permission control device may be integrated into an electronic device, such as a server or a terminal.

[0067] Among them, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms.

[0068] The terminal may be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions thereon.

[0069] For example, Figure 1As shown, a user can use the terminal 10 to initiate an operation request for a Hive table. After receiving the operation request, the server 11 can call the corresponding parsing terminal to parse the operation type of the operation request according to the type of the client; if the operation type meets the preset type, a first operation permission identification event is triggered for the operation request to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents the mapping relationship between the fields of the Hive table and the permissions of the user; if the operation request passes the verification of the first operation permission identification event, the user is allowed to perform the operation corresponding to the operation request on the Hive table; in response to the user completing the operation, a second operation permission identification event is triggered for the operation to update the operation dimension of the Hive table.

[0070] In the embodiments of the present application, "a plurality of" refers to two or more. In the embodiments of the present application, "first" and "second" are used to distinguish descriptions and should not be understood as implying relative importance.

[0071] It should be noted that the order of description of the following embodiments is not intended to limit the preferred order of the embodiments.

[0072] See also Figure 2 and Figure 3 In this embodiment, a Hive permission control method is provided, which is applied to the data sorting end, such as Figure 2 As shown, the specific process of the Hive permission control method can be as follows:

[0073] Step 101: Build a server for executing Hive permission control.

[0074] The server refers to the server that has the management authority over the Hive system and Hive tables. Figure 3 The HiveServe2, Spark, and Presto systems in the project can be servers that provide Hive-related services, or they can be parsing-side computing engines called by servers.

[0075] Hive permissions refer to the permissions a user has to perform Hive operations on Hive, such as creating a Hive table, modifying the name of a Hive table, modifying the fields of a Hive table, modifying the delimiter of a Hive table, and creating a Hive table storage database.

[0076] In some embodiments, a server for executing the above Hive permission control can be built first, and then based on the built server, permission identification is performed on the operation requests for the above Hive operations initiated by users from different types of clients. After the permission identification verification is passed, the user is allowed to perform related Hive operations on the Hive table.

[0077] Optionally, step 101 may further include:

[0078] Obtain the basic service framework required to build the server;

[0079] Obtaining Hive source code for writing the Hive table and a metadata repository for storing the Hive source code;

[0080] Adding a permission identification interface in the Hive source code, wherein the permission identification interface is used to identify the operation request or the field type of the operation and trigger the corresponding event logic;

[0081] Configuring a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger the first operation authority identification event, and the second event listener is used to trigger the second operation authority identification event;

[0082] Deploy the modified Hive source code, the metadata library, the first event listener, and the second event listener to the basic service framework to build the server.

[0083] Specifically, you can first build a Hadoop cluster and start the HDFS storage service and YARN resource scheduling service to build the basic service framework required by the server. Then, install the MySQL (relational database management system) database in this basic service framework.

[0084] In some embodiments, the Hive source code for writing Hive tables can be downloaded and modified. For example, a new field for calling a permission identification interface can be added to the Hive source code so that the server can call the relevant permission identification interface to trigger the corresponding event logic after receiving a Hive operation request initiated by the user.

[0085] In some embodiments, two hooks can be configured to trigger the aforementioned permission identification event logic: a first event listener, MetaStorePreEventListener, for triggering the first operation permission identification event, and a second event listener, MetaStoreEventListener, for triggering the second operation permission identification event. Specifically, the first and second event listeners can be compiled into a jar package and stored in the Hive installation directory, lib.

[0086] Furthermore, the modified compiled Hive source code can be stored in a MySQL database. After the MySQL database is configured as a metadata repository, the modified compiled Hive source code, metadata repository, first event listener and second event listener can be deployed to the basic service framework to build the server.

[0087] In some embodiments, after receiving a Hive operation initiated by a user, the first event listener and the second event listener identify the operation type of the Hive operation and then call the relevant permission identification interface to trigger the corresponding event logic as shown in Table 1 below.

[0088]

[0089]

[0090] Table 1

[0091] As an example only, taking the permission identification interface "DROP_TABLE" in Table 1 as an example, this interface means that when the server recognizes that the operation request initiated by the user is to delete a Hive table, it will call the DROP_TABLE permission identification interface related to deleting the Hive table through the first event listener to verify the user's operation, so that the first event listener triggers the first operation permission identification event "table authentication". After the verification is passed, the second event listener triggers the second operation permission identification event "Delete all dimensions of the table, callback" to complete the entire permission identification operation of verifying whether the user who initiated the operation request has the relevant permission. For details about the first operation permission identification event and the second operation permission identification event, please see the description below.

[0092] Step 102: After receiving an operation request for a Hive table initiated by a user on a client, the server calls a corresponding parser to parse the operation type of the operation request according to the type of the client.

[0093] Among them, such as Figure 3 As shown, the client types may include Beeline, JDBC (Java DataBase Connectivity), Spark-Sql, Spark-Shell, Spark-Jar, Presto-Cli, etc.

[0094] In some embodiments, users can log in to the Hive server through the above different types of clients and initiate an operation request for the Hive table. After receiving the operation request, the server can call the corresponding parser to parse the operation request. For example Figure 3The Beeline and JDBC clients shown correspond to the HiveServer2 parser, the Spark-Sql, Spark-Shell, and Spark-Jar clients correspond to the Spark parser, and the Presto-Cli client corresponds to the Presto parser.

[0095] Operation types can include SQL operations and DDL operations. DDL operations, such as creating and deleting databases, are defined in the database definition language and do not involve read and write permissions for fields in the current Hive table. Therefore, DDL operations are not recognized by Hive permissions.

[0096] In some embodiments, the operation type can be further refined and identified as a modification or query operation on a Hive table, such as a user requesting to modify data in a column of a Hive table, or a user requesting to query data in a Hive table.

[0097] Step 103: If the operation type meets the preset type, a first operation permission identification event is triggered for the operation request to identify whether the user meets the operation dimension of the Hive table.

[0098] The preset types may include modification operations and query operations on a Hive table, such as the user requesting to modify data in a column of a Hive table or the user requesting to query data in a Hive table mentioned in step 102 .

[0099] Optionally, step 103 may include:

[0100] Obtaining a dimension type of the operation dimension, where the dimension type includes a full table dimension and a field dimension. The full table dimension represents a mapping relationship between all fields of the Hive table and the user's permissions, and the field dimension represents a mapping relationship between some fields of the Hive table and the user's permissions.

[0101] According to the dimension type corresponding to the operation type, query the first dimension value of the full table dimension or the second dimension value of the field dimension;

[0102] According to the permission mapping relationship, it is determined whether the user matches the first dimension value or the second dimension value. If so, the operation request passes the verification of the first operation permission identification event.

[0103] The operation dimension can represent the mapping relationship between the fields of the Hive table and the user's permissions. The full table dimension indicates that the corresponding user has the permission to read and write the entire Hive table, and the field dimension indicates that the corresponding user has the permission to read at least some columns of the Hive table.

[0104] In some embodiments, the permission mapping relationship between the user and the Hive can be queried through the operation dimension. Figure 4 and Figure 5 , the operation dimension can be represented by a specific field, which is: "Database Name. Table Name. Column Name. Dimension Type". Figure 4 For example, the field "db1.table1.column1.ro" in the table represents database 1, the field "table1" represents Hive table 1, and the field "column1" represents column 1. "ro" represents the field dimension, indicating a user request to modify or query data in a specific column of the Hive table. Correspondingly, "rw" represents the full table dimension, indicating a user request to modify the entire Hive table, such as deleting or renaming the Hive table.

[0105] It can be understood that the naming rules of the operation dimension can be formed by splicing the library name, table name, column name and dimension type corresponding to the Hive table initiated by the user. Other splicing rules can refer to the introduction of this embodiment and will not be repeated here.

[0106] In some embodiments, the data objects requested for the operation can be one or more. For example, if the user submits the operation request "selectcol1,col2,col3 from db.tb1;", the authentication will check the dimension values under the three columns involved. This embodiment is mainly introduced based on a single access object. In the case of multiple access objects, the authentication of each access object can refer to the authentication rules of a single access object. If one or more access objects do not have permission, a permission exception message will be thrown to determine the permission exception.

[0107] Among them, the dimension value can represent the specific user or user group that has the permission to operate this dimension. Among them, a dimension can have multiple dimension values, and a user or a user group (that is, the dimension value in the figure) can apply for permissions for multiple dimensions, but the full table dimension has only one unique first dimension value, which is the user who created the table, that is, Figure 5 The owner field. To more clearly illustrate the permission mapping relationship between Hive tables and user permissions, the following Table 2 (db1-table1) is used as an example.

[0108]

[0109] Table 2 (db1-table1)

[0110] As can be seen, table1, stored in the db1 database, contains student IDs, names, and grades. The first column, column1, contains the student ID. Users user1 and uesr2 have read access to this first column. For example, user1 and user2 can query the first column, corresponding to the second dimension of the table's field dimensions. Similarly, user owner.user3, the table's creator, has read and write permissions to read and modify the table, such as deleting a column or all columns, corresponding to the first dimension of the entire table's dimensions.

[0111] Optionally, the operation type includes a first operation type of creating a Hive table and creating a metadata database. The method of the present application may further include:

[0112] If the operation type is the first operation type, verifying the path information carried by the operation request through the first event listener;

[0113] If the path information verification passes, the user is allowed to perform the operation of the first operation type; if the path information verification fails, abnormal verification information of the operation request is returned.

[0114] It can be understood that in the first operation type involving creating a table or database, it is necessary to verify the path information (location) contained in the initiated operation request. For example, if a user requests to create a new Hive table in a certain path, the user needs to have permission for the path. Then (DGS-Manager is called) to verify whether the user has permission for the path. If the verification passes, the user is allowed to perform operations of the first operation type under the corresponding path. If the verification fails, a permission exception message is thrown, prohibiting the user from performing operations of the first operation type.

[0115] Step 104: If the operation request passes the verification of the first operation permission identification event, the user is allowed to perform the operation corresponding to the operation request on the Hive table.

[0116] It can be understood from the description in step 102 and step 103 that after identifying the operation type of the operation request initiated by the user, the first event listener can choose to call an appropriate permission identification interface to trigger verification of the corresponding first operation permission identification event.

[0117] Still using the data in Tables 1 and 2 as an example, assume that the user initiates an operation request of the type of modifying the Hive table name, that is, the user requests to modify the name of the Hive table, for example, changing the name of table1 to table2. Furthermore, the first event listener can call the "ALTER_TABLE_NAME" permission identification interface associated with the operation based on the operation type of the operation request, triggering the first operation permission identification event to perform table authentication on the operation request. Table authentication involves identifying whether the first dimension value of the full table dimension of the Hive table contains the user. Correspondingly, field authentication involves identifying whether the second dimension value of the field dimension of the Hive table contains the user.

[0118] Furthermore, assuming that a user requests to change the name of table1 to table2, the table authentication process can identify whether the user has read and write permissions for the Hive table table1. Assuming that the user is user3, it is identified that the first dimension value of the full table dimension of the Hive table table1 contains the user owner.user3. The operation request currently initiated by the user is verified, and the user is allowed to perform the operation of changing the table name of the Hive table.

[0119] Step 105: In response to the user completing the operation, a second operation permission identification event is triggered for the operation to update the operation dimension of the Hive table.

[0120] Optionally, step 105 may further include:

[0121] Identifying, by the second event listener, the operation type and dimension type corresponding to the operation request;

[0122] An update operation on the operation dimension is performed according to the operation type and the dimension type.

[0123] Continuing with the example in step 104, after the user's request to modify the Hive table name is verified, the user can complete the modification operation, triggering a second operation permission identification event. It is understood that after the user completes the modification operation, for example, by changing table1 to table2, while the substantive content of table1 remains unchanged, the operation dimensions, read and write permissions, and read permissions of table2 are inherited from table1. The second event listener triggers a second operation permission identification event to identify and verify whether the operation type (table name modification) is correct and whether the first dimension value of the dimension type (full table dimension) includes the user, i.e., whether the user performing the modification, owner.user3, has read and write permissions for the Hive table.

[0124] After the second operation permission identification event is verified, the dimension migration, permission transfer, and callback operations are triggered. The dimension migration operation migrates the first and second dimension values of the operation dimension of the original Hive table, table1, to table2. The permission transfer operation transfers the read and write permissions and read permissions of the original Hive table, table1, to table2. The callback is a specific callback notification to the Data Map Platform regarding the operations of modifying the table name, migrating the dimension, and transferring the permissions.

[0125] It can be understood that the first event listener is equivalent to listening to the user before performing the operation and identifying the triggering logical event, and the second event listener is equivalent to listening to the user after performing the operation and identifying the triggering logical event. The first event listener and the second event listener have permission identification functions at different user operation stages to ensure that the server of this application can implement comprehensive and efficient permission identification management for the user's operation requests and specific operations.

[0126] Optionally, the method of the present application may further include:

[0127] Receiving and verifying the user's request to add or modify the operation dimension;

[0128] If the addition request or the modification request is verified to be successful, the dimension value of the operation dimension is updated.

[0129] In some embodiments, users can request to add or modify the operation dimension of a Hive table. Figure 3 As shown, users can search for corresponding Hive tables in the data map. The operational dimensions of each Hive table can be centrally managed by the FDW (a type of data map) platform, allowing users to apply for and modify permissions for Hive tables. The server can call the Hive table's permission management system (e.g., the FACS system) to add, delete, or modify the operational dimensions of a specific Hive table, achieving precise control over Hive table permissions. Operational dimensions can be created by the server calling FACS during table creation, and changes to the Hive table structure will also affect the dimensions.

[0130] It can be seen that this application identifies whether the user meets the operation dimension of the Hive table, and the operation dimension can characterize the mapping relationship between the fields of the Hive table and the user's permissions. Therefore, the method of this application can realize Hive table field-level authentication and complete fine-grained control of data permissions, thereby ensuring the comprehensiveness of permission control. At the same time, this method directly manages permissions through the operation dimension after receiving user operations from different types of clients, without the need to restrict client operations. This not only ensures the integrity of user operations, but also enables permission management compatible with Hive operation requests initiated by different types of clients.

[0131] Furthermore, this method implements Hive permission control by invoking internal components such as the first and second event listeners on the Hive server. This allows for compatibility with the permission control methods implemented by these internal components when reusing Hive, supporting Hive reuse and expansion. Therefore, this method provides fine-grained data permission control while fully protecting the integrity of user operations, achieving comprehensive and effective permission control.

[0132] The method described in the above embodiment will be further described below.

[0133] like Figure 6 FIG. 1 is a schematic diagram of a Hive permission control device according to an embodiment of the present application. The device can be applied to a data processing end, and includes:

[0134] A server construction unit 201 is used to construct a server for executing Hive permission control;

[0135] The operation request parsing unit 202 is used for the server to receive an operation request for a Hive table initiated by a user on the client, and call the corresponding parsing end according to the type of the client to parse the operation type of the operation request;

[0136] A first event triggering unit 203 is configured to trigger a first operation permission identification event for the operation request if the operation type meets a preset type, so as to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents a mapping relationship between the fields of the Hive table and the user's permissions;

[0137] An operation verification unit 204 is configured to allow the user to perform the operation corresponding to the operation request on the Hive table if the operation request passes the verification of the first operation permission identification event;

[0138] The second event triggering unit 205 is configured to trigger a second operation permission identification event for the operation in response to the user completing the operation, so as to update the operation dimension of the Hive table.

[0139] Optionally, the server-side construction unit 201 includes:

[0140] The basic service framework acquisition subunit is used to obtain the basic service framework required to build the server;

[0141] The data acquisition subunit is used to obtain the Hive source code for writing Hive tables and the metadata database that stores the Hive source code;

[0142] The interface configuration subunit is used to add a permission identification interface to the Hive source code. The permission identification interface is used to identify the operation request or the field type of the operation and trigger the corresponding event logic.

[0143] A listener configuration subunit, configured to configure a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger a first operation authority identification event, and the second event listener is used to trigger a second operation authority identification event;

[0144] The data deployment subunit is used to deploy the modified Hive source code, metadata library, first event listener and second event listener to the basic service framework to build the server.

[0145] In the present application, the server-side construction unit 201 can construct a server for executing Hive permission control; the operation request parsing unit 202 can receive an operation request initiated by a user on a client for a Hive table through the server, and then call the corresponding parsing end to parse the operation type of the operation request according to the type of the client; the first event triggering unit 203 can trigger a first operation permission identification event for the operation request if the operation type meets the preset type, so as to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents the mapping relationship between the fields of the Hive table and the user's permissions; the operation verification unit 204 can allow the user to perform the operation corresponding to the operation request on the Hive table if the operation request passes the verification of the first operation permission identification event; the second event triggering unit 205 can trigger a second operation permission identification event for the operation in response to the user completing the operation, so as to update the operation dimension of the Hive table.

[0146] It can be seen that this application identifies whether the user meets the operation dimension of the Hive table, and the operation dimension can characterize the mapping relationship between the fields of the Hive table and the user's permissions. Therefore, the method of this application can realize Hive table field-level authentication and complete fine-grained control of data permissions, thereby ensuring the comprehensiveness of permission control. At the same time, this method directly manages permissions through the operation dimension after receiving user operations from different types of clients, without the need to restrict client operations. This not only ensures the integrity of user operations, but also enables permission management compatible with Hive operation requests initiated by different types of clients.

[0147] Furthermore, this method implements Hive permission control by invoking internal components such as the first and second event listeners on the Hive server. This allows for compatibility with the permission control methods implemented by these internal components when reusing Hive, supporting Hive reuse and expansion. Therefore, this method provides fine-grained data permission control while fully protecting the integrity of user operations, achieving comprehensive and effective permission control.

[0148] Corresponding to the above method embodiment, an embodiment of the present invention further provides a computer device. The computer device described below and the Hive permission control method described above can refer to each other.

[0149] The computer equipment includes:

[0150] memory for storing computer programs;

[0151] The processor is configured to implement the steps of the Hive permission control method of the above method embodiment when executing a computer program:

[0152] Build a server for executing Hive permission control;

[0153] After receiving an operation request for a Hive table initiated by a user on a client, the server calls a corresponding parser to parse the operation type of the operation request according to the type of the client;

[0154] If the operation type meets the preset type, triggering a first operation permission identification event for the operation request to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents a mapping relationship between the field of the Hive table and the permission of the user;

[0155] If the operation request passes the verification of the first operation permission identification event, allowing the user to perform the operation corresponding to the operation request on the Hive table;

[0156] In response to the user completing the operation, a second operation permission identification event is triggered for the operation to update the operation dimension of the Hive table.

[0157] For details, please refer to Figure 7, is a schematic diagram of the specific structure of a computer device provided in this embodiment. The computer device may vary greatly due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer applications 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), each of which may include a series of instruction operations in the data processing device. Furthermore, the central processing unit 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the computer device 301.

[0158] The computer device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0159] The steps in the Hive permission control method described above can be implemented by the structure of a computer device.

[0160] Corresponding to the above method embodiment, an embodiment of the present invention further provides a readable storage medium. The readable storage medium described below and the Hive permission control method described above can refer to each other.

[0161] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the Hive permission control method of the above method embodiment.

[0162] The readable storage medium may specifically be any readable storage medium that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0163] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A method for controlling Hive permissions, characterized in that: The method comprises: Build a server for executing Hive permission control; After receiving an operation request for a Hive table initiated by a user on a client, the server calls a corresponding parser to parse the operation type of the operation request according to the type of the client; If the operation type meets the preset type, a first operation permission identification event is triggered for the operation request to identify whether the user meets the operation dimension of the Hive table, wherein the operation dimension represents the mapping relationship between the fields of the Hive table and the permissions of the user, and the preset type includes modification operations and query operations on the Hive table; If the operation request passes the verification of the first operation permission identification event, allowing the user to perform the operation corresponding to the operation request on the Hive table; In response to the user completing the operation, a second operation permission identification event is triggered for the operation to update the operation dimension of the Hive table.

2. The Hive permission control method according to claim 1, characterized in that: The server for executing Hive permission control is constructed, including: Obtain the basic service framework required to build the server; Obtaining Hive source code for writing the Hive table and a metadata repository for storing the Hive source code; Adding a permission identification interface in the Hive source code, wherein the permission identification interface is used to identify the operation request or the field type of the operation and trigger the corresponding event logic; Configuring a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger the first operation authority identification event, and the second event listener is used to trigger the second operation authority identification event; Deploy the modified Hive source code, the metadata library, the first event listener, and the second event listener to the basic service framework to build the server.

3. The Hive permission control method according to claim 2, characterized in that: If the operation type meets the preset type, triggering a first operation permission identification event for the operation request includes: Obtaining a dimension type of the operation dimension, where the dimension type includes a full table dimension and a field dimension. The full table dimension represents a mapping relationship between all fields of the Hive table and the user's permissions, and the field dimension represents a mapping relationship between some fields of the Hive table and the user's permissions. According to the dimension type corresponding to the operation type, query the first dimension value of the full table dimension or the second dimension value of the field dimension; According to the permission mapping relationship, it is determined whether the user matches the first dimension value or the second dimension value. If so, the operation request passes the verification of the first operation permission identification event.

4. The method for controlling Hive permissions according to claim 3, characterized in that: The operation type includes a first operation type of creating a Hive table and creating a metadata database, and the method further includes: If the operation type is the first operation type, verifying the path information carried by the operation request through the first event listener; If the path information verification passes, the user is allowed to perform the operation of the first operation type; if the path information verification fails, abnormal verification information of the operation request is returned.

5. The method for controlling Hive permissions according to claim 3, characterized in that: In response to the user completing the operation, triggering a second operation permission identification event for the operation to update the operation dimension of the Hive table, including: Identifying, by the second event listener, the operation type and dimension type corresponding to the operation request; An update operation on the operation dimension is performed according to the operation type and the dimension type.

6. The method for controlling Hive permissions according to any one of claims 1 to 5, characterized in that: The method further comprises: Receiving and verifying the user's request to add or modify the operation dimension; If the addition request or the modification request is verified to be successful, the dimension value of the operation dimension is updated.

7. A Hive permission control device, characterized in that: The device comprises: The server-side building unit is used to build a server for executing Hive permission control; An operation request parsing unit, configured to, after the server receives an operation request for a Hive table initiated by a user on a client, call a corresponding parsing terminal to parse the operation type of the operation request according to the type of the client; a first event triggering unit, configured to trigger a first operation permission identification event for the operation request if the operation type satisfies a preset type, so as to identify whether the user satisfies an operation dimension of the Hive table, wherein the operation dimension represents a mapping relationship between a field of the Hive table and the permission of the user, and the preset type includes a modification operation and a query operation on the Hive table; an operation verification unit, configured to allow the user to perform the operation corresponding to the operation request on the Hive table if the operation request passes the verification of the first operation permission identification event; The second event triggering unit is configured to trigger a second operation permission identification event for the operation in response to the user completing the operation, so as to update the operation dimension of the Hive table.

8. The Hive permission control device according to claim 7, characterized in that: The server-side construction unit includes: A basic service framework acquisition subunit is used to acquire the basic service framework required to build the server; A data acquisition subunit, configured to acquire the Hive source code for writing the Hive table and a metadata repository for storing the Hive source code; An interface configuration subunit, configured to add a permission identification interface to the Hive source code, wherein the permission identification interface is used to identify the operation request or the field type of the operation and trigger corresponding event logic; a listener configuration subunit, configured to configure a first event listener and a second event listener corresponding to the event logic, wherein the first event listener is used to trigger the first operation authority identification event, and the second event listener is used to trigger the second operation authority identification event; The data deployment subunit is used to deploy the modified Hive source code, the metadata library, the first event listener and the second event listener to the basic service framework to build the server.

9. A computer device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the method for controlling Hive permissions according to any one of claims 1 to 6 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the Hive permission control method according to any one of claims 1 to 6.

Images