A data isolation method, device, electronic device and storage medium

Abstract

The present application provides a data isolation method, apparatus, electronic device and storage medium. The method includes: obtaining user login information; retrieving a corresponding data display page according to the user login information; generating a target database statement segment according to the isolation condition corresponding to the data list in the data display page; splicing the target database statement segment to the basic database statement of the data list to obtain a target database statement; calling target data based on the target database statement and displaying the target data in the data list. In the method provided by the above solution, by binding an isolation condition to the data list, the data in the database is necessarily bound to a corresponding data list, ensuring that data isolation can be achieved, thereby improving data security.

Description

Technical Field

[0001] This application relates to the technical field of data management, and in particular, to a data isolation method, apparatus, electronic device, and storage medium. Background Art

[0002] Currently, whether it is an enterprise management system or an engineering management system, they are all oriented to a large number of users. In an environment of a large number of users and a complex permission system, data isolation technology is generally used to strictly control data display.

[0003] In the prior art, it is usually the role that is bound to the department for isolation. When a user obtains data, the user will obtain the data related to the department bound by the user. If there is business data that is not associated with the department, the business data will not be able to achieve data isolation, reducing the security of the data. Summary of the Invention

[0004] This application provides a data isolation method, apparatus, electronic device, and storage medium to solve the defects such as the reduction of data security in the prior art.

[0005] The first aspect of this application provides a data isolation method, including:

[0006] Obtain user login information;

[0007] According to the user login information, retrieve the corresponding data display page;

[0008] Generate a target database statement fragment according to the isolation condition corresponding to the data list in the data display page;

[0009] Splice the target database statement fragment to the basic database statement of the data list to obtain a target database statement;

[0010] Call target data based on the target database statement and display the target data in the data list.

[0011] Optionally, the retrieving the corresponding data display page according to the user login information includes:

[0012] Determine the isolation dimension of the user according to the user login information; wherein, the isolation dimension is at least divided into three types: department, role, and personnel;

[0013] Determine the corresponding target isolation policy according to the isolation dimension of the user;

[0014] Retrieve the corresponding data display page according to the target isolation policy.

[0015] Optionally, the determining the isolation dimension of the user according to the user login information includes:

[0016] Determine the isolation dimension of the user according to the association type characterized by the user login information.

[0017] Optionally, the determining the isolation dimension of the user according to the association type characterized by the user login information includes:

[0018] When the user login information indicates that the user includes two or more association types, determine the target association type according to the priorities of the association types;

[0019] Determine the isolation dimension of the user according to the target association type.

[0020] Optionally, the generating the target database statement fragment according to the isolation condition corresponding to the data list in the data display page includes:

[0021] Determine the corresponding isolation script and dimension logic according to the isolation condition corresponding to the data list in the data display page;

[0022] Generate the target database statement fragment according to the isolation script and dimension logic.

[0023] Optionally, it further includes:

[0024] Judge whether the current isolation dimension includes a subquery according to the isolation condition corresponding to the data list in the data display page;

[0025] If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

[0026] Add the dimension field to the target database statement fragment.

[0027] Optionally, the invoking the target data based on the target database statement includes:

[0028] Invoke the database query script interface;

[0029] Based on the database query script interface, input the target database statement into a preset database to invoke the target data in the preset database.

[0030] The second aspect of this application provides a data isolation device, including:

[0031] An acquisition module, configured to acquire user login information;

[0032] A page retrieval module, configured to retrieve a corresponding data display page according to the user login information;

[0033] A generation module, configured to generate a target database statement fragment according to an isolation condition corresponding to a data list in the data display page;

[0034] A splicing module, configured to splice the target database statement fragment to a basic database statement of the data list to obtain a target database statement;

[0035] A data calling module, configured to call target data based on the target database statement and display the target data in the data list.

[0036] Optionally, the page calling module is specifically configured to:

[0037] Determine the isolation dimension of the user according to the user login information; wherein, the isolation dimension is at least divided into three types: department, role, and personnel;

[0038] Determine a corresponding target isolation policy according to the isolation dimension of the user;

[0039] Retrieve a corresponding data display page according to the target isolation policy.

[0040] Optionally, the page calling module is specifically configured to:

[0041] Determine the isolation dimension of the user according to the association type represented by the user login information.

[0042] Optionally, the page calling module is specifically configured to:

[0043] When the user login information indicates that the user includes two or more association types, determine a target association type according to the priorities of the association types;

[0044] Determine the isolation dimension of the user according to the target association type.

[0045] Optionally, the generation module is specifically configured to:

[0046] Determine a corresponding isolation script and dimension logic according to the isolation condition corresponding to the data list in the data display page;

[0047] Generate a target database statement fragment according to the isolation script and dimension logic.

[0048] Optionally, the generation module is further configured to:

[0049] Judge whether the current isolation dimension includes a subquery according to the isolation condition corresponding to the data list in the data display page;

[0050] If the current isolation dimension includes a subquery, obtain a dimension field corresponding to the subquery;

[0051] Add the dimension field to the target database statement fragment.

[0052] Optionally, the data call module is specifically configured to:

[0053] Call the database query script interface;

[0054] Based on the database query script interface, input the target database statement into a preset database to call target data in the preset database.

[0055] A third aspect of this application provides an electronic device, including: at least one processor and a memory;

[0056] The memory stores computer execution instructions;

[0057] The at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the method described in the first aspect above and various possible designs of the first aspect.

[0058] A fourth aspect of this application provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the method described in the first aspect above and various possible designs of the first aspect is implemented.

[0059] The technical solution of this application has the following advantages:

[0060] This application provides a data isolation method, device, electronic device and storage medium. The method includes: obtaining user login information; according to the user login information, retrieving the corresponding data display page; according to the isolation conditions corresponding to the data list in the data display page, generating a target database statement fragment; splicing the target database statement fragment to the basic database statement of the data list to obtain a target database statement; calling target data based on the target database statement and displaying the target data in the data list. The method provided by the above solution ensures data isolation by binding isolation conditions to the data list, and the data in the database is necessarily bound to the corresponding data list, thereby improving data security. Description of the Drawings

[0061] In order to more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of this application. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings.

[0062] Figure 1Schematic structural diagram of the data isolation system based on the embodiments of the present application;

[0063] Figure 2 Schematic flow diagram of the data isolation method provided by the embodiments of the present application;

[0064] Figure 3 Schematic structural diagram of the data isolation device provided by the embodiments of the present application;

[0065] Figure 4 Schematic structural diagram of the electronic device provided by the embodiments of the present application.

[0066] Through the above-mentioned drawings, the clear embodiments of the present application have been shown, and more detailed descriptions will be given later. These drawings and text descriptions are not intended to limit the scope of the concept of the present disclosure in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. Detailed implementation manners

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0068] In addition, terms such as "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. In the descriptions of the following embodiments, "a plurality" means two or more, unless otherwise specifically defined.

[0069] In the prior art, it is usually the role-bound department that performs isolation. When a user obtains data, the user will obtain the data related to the department bound to the user. If there is business data that is not associated with the department, this business data will not be able to achieve data isolation, reducing the security of the data.

[0070] In view of the above problems, the data isolation method, device, electronic device and storage medium provided by the embodiments of the present application obtain user login information; call the corresponding data display page according to the user login information; generate a target database statement segment according to the isolation condition corresponding to the data list in the data display page; splice the target database statement segment to the basic database statement of the data list to obtain a target database statement; call the target data based on the target database statement and display the target data in the data list. The method provided by the above solution binds an isolation condition to the data list, and the data in the database is necessarily bound to the corresponding data list, ensuring that data isolation can be achieved, thereby improving data security.

[0071] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will be described below with reference to the accompanying drawings.

[0072] First, the structure of the data isolation system on which the present application is based will be described:

[0073] The data isolation method, device, electronic device and storage medium provided by the embodiments of the present application are applicable to data isolation in data systems such as enterprise management systems or project management systems. As Figure 1 shown, it is a schematic structural diagram of the data isolation system based on the embodiments of the present application, which mainly includes a web front-end service, a database and a data isolation device. Specifically, the user inputs login information to the web front-end service, the data isolation device obtains the user login information in the web front-end service, then calls the target data in the database according to the user login information, and displays it to the user through the web front-end service for the user to read.

[0074] The embodiments of the present application provide a data isolation method for data isolation in data systems such as enterprise management systems or project management systems. The execution subject of the embodiments of the present application is an electronic device, such as a server, a desktop computer, a laptop computer, a tablet computer and other electronic devices that can be used for data isolation.

[0075] As Figure 2 shown, it is a schematic flowchart of the data isolation method provided by the embodiments of the present application, and the method includes:

[0076] Step 201, obtain user login information.

[0077] Among them, the user login information includes at least the username and password input by the user to the web front-end service.

[0078] Step 202, call the corresponding data display page according to the user login information.

[0079] Specifically, based on the user login information, the access permissions of the user can be determined, and then the corresponding data display page can be called in the web front-end service. The data display page contains display boxes for all the information accessible to the user.

[0080] Step 203: Generate a target database statement fragment according to the isolation conditions corresponding to the data list in the data display page.

[0081] It should be noted that the data display page includes multiple data lists. Different data lists display different types of data, and each data list corresponds to a display box. The isolation conditions include multiple isolation parameters, some of which are fixed values and some are dynamic values.

[0082] Specifically, for any data list in the data display page, a corresponding target database statement fragment can be generated according to the isolation conditions bound to the data list.

[0083] Specifically, in one embodiment, the corresponding isolation script and dimension logic can be determined according to the isolation conditions corresponding to the data list in the data display page; and the target database statement fragment can be generated according to the isolation script and dimension logic.

[0084] Among them, the isolation script includes query fields, and the dimension logic includes intersections and unions.

[0085] Specifically, according to the preset data statement writing standard, the corresponding isolation script and dimension logic are determined according to the isolation conditions corresponding to the data list in the data display page, and then the target database statement fragment is generated. Among them, the target database statement fragment can be an SQL statement.

[0086] Step 204: Concatenate the target database statement fragment to the basic database statement of the data list to obtain the target database statement.

[0087] Specifically, the basic database statement can be determined according to the attribute information of the data list itself, and the target database statement is obtained by concatenating the target database statement fragment to the basic database statement.

[0088] Step 205: Call the target data based on the target database statement and display the target data in the data list.

[0089] Specifically, the target database statement can be input into the preset database to call the corresponding target data in the preset database.

[0090] Specifically, in one embodiment, the database query script interface can be called; based on the database query script interface, the target database statement is input into the preset database to call the target data in the preset database.

[0091] Specifically, based on a preset vform service, the database query script interface can be called, and then based on this database query script interface, the target database statement can be input into the preset database.

[0092] Based on the above embodiments, as an implementable manner, in one embodiment, according to the user login information, the corresponding data display page is retrieved, including:

[0093] Step 2021, according to the user login information, determine the isolation dimension of this user; wherein, the isolation dimension is at least divided into three types: department, role, and personnel;

[0094] Step 2022, according to the isolation dimension of this user, determine the corresponding target isolation policy;

[0095] Step 2023, according to the target isolation policy, retrieve the corresponding data display page.

[0096] Specifically, according to the corresponding relationship between the preset user name and the isolation dimension, the isolation dimension corresponding to the user name represented by the user login information can be determined, and then the target isolation policy corresponding to this isolation dimension can be determined. Finally, according to the target isolation policy, the data access permission of this user can be determined, and the data display page that meets its data access permission can be retrieved.

[0097] Specifically, in one embodiment, the isolation dimension of this user can be determined according to the association type represented by the user login information.

[0098] It should be noted that the association type can also be divided into three types: department, role, and personnel.

[0099] Specifically, in one embodiment, when the user login information indicates that this user includes two or more association types, the target association type is determined according to the priority of each association type; according to the target association type, the isolation dimension of this user is determined.

[0100] Exemplarily, if the priority of the association type is from high to low in the order of personnel, role, and department, and the current user login information indicates that this user includes two association types of personnel and role, then personnel is determined as the target association type of this user, and further, the isolation dimension of personnel is determined as the isolation dimension of this user.

[0101] Based on the above embodiments, in order to improve the flexibility of data isolation while improving data security, as an implementable manner, in one embodiment, the method further includes:

[0102] Step 301, according to the isolation condition corresponding to the data list in the data display page, determine whether the current isolation dimension includes a subquery;

[0103] Step 302, if the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

[0104] Step 303, add the dimension field to the target database statement fragment.

[0105] It should be noted that the subquery may specifically refer to a data filtering query.

[0106] Specifically, when the current isolation dimension includes a subquery, a text input box can be generated so that the user can enter a dimension field in the text input box to obtain the dimension field corresponding to the subquery, and then add the dimension field to the target database statement fragment, realizing the user's custom subquery and improving the flexibility of data isolation.

[0107] Among them, considering the security of the system, the dimension field corresponding to the subquery is not allowed to be entered and displayed on the web front end. To ensure normal isolation, the user can enter through the background database account.

[0108] The data isolation method provided by the embodiment of the present application includes: obtaining user login information; according to the user login information, retrieving the corresponding data display page; according to the isolation conditions corresponding to the data list in the data display page, generating a target database statement fragment; splicing the target database statement fragment to the basic database statement of the data list to obtain a target database statement; calling target data based on the target database statement and displaying the target data in the data list. The method provided by the above solution, by binding isolation conditions to the data list, the data in the database is necessarily bound to the corresponding data list, ensuring that data isolation can be achieved, thereby improving the security of data. And, by judging whether the current isolation dimension includes a subquery according to the isolation conditions corresponding to the data list in the data display page; if the current isolation dimension includes a subquery, obtaining the dimension field corresponding to the subquery; adding the dimension field to the target database statement fragment, the user's custom subquery is realized, and the flexibility of data isolation is improved.

[0109] The embodiment of the present application provides a data isolation device for executing the data isolation method provided by the above embodiment.

[0110] As Figure 3 shown, it is a schematic structural diagram of the data isolation device provided by the embodiment of the present application. The data isolation device 30 includes: an acquisition module 301, a page retrieval module 302, a generation module 303, a splicing module 304, and a data call module 305.

[0111] Among them, an acquisition module is used to acquire user login information; a page retrieval module is used to retrieve a corresponding data display page according to the user login information; a generation module is used to generate a target database statement segment according to the isolation conditions corresponding to the data list in the data display page; a splicing module is used to splice the target database statement segment to the basic database statement of the data list to obtain a target database statement; a data call module is used to call target data based on the target database statement and display the target data in the data list.

[0112] Specifically, in one embodiment, the page retrieval module is specifically used for:

[0113] According to the user login information, determine the isolation dimension of the user; among them, the isolation dimension is at least divided into three types: department, role, and personnel;

[0114] According to the isolation dimension of the user, determine the corresponding target isolation policy;

[0115] According to the target isolation policy, retrieve the corresponding data display page.

[0116] Specifically, in one embodiment, the page retrieval module is specifically used for:

[0117] According to the association type represented by the user login information, determine the isolation dimension of the user.

[0118] Specifically, in one embodiment, the page retrieval module is specifically used for:

[0119] When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type;

[0120] According to the target association type, determine the isolation dimension of the user.

[0121] Specifically, in one embodiment, the generation module is specifically used for:

[0122] According to the isolation conditions corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic;

[0123] According to the isolation script and dimension logic, generate a target database statement segment.

[0124] Specifically, in one embodiment, the generation module is further used for:

[0125] According to the isolation conditions corresponding to the data list in the data display page, determine whether the current isolation dimension includes a subquery;

[0126] If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

[0127] Add a dimension field to the target database statement fragment.

[0128] Specifically, in one embodiment, the data invocation module is specifically configured to:

[0129] Invoke the database query script interface;

[0130] Based on the database query script interface, input the target database statement into the preset database to invoke the target data in the preset database.

[0131] Regarding the data isolation device in this embodiment, the specific manners in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0132] The data isolation device provided by the embodiments of the present application is used to execute the data isolation method provided by the above embodiments, and its implementation manner and principle are the same, and will not be repeated.

[0133] The embodiments of the present application provide an electronic device for executing the data isolation method provided by the above embodiments.

[0134] As Figure 4 shown, it is a schematic structural diagram of the electronic device provided by the embodiments of the present application. The electronic device 40 includes: at least one processor 41 and a memory 42.

[0135] The memory stores computer-executable instructions; at least one processor executes the computer-executable instructions stored in the memory, so that at least one processor executes the data isolation method provided by the above embodiments.

[0136] The electronic device provided by the embodiments of the present application is used to execute the data isolation method provided by the above embodiments, and its implementation manner and principle are the same, and will not be repeated.

[0137] The embodiments of the present application provide a computer-readable storage medium, in which computer-executable instructions are stored. When the processor executes the computer-executable instructions, the data isolation method provided by any of the above embodiments is implemented.

[0138] The storage medium containing computer-executable instructions provided by the embodiments of the present application can be used to store the computer-executable instructions for the data isolation method provided in the foregoing embodiments, and its implementation manner and principle are the same, and will not be repeated.

[0139] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections between each other can be through some interfaces. The indirect couplings or communication connections of devices or units can be in electrical, mechanical or other forms.

[0140] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0141] In addition, in each embodiment of the present application, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of a combination of hardware and software functional units.

[0142] The above integrated units implemented in the form of software functional units can be stored in a computer-readable storage medium. The above software functional units stored in a storage medium include several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute some steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs that can store program codes.

[0143] Those skilled in the art can clearly understand that for the convenience and brevity of description, only the above division of each functional module is used as an example. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the foregoing method embodiments and will not be elaborated here.

[0144] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than limiting them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data isolation method, characterized in that, It includes: Obtain user login information; According to the user login information, retrieve the corresponding data display page; Generate a target database statement fragment according to the isolation conditions corresponding to the data list in the data display page; Splice the target database statement fragment to the basic database statement of the data list to obtain a target database statement; Call target data based on the target database statement and display the target data in the data list; The method further includes: According to the isolation conditions corresponding to the data list in the data display page, determine whether the current isolation dimension includes a subquery; If the current isolation dimension includes a subquery, obtain the dimension fields corresponding to the subquery; Add the dimension fields to the target database statement fragment; Wherein, the subquery refers to a data filtering query.

2. The method according to claim 1, wherein The retrieving the corresponding data display page according to the user login information includes: According to the user login information, determine the isolation dimension of the user; wherein, the isolation dimension is at least divided into three types: department, role, and personnel; According to the isolation dimension of the user, determine the corresponding target isolation policy; According to the target isolation policy, retrieve the corresponding data display page.

3. The method according to claim 2, characterized in that, The determining the isolation dimension of the user according to the user login information includes: According to the association type represented by the user login information, determine the isolation dimension of the user.

4. The method according to claim 3, wherein The determining the isolation dimension of the user according to the association type represented by the user login information includes: When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type; According to the target association type, determine the isolation dimension of the user.

5. The method according to claim 4, wherein The generating the target database statement fragment according to the isolation conditions corresponding to the data list in the data display page includes: According to the isolation conditions corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic; Generate a target database statement fragment according to the isolation script and dimension logic.

6. The method according to claim 1, wherein The calling the target data based on the target database statement includes: Call the database query script interface; Based on the database query script interface, input the target database statement into a preset database to call target data in the preset database.

7. A data isolation device, characterized in that, It includes: An obtaining module, configured to obtain user login information; A page retrieving module, configured to retrieve the corresponding data display page according to the user login information; A generating module, configured to generate a target database statement fragment according to the isolation conditions corresponding to the data list in the data display page; A splicing module, configured to splice the target database statement fragment to the basic database statement of the data list to obtain a target database statement; A data calling module, configured to call target data based on the target database statement and display the target data in the data list; The generating module is further configured to: According to the isolation conditions corresponding to the data list in the data display page, determine whether the current isolation dimension includes a subquery; If the current isolation dimension includes a subquery, obtain the dimension fields corresponding to the subquery; Add the dimension field to the target database statement fragment; Wherein, the subquery refers to data filtering query.

8. An electronic device, characterized in that, Comprising: At least one processor and a memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Computer-executable instructions are stored in the computer-readable storage medium, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 6 is implemented.

Images