Method and apparatus for automatically generating authorization script of data operation right

Abstract

The application relates to the field of financial technology, and provides a data operation permission authorization script automatic generation method and related equipment, the data operation permission authorization script automatic generation method obtains all business data tables related to a storage process through a target interface of the storage process, so that all data operations performed on each business data table are obtained through matching processing of the business data tables in the storage process, and finally, a data control script template is preset to automatically generate permissions for granting a user of a business system to perform related data operations on the business data tables, so that in the conversion process from the storage process to a java program code, the authorization script of the related data operation permission on the business data table can be automatically generated, the human consumption in the conversion process is reduced, and the efficiency of converting the storage process is improved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to a method and device for automatically generating authorization scripts for data operation permissions. Background Technology

[0002] Currently, many applications in the core life insurance system rely on database stored procedures. Often, the Java program only provides an entry point, while the majority of the business logic is written into the stored procedure. In Oracle databases, the stored procedure only needs authorization from the user to manipulate the business data tables; no authorization from the application system user is required.

[0003] However, due to various drawbacks of Oracle databases, moving away from Oracle is an industry trend. The first step in this process is to convert stored procedure logic into Java code. Business systems can no longer manipulate business data tables through stored procedures; instead, they need to write stored procedure logic within the business system to perform CRUD operations on these tables. However, since many business data tables are not authorized for use by business system users, the converted code often results in "table or view not found" errors when the business system executes the program. In such cases, developers often need to manually check the business data tables, write authorization scripts, and manually edit database deployment documents—a series of manual processes that are inefficient and costly. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, electronic device, and computer-readable storage medium for automatically generating authorization scripts for data operation permissions. This method can automatically generate authorization scripts for relevant data operation permissions on business data tables, improve the efficiency of transferring data operation permissions of business data tables during stored procedure conversion, and reduce manpower consumption.

[0005] To achieve the above objectives, a first aspect of this application proposes a method for automatically generating authorization scripts for data operation permissions, the method comprising:

[0006] Obtain the stored procedures of the database used by the business system and the target interfaces corresponding to the stored procedures;

[0007] Based on the target interface, all business data tables related to the stored procedure and the user who created each business data table are obtained through querying.

[0008] Based on the business data table, the stored procedure performs matching processing to obtain all data operations performed on each business data table;

[0009] Based on the user who created the business data table, the data operation, and the preset data control script template, generate the SQL authorization script corresponding to each business data table;

[0010] The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

[0011] According to some embodiments of this application, the method for automatically generating authorization scripts for data operation permissions includes a stored procedure containing multiple SQL code strings. The process of matching the data operation performed on the business data table within the stored procedure to obtain the data operation to be executed on the business data table includes:

[0012] All the SQL code strings are extracted from the stored procedure;

[0013] Based on the business data table, the SQL code string is matched to determine all data operations to be performed on each business data table.

[0014] According to some embodiments of this application, the method for automatically generating authorization scripts for data operation permissions includes matching the SQL code string based on the business data table to determine all data operations to be performed on each business data table, including:

[0015] Perform string matching on the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string;

[0016] The search continues forward within the SQL code string, starting from the location information, until the data manipulation keyword is found.

[0017] Summarize the data operation keywords obtained from searching all the SQL code strings to determine all data operations to be performed on each of the business data tables.

[0018] According to some embodiments of this application, the method for automatically generating authorization scripts for data operation permissions includes generating an SQL authorization script for each business data table based on the user who created the business data table, the data operation, and a preset data control script template.

[0019] Obtain a preset data control script template, which includes a first fill area, a second fill area, and a third fill area. The first fill area is used to fill in the data operation permissions to be granted, the second fill area is used to fill in the business data table for which permissions are to be granted, and the third fill area is used to fill in the user for whom permissions are to be granted.

[0020] For each of the business data tables, the data operations are filled into the first fill area, the business data table and the user who created the business data table are associated, and the association result is filled into the second fill area. The user of the business system is filled into the third fill area, and the SQL authorization script corresponding to the business data table is generated.

[0021] According to some embodiments of this application, the method for automatically generating authorization scripts for data operation permissions, after generating the SQL authorization script corresponding to each business data table based on the creation user of the business data table, the data operation, and a preset data control script template, the method further includes:

[0022] Generate a script deployment document, which includes the SQL authorization script to be deployed and the correspondence between the SQL authorization script and the database and the users of the business system.

[0023] According to some embodiments of this application, the method for automatically generating authorization scripts for data operation permissions, after generating the SQL authorization script corresponding to each business data table based on the creation user of the business data table, the data operation, and a preset data control script template, the method further includes:

[0024] By calling the interface of the preset development quality management platform, the security audit results are obtained by performing security audits on the SQL authorization scripts corresponding to all the business data tables.

[0025] The method for automatically generating authorization scripts for data operation permissions according to some embodiments of this application further includes:

[0026] Package all the SQL authorization scripts, the script deployment documents, and the security audit results into a single package and send the packaged result to the approver for script approval.

[0027] If the approval result indicates that the approval has been passed, the packaged result and the approval result are sent to the system administrator of the database management system.

[0028] To achieve the above objectives, a second aspect of this application provides an apparatus for automatically generating authorization scripts for data operation permissions, the apparatus comprising:

[0029] The first acquisition module is used to acquire the stored procedures of the database used by the business system and the target interfaces corresponding to the stored procedures;

[0030] The query module is used to query all business data tables related to the stored procedure and the user who created each business data table based on the target interface;

[0031] The matching module is used to perform matching processing on the stored procedure based on the business data table to obtain all data operations performed on each business data table;

[0032] The script generation module is used to generate an SQL authorization script for each business data table based on the user who created the business data table, the data operation, and a preset data control script template.

[0033] The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

[0034] To achieve the above objectives, a third aspect of this application provides an electronic device, the electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the method described in the first aspect.

[0035] To achieve the above objectives, a fourth aspect of the present application provides a storage medium, which is a computer-readable storage medium for computer-readable storage, wherein the storage medium stores one or more computer programs that can be executed by one or more processors to implement the method described in the first aspect.

[0036] This application proposes a method, apparatus, electronic device, and computer-readable storage medium for automatically generating authorization scripts for data operation permissions. The method includes obtaining the stored procedures of the database used by the business system and the target interface corresponding to the stored procedures; then, querying all business data tables related to the stored procedures and the users who created each business data table based on the target interface; next, performing matching processing within the stored procedures based on the business data tables to obtain all data operations to be performed on each business data table; and finally, generating an SQL authorization script corresponding to each business data table based on the users who created the business data tables, the data operations, and a preset data control script template. This SQL authorization script is used to grant users of the business system permissions to perform data operations on the business data tables. This embodiment of the application obtains all business data tables related to the stored procedures through the target interface of the stored procedures, thereby using the business data tables to perform matching processing within the stored procedures to obtain all data operations to be performed on each business data table. Finally, based on a preset data control script template, it automatically generates authorization scripts to grant users of the business system permissions to perform relevant data operations on the business data tables. This method can automatically generate authorization scripts for relevant data operation permissions on business data tables, improving the efficiency of transferring data operation permissions of business data tables during stored procedure conversion and reducing manpower consumption. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating a method for automatically generating authorization scripts for data operation permissions provided in an embodiment of this application;

[0038] Figure 2 yes Figure 1 A flowchart illustrating the sub-steps of step S130;

[0039] Figure 3 yes Figure 2 A flowchart illustrating the sub-steps of step S220;

[0040] Figure 4 yes Figure 1 A flowchart illustrating the sub-steps of step S140;

[0041] Figure 5 This is a flowchart illustrating a method for automatically generating authorization scripts for data operation permissions according to another embodiment of this application;

[0042] Figure 6 This is a schematic diagram of the structure of an automatic data operation permission authorization script generation device provided in an embodiment of this application;

[0043] Figure 7 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] It should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0046] First, let's analyze some of the terms used in this application:

[0047] A stored procedure is a pre-compiled and stored reusable program in a database, consisting of a set of SQL statements designed to perform a specific function. It can receive parameters, execute specific operations, and return results. Stored procedures are typically used to perform complex calculations, data processing, and business logic tasks. They can improve database performance and security, reduce network overhead, and decrease the coupling between applications and the database.

[0048] Data Manipulation Language (DML) is a language used to manipulate data stored in a database. DML is commonly used to perform insert, update, delete, and query operations on data in database tables. Common DML operations include: Inserting data: inserting new rows into a database table; Updating data: modifying existing rows in a database table; Deleting data: deleting rows from a database table; Querying data: retrieving desired data from a database table.

[0049] Data Control Language (DCL) is a language used to define and manage database access permissions and security. It is primarily used to control user access permissions, execution permissions, and operation permissions for database objects (such as tables, views, stored procedures, etc.).

[0050] Currently, many applications in the core life insurance system rely on database stored procedures. Often, the Java program only provides an entry point, while the majority of the business logic is written into the stored procedure. In Oracle databases, the stored procedure only needs authorization from the user to manipulate the business data tables; no authorization from the application system user is required.

[0051] However, due to various drawbacks of Oracle databases, moving away from Oracle is an industry trend. The first step in this process is to convert stored procedure logic into Java code. Business systems can no longer manipulate business data tables through stored procedures; instead, they need to write stored procedure logic within the business system to perform CRUD operations on these tables. However, since many business data tables are not authorized for use by business system users, the converted code often results in "table or view not found" errors when the business system executes the program. In such cases, developers often need to manually check the business data tables, write authorization scripts, and manually edit database deployment documents—a series of manual processes that are inefficient and costly.

[0052] Based on this, embodiments of this application provide a method, apparatus, electronic device, and computer-readable storage medium for automatically generating authorization scripts for data operation permissions. These methods can automatically generate authorization scripts for relevant data operation permissions on business data tables, improving the efficiency of transferring data operation permissions of business data tables during stored procedure conversion and reducing manpower consumption.

[0053] First, the method for automatically generating authorization scripts for data operation permissions in the embodiments of this application is described:

[0054] The method for automatically generating authorization scripts for data operation permissions provided in this application can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the method for automatically generating authorization scripts for data operation permissions, etc., but is not limited to the above forms.

[0055] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0056] Please see Figure 1 , Figure 1 This illustration shows a flowchart of an automatic data operation permission authorization script generation method provided in an embodiment of this application. Figure 1 As shown, the automatic generation method for the authorization script of the data operation permission includes, but is not limited to, steps S110 to S140.

[0057] Step S110: Obtain the stored procedures of the database used by the business system and the target interfaces corresponding to the stored procedures.

[0058] It is understandable that the business system calls the target interface of the stored procedure to execute the relevant stored procedure. The target interface of the stored procedure includes the package name and the interface name. For example, the target interface of the stored procedure is chk_cashier.get_uncheck_data, where chk_cashier is the package name and get_uncheck_data is the interface name.

[0059] Step S120: Based on the target interface, query all business data tables related to the stored procedure and the user who created each business data table.

[0060] In one specific embodiment, all business data tables involved in the stored procedure are queried through a pre-established tool system based on the target interface of the stored procedure.

[0061] Understandably, this tool system stores the correspondence between stored procedure interfaces and business data tables, as well as the users who created the business data tables. By obtaining the target interface corresponding to the stored procedure, the tool system can retrieve all business data tables related to the stored procedure and the creation user of each business data table based on the correspondence between the stored procedure interface and the business data table, as well as the creation user of each business data table.

[0062] It should be noted that all business data tables related to stored procedures refer to all business data tables accessed in the corresponding database when the stored procedure is executed.

[0063] Step S130: Based on the business data table, perform matching processing in the stored procedure to obtain all data operations performed on each business data table.

[0064] In some embodiments, see Figure 2 , Figure 2 It shows Figure 1 A flowchart illustrating the sub-steps of step S130 is shown below. Figure 2 As shown, the stored procedure contains multiple SQL code strings. The matching process based on the business data table in the stored procedure yields data operations to be performed on the business data table, including but not limited to steps S210 and S220.

[0065] Step S210: Extract all the SQL code strings from the stored procedure.

[0066] Step S220: Based on the business data table, perform matching processing on the SQL code string to determine all data operations performed on each business data table.

[0067] It should be understood that a stored procedure consists of a set of SQL statements. Before performing matching processing based on business data tables in the stored procedure, all the SQL code strings can be extracted from the stored procedure. Since the extracted SQL code strings are complete SQL execution statements, when performing matching processing based on business data tables in the SQL code strings, it is possible to more accurately and easily match all data operations executed on each business data table from the stored procedure.

[0068] In some embodiments, see Figure 3 , Figure 3 It shows Figure 2 A flowchart illustrating the sub-steps of step S220 is shown below. Figure 3 As shown, the process of matching the SQL code string based on the business data table determines all data operations to be performed on each business data table, including but not limited to steps S310, S320, and S330.

[0069] Step S310: Perform string matching on the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string.

[0070] Step S320: Starting from the location information, search backwards in the SQL code string until the data operation keyword is found.

[0071] Step S330: Summarize the data operation keywords obtained from searching all the SQL code strings to determine all data operations performed on each of the business data tables.

[0072] It should be understood that data manipulation keywords are keywords in the Data Manipulation Language (DML), including select, delete, insert, and update, which correspond to the DML operations of querying, deleting, inserting, and updating business data tables, respectively.

[0073] Understandably, after retrieving all the SQL code strings from the stored procedure, for each business data table, string matching is performed between the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string. Since the SQL statement first describes the data operation keywords and then describes the operation object, i.e., the data table, for each position information, the search proceeds backward in the SQL code string until the data operation keywords are found. Finally, the data operation keywords found in all the SQL code strings are summarized to determine all data operations performed on each business data table.

[0074] For example, the above steps retrieve the business data table related to the stored procedure, including `prem_info`. For the `prem_info` business data table, the string "prem_info" is matched against the SQL code string. Each time a matching string is found, its position within the stored procedure's SQL code string is marked. After the scan is complete, the search proceeds backward from the marked positions until the data operation keywords `select`, `delete`, `insert`, and `update` are found. After searching all the marked positions of the `prem_info` business data table and summarizing the retrieved data operation keywords, the data operation permissions granted to the `prem_info` business data table in the business system can be determined. For example, if the data keywords corresponding to the `prem_info` business data table are `select` and `delete` found in all the SQL code strings, it indicates that the stored procedure performs query and delete operations on the `prem_info` business data table. Therefore, users in the business system need to be granted permissions to perform query and delete operations on the `prem_info` business data table.

[0075] Step S140: Generate an SQL authorization script corresponding to each business data table based on the user who created the business data table, the data operation, and the preset data control script template.

[0076] The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

[0077] It should be noted that the data control script template is a script template written based on the Data Control Language (DCL). It mainly includes the grant command used to grant users specific permissions, enabling them to perform specific database operations.

[0078] It should be understood that after obtaining the business data table, the user who created the business data table, and the data operations performed on the business data table, the data control script module automatically generates an SQL authorization script to grant users of the business system the permission to perform data operations on the business data table. By deploying this SQL authorization script in the corresponding database, the data operation permission transfer operation of the business data table during the stored procedure conversion process can be completed, greatly reducing manpower consumption.

[0079] In some embodiments, see Figure 4 , Figure 4 It shows Figure 1 A flowchart illustrating the sub-steps of step S140 is shown below. Figure 4As shown, the step of generating the SQL authorization script corresponding to each business data table based on the creation user of the business data table, the data operation, and the preset data control script template includes, but is not limited to, steps S410 and S420.

[0080] Step S410: Obtain a preset data control script template. The data control script template includes a first fill area, a second fill area, and a third fill area. The first fill area is used to fill in the data operation permissions to be granted, the second fill area is used to fill in the business data table for which permissions are to be granted, and the third fill area is used to fill in the users for whom permissions are to be granted.

[0081] Step S420: For each of the business data tables, fill the data operation into the first fill area, associate the business data table with the user who created the business data table, fill the association result into the second fill area, fill the user of the business system into the third fill area, and generate the SQL authorization script corresponding to the business data table.

[0082] It should be understandable that after obtaining all data operations performed on each business data table, a data control script template including a first fill area, a second fill area, and a third fill area is obtained. For each business data table, the data operations corresponding to the business data table, as well as the created users and users of the business system, are respectively filled into the first fill area, the second fill area, and the third fill area. For example, the data control script template is: "grant ① on ② to ③", where the character position of number ① is the first fill area, used to fill in the data operation permissions to be granted; the character position of number ② is the second fill area, used to fill in the business data table to be granted permissions; and the character position of number ③ is the third fill area, used to fill in the user to be granted permissions. The data operations `select` and `delete` are performed on the business data table `prem_info`, which was created by user `ACCTMAN`. The user to be granted permissions is the business system user `ifpftsopr`. Therefore, the `select` and `delete` operations are filled into the first fill area containing number ①. The business data table `prem_info` and the creating user `ACCTMAN` are joined to obtain the join result `ACCTMAN.prem_info`. The join result `ACCTMAN.prem_info` is then filled into the second fill area containing number ②. The business system user `ifpftsopr` is filled into the third fill area containing number ③. This generates the SQL authorization script corresponding to the business data table `prem_info`: "grant select,delete on". The SQL authorization script "ACCTMAN.prem_info to ifpftsopr" grants query and delete permissions for the business data table prem_info, created by user ACCTMAN, to the business system user ifpftsopr.

[0083] In some embodiments, see Figure 5 , Figure 5 This illustration shows a flowchart of an automatic data operation permission authorization script generation method provided in an embodiment of this application. Figure 5 As shown, after generating the SQL authorization script corresponding to each business data table based on the creation user of the business data table, the data operation, and the preset data control script template, the method further includes step S510.

[0084] Step S510: Generate a script deployment document, which includes the SQL authorization script to be deployed and the correspondence between the SQL authorization script and the database and the users of the business system.

[0085] Understandably, after generating the SQL authorization scripts for each business data table, a script deployment document is generated. This document contains the SQL authorization scripts that need to be deployed, as well as the correspondence between the SQL authorization scripts and the users in the database and business system. By reviewing this document, developers can clearly understand which SQL authorization scripts need to be deployed, the databases that will execute the SQL authorization scripts, and the users used to execute them. This document can guide database system administrators to quickly deploy scripts, further improving the efficiency of transferring data operation permissions for business data tables during stored procedure conversion.

[0086] In some embodiments, such as Figure 5 As shown, after generating the SQL authorization script corresponding to each business data table based on the creation user of the business data table, the data operation, and the preset data control script template, the method further includes step S520.

[0087] Step S520: By calling the interface of the preset development quality management platform, a security audit is performed on the SQL authorization scripts corresponding to all the business data tables to obtain the security audit results.

[0088] Understandably, after generating the SQL authorization script for each business data table, a pre-defined interface of the development quality management platform is called to perform a security audit on all SQL authorization scripts, ensuring their compliance and database security. This security audit of the SQL authorization scripts may include code compliance, SQL injection detection, and data filtering checks.

[0089] In some embodiments, such as Figure 5 As shown, the method further includes steps S530 and S540.

[0090] Step S530: Package all the SQL authorization scripts, the script deployment documents, and the security audit results into a package and send the packaged result to the approver for script approval.

[0091] Step S540: If the approval result indicates that the approval has been passed, the packaged result and the approval result are sent to the system administrator of the database management system.

[0092] Understandably, all SQL authorization scripts, script deployment documents, and security audit results are packaged together and sent to approvers for script approval. Only when the approval result indicates that the scripts have passed can the packaged results and the approval result be sent to the system administrator of the database management system. This automates the transfer of data operation permissions for business data tables during the stored procedure conversion process. After receiving the packaged results and the approval result, the system administrator can start deploying the SQL authorization scripts according to the project requirements, saving manpower in transferring data operation permissions.

[0093] This application proposes a method for automatically generating authorization scripts for data operation permissions. The method includes obtaining the stored procedures of the database used by the business system and the target interface corresponding to the stored procedures; then, querying all business data tables related to the stored procedures and the users who created each business data table based on the target interface; next, performing matching processing within the stored procedures based on the business data tables to obtain all data operations to be performed on each business data table; and finally, generating an SQL authorization script corresponding to each business data table based on the users who created the business data tables, the data operations, and a preset data control script template. This SQL authorization script is used to grant users of the business system permissions to perform data operations on the business data tables. This embodiment of the application obtains all business data tables related to the stored procedures by querying the target interface of the stored procedures, thereby using the business data tables to perform matching processing within the stored procedures to obtain all data operations to be performed on each business data table. Finally, based on a preset data control script template, it automatically generates authorization scripts to grant users of the business system permissions to perform relevant data operations on the business data tables. This method can automatically generate authorization scripts for relevant data operation permissions on business data tables, improving the efficiency of transferring data operation permissions of business data tables during stored procedure conversion and reducing manpower consumption.

[0094] Please see Figure 6 This application embodiment also provides an automatic data operation permission authorization script generation device 100, which includes:

[0095] The first acquisition module 110 is used to acquire the stored procedures of the database used by the business system and the target interface corresponding to the stored procedures;

[0096] The query module 120 is used to query all business data tables related to the stored procedure and the user who created each business data table based on the target interface;

[0097] Matching module 130 is used to perform matching processing in the stored procedure based on the business data table to obtain all data operations performed on each business data table;

[0098] The script generation module 140 is used to generate an SQL authorization script for each business data table based on the user who created the business data table, the data operation, and a preset data control script template.

[0099] The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

[0100] This application proposes an automatic data operation permission authorization script generation device. The device obtains the stored procedures of the database used by the business system and the corresponding target interfaces of the stored procedures through a first acquisition module. Then, a query module queries based on the target interfaces to obtain all business data tables related to the stored procedures and the users who created each business data table. Next, a matching module performs matching processing based on the business data tables within the stored procedures to obtain all data operations to be performed on each business data table. Finally, a script generation module generates an SQL authorization script corresponding to each business data table based on the users who created the business data tables, the data operations, and a preset data control script template. This SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data tables. This embodiment of the application obtains all business data tables related to the stored procedures by querying the target interfaces of the stored procedures, thereby using the business data tables to perform matching processing within the stored procedures to obtain all data operations to be performed on each business data table. Finally, based on a preset data control script template, it automatically generates authorization scripts to grant users of the business system the permission to perform relevant data operations on the business data tables. This automatically generates authorization scripts for relevant data operation permissions on business data tables, improving the efficiency of transferring data operation permissions of business data tables during stored procedure conversion and reducing manpower consumption.

[0101] In some embodiments, the matching module 130 includes:

[0102] The extraction module is used to extract all the SQL code strings from the stored procedure;

[0103] The first sub-matching module is used to perform matching processing on the SQL code string based on the business data table to determine all data operations performed on each of the business data tables.

[0104] In some embodiments, the first sub-matching module includes:

[0105] The second sub-matching module is used to perform string matching on the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string;

[0106] The search module is used to search forward in the SQL code string starting from the location information until the data operation keyword is found.

[0107] The summary module is used to summarize the data operation keywords obtained by searching in all the SQL code strings, and to determine all data operations performed on each of the business data tables.

[0108] In some embodiments, the script generation module 140 includes:

[0109] The second acquisition module is used to acquire a preset data control script template. The data control script template includes a first fill area, a second fill area, and a third fill area. The first fill area is used to fill in the data operation permissions to be granted, the second fill area is used to fill in the business data table for the permissions to be granted, and the third fill area is used to fill in the users for the permissions to be granted.

[0110] The data entry module is used to, for each of the business data tables, fill the data operation into the first fill area, associate the business data table with the user who created the business data table and fill the association result into the second fill area, fill the user of the business system into the third fill area, and generate the SQL authorization script corresponding to the business data table.

[0111] In some embodiments, the automatic generation device 100 for data operation permission authorization scripts further includes:

[0112] The deployment document generation module is used to generate script deployment documents, which include the SQL authorization script to be deployed and the correspondence between the SQL authorization script and the database and the users of the business system.

[0113] In some embodiments, the automatic generation device 100 for data operation permission authorization scripts further includes:

[0114] The security audit module is used to perform security audits on the SQL authorization scripts corresponding to all the business data tables by calling the interface of the preset development quality management platform, and obtain the security audit results.

[0115] In some embodiments, the automatic generation device 100 for data operation permission authorization scripts further includes:

[0116] The packaging module is used to package all the SQL authorization scripts, the script deployment documents and the security audit results, and send the packaging results to the approvers for script approval.

[0117] The sending module is used to send the packaged result and the approval result to the system administrator of the database management system when the approval result indicates that the approval has been passed.

[0118] It should be noted that the information interaction and execution process between the modules of the above-mentioned device are based on the same concept as the method embodiment of this application. For details on their specific functions and technical effects, please refer to the method embodiment section, and they will not be repeated here.

[0119] Please see Figure 7 , Figure 7 This application illustrates the hardware structure of an electronic device according to an embodiment of the present application. The electronic device includes:

[0120] The processor 210 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant computer programs to implement the technical solutions provided in the embodiments of this application.

[0121] The memory 220 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 220 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 220, and the processor 210 calls the automatic generation method for the authorization script of data operation permissions in the embodiments of this application.

[0122] Input / output interface 230 is used to implement information input and output;

[0123] The communication interface 240 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); and the bus 250 is used to transmit information between each component of the device (such as processor 210, memory 220, input / output interface 230 and communication interface 240).

[0124] The processor 210, memory 220, input / output interface 230 and communication interface 240 are connected to each other within the device via bus 250.

[0125] This application also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more computer programs, which can be executed by one or more processors to implement the above-mentioned method for automatically generating authorization scripts for data operation permissions.

[0126] Memory, as a computer-readable storage medium, can be used to store software programs and computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0127] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0128] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0130] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0131] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0132] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0134] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] Furthermore, the functional units in each embodiment of this application can be integrated into a single processing unit, or each unit can exist independently, or two or more units can be integrated into a single unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0136] If the assembled units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of each embodiment of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for automatically generating authorization scripts for data operation permissions, characterized in that, The method includes: Obtain the stored procedures of the database used by the business system and the target interfaces corresponding to the stored procedures. The stored procedures contain multiple SQL code strings. Based on the target interface, all business data tables related to the stored procedure and the user who created each business data table are obtained through querying. All the SQL code strings are extracted from the stored procedure; Perform string matching on the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string; The search continues forward within the SQL code string, starting from the location information, until the data manipulation keyword is found. Summarize the data operation keywords obtained from searching all the SQL code strings to determine all data operations to be performed on each of the business data tables; Obtain a preset data control script template, which includes a first fill area, a second fill area, and a third fill area. The first fill area is used to fill in the data operation permissions to be granted, the second fill area is used to fill in the business data table for which permissions are to be granted, and the third fill area is used to fill in the user for whom permissions are to be granted. For each of the business data tables, the data operation is filled into the first fill area, the business data table and the user who created the business data table are associated, and the association result is filled into the second fill area, the user of the business system is filled into the third fill area, and the SQL authorization script corresponding to the business data table is generated. The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

2. The method according to claim 1, characterized in that, After generating the SQL authorization script corresponding to each business data table based on the creation user, the data operation, and the preset data control script template, the method further includes: Generate a script deployment document, which includes the SQL authorization script to be deployed and the correspondence between the SQL authorization script and the database and the users of the business system.

3. The method according to claim 2, characterized in that, After generating the SQL authorization script corresponding to each business data table based on the creation user, the data operation, and the preset data control script template, the method further includes: By calling the interface of the preset development quality management platform, the security audit results are obtained by performing security audits on the SQL authorization scripts corresponding to all the business data tables.

4. The method according to claim 3, characterized in that, The method further includes: Package all the SQL authorization scripts, the script deployment documents, and the security audit results into a single package and send the packaged result to the approver for script approval. If the approval result indicates that the approval has been passed, the packaged result and the approval result are sent to the system administrator of the database management system.

5. A device for automatically generating authorization scripts for data operation permissions, characterized in that, The device includes: The first acquisition module is used to acquire the stored procedures of the database used by the business system and the target interfaces corresponding to the stored procedures; The query module is used to query all business data tables related to the stored procedure and the user who created each business data table based on the target interface. The stored procedure contains multiple SQL code strings. The matching module is used to extract all the SQL code strings from the stored procedure; String matching is performed on the business data table and the SQL code string to obtain the position information of the business data table in each SQL code string; starting from the position information, a forward search is performed in the SQL code string until a data operation keyword is found; the data operation keywords found in all SQL code strings are summarized to determine all data operations performed on each business data table. The script generation module is used to obtain a preset data control script template. The data control script template includes a first fill area, a second fill area, and a third fill area. The first fill area is used to fill in the data operation permissions to be granted, the second fill area is used to fill in the business data table for which permissions are to be granted, and the third fill area is used to fill in the user for whom permissions are to be granted. For each business data table, the data operation is filled in the first fill area, the business data table and the user who created the business data table are associated, and the association result is filled in the second fill area. The user of the business system is filled in the third fill area, and the SQL authorization script corresponding to the business data table is generated. The SQL authorization script is used to grant users of the business system the permission to perform data operations on the business data table.

6. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 4.

Images