Access control methods and business processing methods

Abstract

This application relates to an access control method and a business processing method, which can be applied to various scenarios such as intelligent transportation. The access control method includes: receiving an access request from a computing engine, the request carrying user information; if fine-grained permissions exist in the user's corresponding user access information, generating a proxy access credential to allow access to the data storage path corresponding to the fine-grained permissions; verifying the permissions to be verified corresponding to the access request based on the user access information and the proxy access credential; if the permission verification passes, feeding back the proxy access credential to the computing engine, enabling the computing engine to retrieve data on the storage path matching the access request based on the proxy access credential. This method enables the retrieval of data on the storage path, solves the problem of separating table permissions and path permissions, and improves data security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an access control method and a business processing method. Background Technology

[0002] With the development of computer technology, computing engines have emerged. Computing engines provide distributed computing capabilities, enabling them to retrieve data stored in distributed storage systems and distribute computational tasks across different computing nodes. In big data scenarios using computing engines, access control is often necessary to ensure data security.

[0003] In traditional technologies, access control in big data scenarios includes table access management, fine-grained access management (including row-level and column-level access management), and access management of the storage path where table data resides. For fine-grained access management, the common approach is to grant partial authorization at the table level (including authorization for some rows and some columns).

[0004] However, in big data scenarios, user table permissions and the corresponding storage path permissions are usually separate. If only partial authorization is granted at the table level, the computing engine cannot access the data on the storage path. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product capable of implementing access control for data on a storage path, as well as a business processing method, apparatus, computer device, computer-readable storage medium, and computer program product capable of implementing access control for data on a storage path, in response to the aforementioned technical problems.

[0006] Firstly, this application provides an access control method. The method includes:

[0007] Receive permission requests from the computing engine, and the permission requests carry user information;

[0008] If the user information contains fine-grained permissions, a proxy access credential is generated, enabling access to the data storage path corresponding to the fine-grained permissions.

[0009] Based on user permission information and proxy access credentials, the permissions to be verified corresponding to the permission acquisition request are verified. If the permission verification is successful, the proxy access credentials are fed back to the computing engine, so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0010] Secondly, this application also provides an access control device. The device includes:

[0011] The request receiving module is used to receive permission acquisition requests from the computing engine. The permission acquisition requests carry user information.

[0012] The authorization module is used to generate proxy access credentials if there are fine-grained permissions in the user permission information corresponding to the user information, so that the data storage path corresponding to the fine-grained permissions can be accessed.

[0013] The authentication module is used to verify the permissions to be verified corresponding to the permission acquisition request based on the user's permission information and the proxy access credentials. If the permission verification is successful, the proxy access credentials are sent back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0014] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0015] Receive permission requests from the computing engine, and the permission requests carry user information;

[0016] If the user information contains fine-grained permissions, a proxy access credential is generated, enabling access to the data storage path corresponding to the fine-grained permissions.

[0017] Based on user permission information and proxy access credentials, the permissions to be verified corresponding to the permission acquisition request are verified. If the permission verification is successful, the proxy access credentials are fed back to the computing engine, so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0018] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0019] Receive permission requests from the computing engine, and the permission requests carry user information;

[0020] If the user information contains fine-grained permissions, a proxy access credential is generated, enabling access to the data storage path corresponding to the fine-grained permissions.

[0021] Based on user permission information and proxy access credentials, the permissions to be verified corresponding to the permission acquisition request are verified. If the permission verification is successful, the proxy access credentials are fed back to the computing engine, so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0022] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0023] Receive permission requests from the computing engine, and the permission requests carry user information;

[0024] If the user information contains fine-grained permissions, a proxy access credential is generated, enabling access to the data storage path corresponding to the fine-grained permissions.

[0025] Based on user permission information and proxy access credentials, the permissions to be verified corresponding to the permission acquisition request are verified. If the permission verification is successful, the proxy access credentials are fed back to the computing engine, so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0026] Sixthly, this application provides a business processing method. The method includes:

[0027] When a user's business processing request is received, an authorization request is sent to the server based on the business processing request, and the authorization request carries user information.

[0028] Receive the authorization verification response from the server, which includes the proxy access credentials;

[0029] If the server verifies the permission to be verified for the permission request based on the permission verification response, it retrieves the data on the storage path that matches the permission request based on the proxy access credentials.

[0030] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0031] Seventhly, this application also provides a business processing apparatus. The apparatus includes:

[0032] The request sending module is used to send an authorization request to the server based on the user's business processing request when it receives the business processing request. The authorization request carries user information.

[0033] The response receiving module is used to receive the permission verification response from the server. The permission verification response includes proxy access credentials.

[0034] The data acquisition module is used to determine, based on the permission verification response, that the server has successfully verified the permission to be verified corresponding to the permission acquisition request, and to acquire the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0035] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0036] Eighthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0037] When a user's business processing request is received, an authorization request is sent to the server based on the business processing request, and the authorization request carries user information.

[0038] Receive the authorization verification response from the server, which includes the proxy access credentials;

[0039] If the server verifies the permission to be verified for the permission request based on the permission verification response, it retrieves the data on the storage path that matches the permission request based on the proxy access credentials.

[0040] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0041] Ninthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0042] When a user's business processing request is received, an authorization request is sent to the server based on the business processing request, and the authorization request carries user information.

[0043] Receive the authorization verification response from the server, which includes the proxy access credentials;

[0044] If the server verifies the permission to be verified for the permission request based on the permission verification response, it retrieves the data on the storage path that matches the permission request based on the proxy access credentials.

[0045] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0046] Tenthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0047] When a user's business processing request is received, an authorization request is sent to the server based on the business processing request, and the authorization request carries user information.

[0048] Receive the authorization verification response from the server, which includes the proxy access credentials;

[0049] If the server verifies the permission to be verified for the permission request based on the permission verification response, it retrieves the data on the storage path that matches the permission request based on the proxy access credentials.

[0050] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0051] The aforementioned access control method, apparatus, computer equipment, storage medium, and computer program product, upon receiving an access request from the computing engine, if fine-grained permissions exist in the user access information corresponding to the user information, generate a proxy access credential, enabling access to the data storage path corresponding to the fine-grained permissions. Then, the user access information and the proxy access credential can be used to verify the permissions to be verified corresponding to the access request. If the permission verification passes, the proxy access credential is fed back to the computing engine, allowing the computing engine to obtain data on the storage path matching the access request based on the proxy access credential, thus solving the problem of separating table permissions and path permissions.

[0052] The aforementioned business processing method, apparatus, computer equipment, storage medium, and computer program product, upon receiving a user's business processing request, send a permission acquisition request carrying user information to the server based on the business processing request. This enables the server to generate a proxy access credential when fine-grained permissions exist in the user's permission information corresponding to the user information. This allows the user to access the data storage path corresponding to the fine-grained permissions. Furthermore, the server verifies the permissions to be verified corresponding to the permission acquisition request using the user permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine, enabling the computing engine to obtain the data on the storage path matching the permission acquisition request based on the proxy access credential. This solves the problem of separating table permissions and path permissions. Attached Figure Description

[0053] Figure 1 This is a diagram illustrating the application environment of the access control method in one embodiment;

[0054] Figure 2 This is a diagram illustrating the application environment of the access control method in another embodiment;

[0055] Figure 3 This is a flowchart illustrating the access control method in one embodiment;

[0056] Figure 4 This is a flowchart illustrating the access control method in yet another embodiment;

[0057] Figure 5 This is a flowchart illustrating a business processing method in one embodiment;

[0058] Figure 6 This is a diagram illustrating an application scenario of the access control method in one embodiment.

[0059] Figure 7 This is an overall architecture diagram of the access control method in one embodiment;

[0060] Figure 8 This is a flowchart illustrating the application of the access control method in the Spark computing engine (a fast and general-purpose computing engine designed for large-scale data processing) in one embodiment.

[0061] Figure 9 This is a structural block diagram of the access control device in one embodiment;

[0062] Figure 10 This is a structural block diagram of a service processing device in one embodiment;

[0063] Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. The embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0065] The access control method provided in this application can be applied to, for example, Figure 1In the application environment shown, terminal 102, equipped with a computing engine, communicates with server 104 via a network. A data storage system stores the data that server 104 needs to process. This data storage system can be integrated onto server 104 or located in the cloud or on another server. Server 104 receives permission requests from terminal 102, which carry user information. If fine-grained permissions exist in the user's permission information, a proxy access credential is generated, allowing access to the data storage path corresponding to the fine-grained permissions. Based on the user's permission information and the proxy access credential, the server verifies the permissions to be verified corresponding to the permission request. If the permission verification passes, the server sends the proxy access credential back to terminal 102, enabling terminal 102 to access the data on the storage path matching the permission request. Among them, server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, a node on the blockchain, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0066] The access control method provided in this application can be applied to, for example, Figure 2 In the application environment shown, the server includes a first process 202 with a computing engine deployed and a second process 204 for permission verification. The first process 202 with the computing engine deployed communicates with the second process 204 for permission verification. The second process 204 receives a permission acquisition request from the first process 202 with the computing engine deployed. The permission acquisition request carries user information. If the user permission information corresponding to the user information contains fine-grained permissions, a proxy access credential is generated, allowing access to the data storage path corresponding to the fine-grained permissions. Based on the user permission information and the proxy access credential, the permission to be verified corresponding to the permission acquisition request is verified. If the permission verification is successful, the proxy access credential is fed back to the first process 202 with the computing engine deployed, so that the first process 202 with the computing engine deployed can obtain the data on the storage path matching the permission acquisition request based on the proxy access credential.

[0067] In one embodiment, such as Figure 3 As shown, an access control method is provided, which can be applied to... Figure 1 Taking server 104 as an example, it can be understood that this method can also be applied to... Figure 2 The second process 204 used for permission verification includes the following steps:

[0068] Step 302: Receive the permission acquisition request from the computing engine. The permission acquisition request carries user information.

[0069] The computing engine provides distributed computing capabilities, enabling it to retrieve data stored in distributed storage systems and distribute computational tasks across different computing nodes. In big data scenarios using computing engines, access control is often necessary to ensure data security. Common computing engines include Flink (a framework and distributed processing engine), Impala (a query system), Presto (a data query engine), and Spark. Big data refers to data sets that cannot be captured, managed, and processed within a certain timeframe using conventional software tools. It represents massive, rapidly growing, and diverse information assets that require new processing models to achieve stronger decision-making, insight discovery, and process optimization capabilities. With the advent of the cloud era, big data has attracted increasing attention. Big data requires specialized technologies to effectively process large amounts of data within a tolerable timeframe. Technologies suitable for big data include massively parallel processing databases, data mining, distributed file systems, distributed databases, cloud computing platforms, the internet, and scalable storage systems.

[0070] In this context, a permission acquisition request refers to a request to obtain data permissions for data processing. For example, a permission acquisition request can be a response request generated based on a user's business processing request. For instance, a permission acquisition request can be a response request generated based on a user's SQL (Structured Query Language) request. User information refers to information that identifies a user. For example, user information can be a user identifier.

[0071] Specifically, in big data scenarios, if business processing is required, users will send business processing requests to the computing engine. After receiving the business processing request, the computing engine will generate an permission acquisition request carrying user information based on the business processing request and send the permission acquisition request to the server.

[0072] Step 304: If fine-grained permissions exist in the user permission information corresponding to the user information, generate a proxy access credential to enable access to the data storage path corresponding to the fine-grained permissions.

[0073] User permission information records the table-level permissions a user has been granted, including table permissions and fine-grained permissions. Table permissions grant access to the entire table in the database. Fine-grained permissions grant access to specific data within a table, including row-level and column-level permissions. For example, fine-grained permissions might grant access to only certain columns in a table. Or, they might grant access to only certain rows within certain columns of a table.

[0074] Here, the data storage path refers to the path where data corresponding to fine-grained permissions is stored. It should be noted that in big data scenarios, user table permissions and the corresponding storage path permissions are usually separate. The inventors believe that in this big data scenario, to achieve row- and column-level permission control, table permission control and storage path permission control need to be considered together. Otherwise, if only partial column authorization is performed at the table level, the computing engine will still be unable to read the data on the storage path.

[0075] In this context, the proxy access credential is the credentials for accessing the data storage path corresponding to fine-grained permissions, used to declare temporarily granted path permissions. For example, the proxy access credential may specifically include verification information for accessing the data storage path corresponding to the fine-grained permissions.

[0076] Specifically, upon receiving a permission request, the server reads the corresponding user permission information based on the user information carried in the request. It then determines whether fine-grained permissions exist based on this information. If fine-grained permissions exist, the server retrieves the data storage path corresponding to those permissions, grants temporary authorization to that path, and generates a proxy access credential, allowing access to the data storage path associated with the fine-grained permissions. If no fine-grained permissions exist, no temporary authorization is required, and an empty proxy access credential is generated.

[0077] Step 306: Verify the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credentials. If the permission verification is successful, send the proxy access credentials back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0078] Here, the permissions to be verified refer to the permissions required by the user. For example, the permissions to be verified could specifically refer to operations on data tables in the metadata database, including read, write, delete, and structure modification operations. Furthermore, when the server connects to multiple metadata databases, namespaces can be set to distinguish different data sources. For instance, the permissions to be verified could specifically refer to read, write, delete, and structure modification operations on table C in namespace A-database B.

[0079] Specifically, after generating the proxy access credential, the server parses the permission acquisition request to obtain the corresponding permissions to be verified. Based on the user's permission information and the proxy access credential, the server verifies the permissions to be verified corresponding to the permission acquisition request to determine whether the user's required permissions are compliant. If the permission verification passes, the server sends the proxy access credential back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credential.

[0080] In a specific application, if the permission verification fails, the server will send a verification failure message to the computing engine, causing the computing engine to terminate the current operation.

[0081] In one specific application, if authorization verification is successful, the server only needs to send the proxy access credentials to the computing engine. If the computing engine receives the proxy access credentials, it means that authorization verification has passed. In another specific application, in addition to the proxy access credentials, the server will also send a successful verification message to the computing engine, instructing the computing engine to retrieve the data from the storage path that matches the authorization request based on the proxy access credentials.

[0082] The aforementioned access control method, upon receiving an access request from the computing engine, generates a proxy access credential if the user's access information contains fine-grained permissions. This allows access to the data storage path corresponding to the fine-grained permissions. The user's access information and the proxy access credential are then used to verify the permissions to be verified in the access request. If the verification passes, the proxy access credential is sent back to the computing engine, enabling the engine to access the data on the storage path matching the access request. This solves the problem of separating table permissions and path permissions.

[0083] In one embodiment, if the user permission information corresponding to the user information contains fine-grained permissions, generating proxy access credentials includes:

[0084] Read the corresponding user permission information based on the user information;

[0085] If it is determined that a user has fine-grained permissions based on user permission information, the corresponding data storage path is determined based on the fine-grained permissions;

[0086] Grant temporary authorization to the data storage path, obtain temporary authorization information, and generate proxy access credentials based on the temporary authorization information.

[0087] Temporary authorization refers to temporarily granting path permissions for the data storage path corresponding to fine-grained permissions. Temporary authorization information is used to describe the path permissions that are temporarily granted.

[0088] Specifically, the server reads the corresponding user permission information from the permission database based on the user information. The user permission information includes the table-level permissions that the user has. If it is determined from the user permission information that the user has fine-grained permissions, the server will obtain the metadata of the metadata database based on the fine-grained permissions, determine the corresponding data storage path through the metadata, grant temporary authorization to the data storage path, obtain temporary authorization information, and generate proxy access credentials based on the temporary authorization information.

[0089] The permission database stores user permission information, which includes user information and table permissions. The user information section records users and their respective groups; authorization can typically be granted by user or by group. The table permissions section includes metadata operation permissions for tables, such as adding partitions, column operations, and row operations. Metadata, in big data scenarios, describes the metadata of tables in the data warehouse. Table metadata includes descriptions of the table itself, specifically including the creator, physical storage path, business purpose, and the business meaning of fields.

[0090] In this embodiment, by reading the corresponding user permission information based on user information, it is possible to determine whether the user has fine-grained permissions. If the user has fine-grained permissions, the corresponding data storage path is determined based on the fine-grained permissions, and temporary authorization is granted to the data storage path to obtain temporary authorization information. Then, a proxy access credential is generated based on the temporary authorization information.

[0091] In one embodiment, fine-grained permissions include at least one of partial row permissions and partial column permissions, and generating proxy access credentials based on temporary authorization information includes:

[0092] A mask matrix is ​​generated based on partial row permissions and / or partial column permissions. The mask matrix is ​​used to instruct the calculation engine to hide data that the user does not have permission to access.

[0093] Generate proxy access credentials based on temporary authorization information and a mask matrix.

[0094] The mask matrix is ​​a matrix used to hide data that the user does not have permission to access. In the mask matrix, data that the user has permission to access is labeled with one identifier, and data that the user does not have permission to access is labeled with another identifier.

[0095] For example, when data that a user has permission to access is labeled with the number 1, and data that a user does not have permission to access is labeled with the number 0, the mask matrix can be in the form shown in Table 1. In Table 1, the data that a user does not have permission to access is the data in the second row of the first column, the first row of the second column, the third row of the second column, the first row of the third column, and the second row of the third column. The data in the remaining rows and columns are the data that a user has permission to access.

[0096] Table 1

[0097] Line 1 1 0 0 1 Line 2 0 1 0 1 Line 3 1 0 1 1

[0098] Specifically, when fine-grained permissions include partial row permissions, it means the user only has permission for data under certain rows. When fine-grained permissions include partial column permissions, it means the user only has permission for data under certain columns. When fine-grained permissions include both partial row and partial column permissions, it means the user only has permission for some rows of data under certain columns. For different situations, the server will determine the data that the user has permission for and the data that the user does not have permission for based on the partial row and / or partial column permissions in the fine-grained permissions. Based on the positions of the data that the user has permission for and the data that the user does not have permission for in the table, a mask matrix is ​​generated. Based on the temporary authorization information and the mask matrix, a proxy access credential is generated to instruct the computing engine to hide the data that the user does not have permission for when outputting data.

[0099] In this embodiment, when fine-grained permissions include at least one of partial row permissions and / or partial column permissions, a mask matrix is ​​generated based on the partial row permissions and / or partial column permissions. This allows the computing engine to hide data that the user does not have permission for, thereby enabling data permission control and ensuring data security and privacy.

[0100] In one embodiment, the access control method further includes:

[0101] The permission acquisition request is parsed to determine the target namespace that matches the permission acquisition request, as well as the target database, target data table, and target operation in the target namespace. The target database includes the target data table, and the target operation is the operation performed on the target data table.

[0102] Based on the target namespace, target database, target data table, and target operation, obtain the permissions to be verified corresponding to the permission acquisition request.

[0103] Namespaces are used to differentiate between different data sources. For example, namespaces can be used to distinguish between different metadata databases, allowing the server to connect to different metadata databases. Furthermore, the different metadata databases that the server connects to can be heterogeneous, such as supporting Hive (a data warehouse tool), MetaStore (metadata storage), MySQL (a relational database management system), etc., as long as the metadata database conforms to the JDBC (Java Database Connectivity) specification.

[0104] Here, the target namespace refers to the namespace containing the database corresponding to the permission acquisition request. The target database refers to the database within the target namespace that corresponds to the permission acquisition request and requires data operations. The target database includes at least one table, and the target table refers to the table within the target database that corresponds to the permission acquisition request and requires data operations. The target operation refers to the operation performed on the target table. For example, a target operation may specifically include read operations, write operations, delete operations, and structure modification operations.

[0105] Specifically, the server parses the permission acquisition request, determines the target namespace that matches the permission acquisition request, routes to the correct metadata storage based on the target namespace, retrieves the corresponding metadata, and thus determines the target database, target data table, and target operation in the target namespace. By combining the target namespace, target database, target data table, and target operation, the permissions to be verified corresponding to the permission acquisition request can be obtained.

[0106] In a specific application, the format of the permission to be verified can be: target operation on namespace-database-table. For example, depending on the different permissions to be verified, the permissions to be verified can be in the following three formats: one is read operation, write operation, delete operation, and structure change operation on namespace-database-table; the second is read operation on namespace-database-table-partial column; and the third is read operation on namespace-database-table-partial column-partial row.

[0107] In this embodiment, by parsing the permission acquisition request, the target namespace, target database, target data table, and target operation within the target namespace that match the permission acquisition request are determined. Based on the target namespace, target database, target data table, and target operation, the permissions to be verified corresponding to the permission acquisition request can be obtained, thus achieving accurate parsing.

[0108] Furthermore, the inventors believe that in this embodiment, different metadata databases are integrated together through namespaces to provide unified external services. From the perspective of the computing engine, it is a single metadata database, which solves the problem of cross-source access control and achieves cross-source resolution.

[0109] In one embodiment, verifying the permissions to be verified corresponding to the permission acquisition request based on user permission information and proxy access credentials includes:

[0110] Based on the proxy access credentials and user permission information, determine the scope of user authorization;

[0111] The scope of user authorization is compared with the permissions to be verified in order to perform permission verification.

[0112] The scope of user authorization refers to the scope of permissions that have been granted to the user.

[0113] Specifically, the proxy access credentials declare the user's temporary path permissions, and the user's permission information includes the user's table-level permissions. Based on the proxy access credentials and user permission information, the server can determine the user's authorized scope, which is the union of temporary path permissions and table-level permissions. After determining the user's authorized scope, the server compares it with the permissions to be verified to perform permission verification. If the permission to be verified falls within the user's authorized scope, the permission verification passes; otherwise, the permission verification fails.

[0114] For example, the permissions to be verified require authorization. Assume the scope of the permissions to be verified is A. Within the user's authorized scope, the records where the user has full operation permissions on the table are represented by B1 (where "full" means readable, writable, and modifiable); the records where the user only has read permissions are represented by B2 (the storage path corresponding to this part of the table in the permission database may not have permissions, requiring temporary authorization of the storage path in the proxy access credentials); and the records where the user only has read permissions on some columns and some rows are represented by B3 (the storage path corresponding to the table in the permission database does not have permissions, requiring temporary authorization of the storage path in the proxy access credentials). If A is less than B1 + B2 + B3 (i.e., the union of B1, B2, and B3), then the verification passes; otherwise, it fails. The partial records B2 and B3 are written in the proxy access credentials and are temporarily generated.

[0115] The inventors believe that permanently writing storage path permissions to the permission database poses a risk of bypassing the computing engine's permission verification process, allowing direct access to the storage system and the theft of underlying data, potentially leading to data breaches and other security vulnerabilities. This application addresses this by granting temporary authorization for storage path permissions, with the corresponding proxy access credentials destroyed after the computing engine's current execution, thus ensuring data security. Furthermore, the permission control method of this application can be implemented using session technology; the proxy access credentials are stored in the session, can be directly retrieved, and are destroyed after the session ends.

[0116] In this embodiment, by determining the scope of user authorization based on proxy access credentials and user permission information, permission verification can be achieved by comparing the scope of user authorization with the permissions to be verified.

[0117] In one embodiment, the access control method further includes:

[0118] If the user permission information corresponding to the user information does not contain fine-grained permissions, an empty proxy access credential is generated, and the process proceeds to the step of verifying the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential.

[0119] Specifically, upon receiving a permission acquisition request, the server reads the corresponding user permission information based on the user information carried in the permission acquisition request. It then determines whether fine-grained permissions exist based on the user permission information. If no fine-grained permissions exist in the user permission information, the server generates an empty proxy access credential and proceeds to the step of verifying the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential, thereby achieving permission verification.

[0120] In this embodiment, when there are no fine-grained permissions in the user permission information corresponding to the user information, an empty proxy access credential is generated. This enables the generation of the proxy access credential, and permission verification can be performed based on the proxy access credential and user permission information to achieve permission control.

[0121] In one embodiment, such as Figure 4 As shown in the diagram, the access control method of this application is illustrated through a flowchart. The access control method specifically includes the following steps:

[0122] Step 402: Receive the permission acquisition request from the computing engine. The permission acquisition request carries user information.

[0123] Step 404: Read the corresponding user permission information based on the user information;

[0124] Step 406: If it is determined that the user has fine-grained permissions based on the user permission information, determine the corresponding data storage path based on the fine-grained permissions;

[0125] Step 408: Grant temporary authorization to the data storage path, obtain temporary authorization information, and generate proxy access credentials based on the temporary authorization information;

[0126] Step 410: Parse the permission acquisition request, determine the target namespace that matches the permission acquisition request, as well as the target database, target data table and target operation in the target namespace. The target database includes the target data table, and the target operation is the operation performed on the target data table.

[0127] Step 412: Based on the target namespace, target database, target data table, and target operation, obtain the permissions to be verified corresponding to the permission acquisition request;

[0128] Step 414: Determine the scope of user authorization based on proxy access credentials and user permission information;

[0129] Step 416: Compare the user's authorized scope with the permissions to be verified to perform permission verification;

[0130] Step 418: If the permission verification is successful, the proxy access credentials are sent back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0131] In one embodiment, such as Figure 5 As shown, a business processing method is provided, which is applied to... Figure 1 Taking terminal 102, which has a computing engine deployed in the example, as an example, it can be understood that this method can also be applied to... Figure 2 The first process 202, which deploys the computing engine, includes the following steps:

[0132] Step 502: When a user's business processing request is received, an authorization request is sent to the server based on the business processing request. The authorization request carries user information.

[0133] Step 504: Receive the permission verification response from the server. The permission verification response includes the proxy access credentials.

[0134] Step 506: If, based on the permission verification response, it is determined that the server has successfully verified the permission to be verified corresponding to the permission acquisition request, then the data on the storage path that matches the permission acquisition request is retrieved based on the proxy access credentials.

[0135] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0136] Specifically, in big data scenarios, if business processing is required, users send business processing requests to terminals deployed with computing engines. Upon receiving these requests, the terminals send permission requests to the server, carrying user information. These business processing requests refer to requests for data processing based on business logic. For example, a business processing request could be a read request to a table in a database. Or, it could be a read request to select specific columns in a database table. For instance, a business processing request could be an SQL request.

[0137] Specifically, upon receiving a permission acquisition request, the server reads the corresponding user permission information based on the user information carried in the request. If fine-grained permissions exist within the user permission information, the server obtains the data storage path corresponding to the fine-grained permissions, grants temporary authorization to that data storage path, and generates temporary authorization information. Based on this temporary authorization information, a proxy access credential is generated. After generating the proxy access credential, the server parses the permission acquisition request to obtain the corresponding permissions to be verified. Based on the user permission information and the proxy access credential, the server verifies the permissions to be verified to determine if the user's required permissions are compliant. If the permission verification passes, a permission verification response, including the proxy access credential, is sent to the terminal with the computing engine deployed. If the permission verification fails, a permission verification failure response is sent to the terminal with the computing engine deployed, causing the terminal with the computing engine to terminate the current operation.

[0138] In one specific application, if the permission verification passes, the permission verification response only needs to include the proxy access credentials; that is, the terminal with the computing engine deployed receives the proxy access credentials, indicating that the permission verification has passed. In another specific application, in addition to the proxy access credentials, the permission verification response will also include a verification success message, instructing the terminal with the computing engine deployed to retrieve the data on the storage path that matches the permission retrieval request based on the proxy access credentials.

[0139] Specifically, if the server verifies the permissions of the requested permission based on the permission verification response, the terminal with the computing engine will retrieve the data from the storage path matching the permission request using proxy access credentials. In practical applications, the matching storage path is stored in a distributed storage system (such as the Hadoop Distributed File System). When retrieving data, the terminal with the computing engine sends a data retrieval request carrying proxy access credentials to the distributed storage system. Upon receiving the request, the distributed storage system compares the data permissions in the request with those declared in the proxy access credentials to verify the terminal's permissions. If the data permissions in the request fall within the scope of those permissions declared in the proxy access credentials, the system returns the data from the matching storage path to the terminal with the computing engine.

[0140] In a specific application, when fine-grained permissions include at least one of partial row permissions and partial column permissions, a mask matrix will be included in the proxy access credentials. When a terminal with a computing engine retrieves data from the matching storage path, it will perform calculations based on the mask matrix when outputting the query results for that data. This hides data in the mask matrix that the user lacks permissions for, thus enabling read operations on the namespace-database-table-partial columns-partial rows. For example, * can be used to represent data that the user lacks permissions for to achieve this hiding.

[0141] The above-described business processing method, upon receiving a user's business processing request, sends a permission acquisition request carrying user information to the server based on the request. This enables the server to generate a proxy access credential when fine-grained permissions exist in the user's permission information. This allows the user to access the data storage path corresponding to the fine-grained permissions. Furthermore, the server verifies the permissions to be verified corresponding to the permission acquisition request using the user permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine. This allows the computing engine to retrieve the data on the storage path matching the permission acquisition request based on the proxy access credential, thus solving the problem of separating table permissions and path permissions.

[0142] In one embodiment, the access control method of this application can be applied to, for example... Figure 6In the application scenario shown, the computing layer includes multiple computing engines, each of which can communicate with the access control layer. The storage layer includes a distributed storage system that provides distributed storage services. It should be noted that the computing layer and the access control layer can be deployed on the same server, in which case the computing engines and the access control layer are independent processes. Alternatively, the computing layer and the access control layer can be deployed on different servers. Specifically, the access control method is applied in this scenario as follows:

[0143] When any computing engine in the computing layer receives a user's business processing request, it sends a permission acquisition request to the permission control layer based on the business processing request. The permission acquisition request carries user information. After receiving the permission acquisition request from the computing engine, the permission control layer reads the corresponding user permission information based on the user information. If it is determined that the user has fine-grained permissions based on the user permission information, it determines the corresponding data storage path based on the fine-grained permissions, grants temporary authorization to the data storage path, obtains temporary authorization information, generates proxy access credentials based on the temporary authorization information, parses the permission acquisition request, determines the target namespace matching the permission acquisition request, and identifies the target database, target data table, and target operation within the target namespace. The target database includes the target data table, and the target operation is the operation performed on the target data table. Based on the target namespace, target database, target data table, and target operation, it obtains the permissions to be verified corresponding to the permission acquisition request. Based on the proxy access credentials and user permission information, it determines the scope of user authorization and compares the scope of user authorization with the permissions to be verified to perform permission verification. If the permission verification passes, the proxy access credentials are fed back to the computing engine. After receiving the proxy access credentials, the computing engine retrieves the data on the storage path that matches the permission acquisition request from the distributed storage system that provides distributed storage services in the storage layer.

[0144] Furthermore, the server deploying the access control layer can be a standalone physical server, a server cluster, or a distributed system composed of multiple physical servers, depending on the specific application scenario. In big data scenarios, considering high availability, the server is typically a server cluster or distributed system composed of multiple physical servers to reduce coupling. In small-scale scenarios, to reduce deployment costs, the server is usually a standalone physical server. When the server is a server cluster or distributed system composed of multiple physical servers, different functions of the access control layer can be implemented through different servers.

[0145] For example, such as Figure 7As shown in the overall architecture diagram, after the permission control layer is functionally decomposed, it can include several parts such as permission credential generation service, request parser (specifically, SQL parser), permission verification service, metadata database, permission database, and unified metadata service. Each part can be implemented through different servers.

[0146] The unified metadata service can interface with different metadata databases, and the metadata can be heterogeneous, as long as the metadata database conforms to the JDBC specification. It's worth noting that the unified metadata service internally distinguishes different data sources using namespaces. A table is uniquely identified by three elements: namespace, database, and table.

[0147] The permission credential generation service writes the authorized records of users or user groups into the proxy access credentials. In particular, when a user or user group only has partial column permissions on a certain table, the permission credential generation service requests the unified metadata service to obtain the storage path corresponding to the table, temporarily authorizes the permissions of the storage path, writes it into the proxy access credentials, and sends the proxy access credentials to the permission verification service to solve the problem of separating table permissions and path permissions.

[0148] The request parser receives permission acquisition requests from different computing engines and requests the unified metadata service to parse these requests. Considering that the unified metadata service already supports multiple data sources, the request parser can support cross-source parsing. With the assistance of the unified metadata service, the request parser can extract the permissions to be verified corresponding to the permission acquisition request and send these permissions to the permission verification service. Specifically, the permissions to be verified can be uniformly translated into the following three formats: 1) read, write, delete, and modify structure operations for a namespace-database-table; 2) read operations for a namespace-database-table containing certain columns; and 3) read operations for a namespace-database-table containing certain columns and rows.

[0149] The permission verification service, upon receiving the permission to be verified from the request parser, reads the user permission information from the permission database. Based on the proxy access credentials and user permission information, it verifies the permission to determine if it is unauthorized. Unauthorized requests return a failure, while compliant requests are allowed. The computing engine decides whether to terminate the current operation based on the result of the permission verification service, thus achieving the effect of permission control. In particular, when row (i.e., the third format) permissions need to be verified, the permission verification service generates a mask matrix based on row permissions, column permissions, and table metadata. This allows the computing engine to hide data that the user does not have permission to access, enabling data permission control and ensuring data security and privacy.

[0150] In one embodiment, based on Figure 7The overall architecture diagram in the document provides an example of the access control method used in this application within the Spark computing engine.

[0151] A user runs an SQL query using the Spark computing engine to read three columns of data from table1 in the `default` database within namespace 1 (assuming table1's data storage path is `hdfs: / / namespace1 / default / table1`) and writes it to table2 in the `default` database within namespace 2 (assuming table2's data storage path is `hdfs: / / namespace2 / default / table2`). Since the user only has read permissions for some columns in table1 and lacks read permissions for the path `hdfs: / / namespace1 / default / table1`, direct access will fail. However, the access control method described in this application can solve the problem of separating table permissions from path permissions through proxy credentials, achieving fine-grained access control without bypassing SQL access control and eliminating the risk of direct database breaches.

[0152] A detailed flowchart can be found as follows: Figure 8 As shown, it should be noted that Figure 8 Each step in can be done through Figure 7 The interaction implementation between the computing engine and the access control layer, between different services in the access control layer, and between the computing engine and the distributed storage system, and the specific steps and corresponding interactions are described in [the document / document / details]. Figure 7 As indicated in the annotation, the access control method of this application specifically includes the following steps under this application:

[0153] In step 802, the user submits an SQL statement to the Spark Driver node (the driver node in the computing engine) through the Spark computing engine client, such as reading the data from columns 1, 2, and 3 of table1 and writing it to table2. The Spark Driver node first requests permission credentials.

[0154] Step 804: The permission credential generation service reads the permission database and writes the user's existing permissions into the proxy access credential. In particular, it temporarily authorizes the storage path hdfs: / / namespace1 / default / table1 corresponding to table1 and writes it into the proxy access credential, then returns the proxy access credential to the Spark computing engine.

[0155] In step 806, before executing the SQL, the Spark Driver node submits the SQL to the permission control layer for permission verification. The request parser parses the permissions to be verified, uniformly resolving them into the following format: namespace1-default-table1-column1-ro, namespace1-default-table1-column2-ro, and namespace1-default-table1-column3-ro indicate read permissions for these three columns in table1, while namespace1-default-table2-w indicates write permissions for table2.

[0156] Step 808: The permission verification service compares the proxy access credentials and the user permission information read from the permission database with the permissions to be verified in the previous step, determines that the user has the required permissions, and returns a successful verification result.

[0157] Step 810: After receiving the successful authorization verification result, the Spark Driver node converts the SQL into a real computing task and distributes the computing task to different Spark Executor nodes (the nodes that execute tasks in the computing engine).

[0158] In step 812, the Spark Executor nodes perform data read / write and computation operations. Because the Spark Executor nodes can obtain proxy access credentials from the Spark Driver nodes, they can normally access the data at the path hdfs: / / namespace1 / default / table1, complete the data computation, and write the data in table1 into table2. After the Spark Executor nodes complete the computation, they return a success result to the Spark Driver nodes. The Spark Driver nodes wait for all computation tasks on the Spark Executor nodes to complete before returning a success message, and the SQL operation is completed.

[0159] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0160] Based on the same inventive concept, embodiments of this application also provide an access control device for implementing the access control method described above, and a business processing device for implementing the business processing method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more access control devices and business processing devices embodiments provided below can be found in the limitations of the access control method and business processing method described above, and will not be repeated here.

[0161] In one embodiment, such as Figure 9 As shown, an access control device is provided, including: a request receiving module 902, an authorization module 904, and an authentication module 906, wherein:

[0162] The request receiving module 902 is used to receive permission acquisition requests from the computing engine, and the permission acquisition requests carry user information.

[0163] The authorization module 904 is used to generate a proxy access credential if there are fine-grained permissions in the user permission information corresponding to the user information, so that the data storage path corresponding to the fine-grained permissions can be accessed.

[0164] The authentication module 906 is used to verify the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credential.

[0165] Upon receiving a permission acquisition request from the computing engine, the aforementioned permission control device generates a proxy access credential if the user permission information corresponding to the user information contains fine-grained permissions. This allows access to the data storage path corresponding to the fine-grained permissions. The device can then verify the permissions to be verified corresponding to the permission acquisition request using the user permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine, enabling the computing engine to acquire the data on the storage path matching the permission acquisition request based on the proxy access credential. This solves the problem of separating table permissions and path permissions.

[0166] In one embodiment, the authorization module is further configured to read the corresponding user permission information based on the user information; if it is determined based on the user permission information that the user has fine-grained permissions, the corresponding data storage path is determined based on the fine-grained permissions, temporary authorization is granted to the data storage path to obtain temporary authorization information, and proxy access credentials are generated based on the temporary authorization information.

[0167] In one embodiment, fine-grained permissions include partial row permissions and partial column permissions. The authorization module is further configured to generate a mask matrix based on the partial row permissions and partial column permissions. The mask matrix is ​​used to instruct the computing engine to hide data that the user does not have permission to access. Proxy access credentials are generated based on the temporary authorization information and the mask matrix.

[0168] In one embodiment, the access control device further includes a request parsing module, which is used to parse the access request, determine the target namespace matching the access request, and the target database, target data table and target operation in the target namespace. The target database includes the target data table, and the target operation is the operation performed on the target data table. Based on the target namespace, target database, target data table and target operation, the access permission to be verified corresponding to the access request is obtained.

[0169] In one embodiment, the authentication module is further configured to determine the scope of authorization that a user can grant based on the proxy access credentials and user permission information, and compare the scope of authorization that a user can grant with the permissions to be verified in order to perform permission verification.

[0170] In one embodiment, the authorization module is further configured to generate an empty proxy access credential if the user permission information corresponding to the user information does not contain fine-grained permissions, and proceed to the step of verifying the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential.

[0171] In one embodiment, such as Figure 10 As shown, a service processing apparatus is provided, including: a request sending module 1002, a response receiving module 1004, and a data acquisition module 1006, wherein:

[0172] The request sending module 1002 is used to send an authorization request to the server based on the business processing request when it receives a user's business processing request. The authorization request carries user information.

[0173] The response receiving module 1004 is used to receive the permission verification response from the server. The permission verification response includes the proxy access credentials.

[0174] The data acquisition module 1006 is used to determine, based on the permission verification response, that the server has passed the permission verification for the permission to be verified corresponding to the permission acquisition request, and to acquire the data on the storage path that matches the permission acquisition request based on the proxy access credentials.

[0175] The server verifies the permissions to be verified based on user permission information and proxy access credentials. The user permission information corresponds to the user information, and the proxy access credentials are generated when there are fine-grained permissions in the user permission information.

[0176] Upon receiving a user's business processing request, the aforementioned business processing device sends a permission acquisition request carrying user information to the server based on the request. This enables the server to generate a proxy access credential when fine-grained permissions exist in the user's permission information. This allows the user to access the data storage path corresponding to the fine-grained permissions. Furthermore, the device verifies the permissions to be verified corresponding to the permission acquisition request using the user's permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine. This allows the computing engine to retrieve the data on the storage path matching the permission acquisition request based on the proxy access credential, thus solving the problem of separating table permissions and path permissions.

[0177] The modules in the aforementioned access control device and business processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0178] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 11As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores user permission information and other data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an access control method and a business processing method.

[0179] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0180] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0181] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0182] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0183] It should be noted that the user information (including but not limited to user permission information) and data (including but not limited to data used for analysis, data stored, data displayed) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0184] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0185] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0186] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An access control method, characterized in that, The method includes: Receive a permission request from the computing engine, the permission request carrying user information; If the user permission information corresponding to the user information contains fine-grained permissions, the corresponding data storage path is determined based on the fine-grained permissions; the fine-grained permissions include at least one of partial row permissions and partial column permissions; Temporary authorization is granted to the data storage path to obtain temporary authorization information. A mask matrix is ​​generated based on the partial row permissions and / or the partial column permissions. The mask matrix is ​​used to instruct the computing engine to hide data that the user does not have permission to access. Generate proxy access credentials based on the temporary authorization information and the mask matrix; Based on the user permission information and the proxy access credential, the permission to be verified corresponding to the permission acquisition request is verified. If the permission verification is successful, the proxy access credential is fed back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credential.

2. The method according to claim 1, characterized in that, The method further includes: The permission acquisition request is parsed to determine the target namespace that matches the permission acquisition request, as well as the target database, target data table, and target operation in the target namespace. The target database includes the target data table, and the target operation is an operation performed on the target data table. Based on the target namespace, the target database, the target data table, and the target operation, the permissions to be verified corresponding to the permission acquisition request are obtained.

3. The method according to claim 1, characterized in that, The permission verification of the permission acquisition request corresponding to the pending permission based on the user permission information and the proxy access credential includes: Based on the proxy access credentials and the user permission information, the scope of authorization that the user can grant is determined; The scope of user authorization is compared with the permissions to be verified in order to perform permission verification.

4. The method according to claim 1, characterized in that, The method further includes: If the user permission information corresponding to the user information does not contain fine-grained permissions, an empty proxy access credential is generated, and the process proceeds to the step of verifying the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential.

5. A business processing method, characterized in that, The method includes: When a user's business processing request is received, an authorization request is sent to the server based on the business processing request, and the authorization request carries user information. Receive the permission verification response from the server, the permission verification response including proxy access credentials; If, based on the permission verification response, it is determined that the server has successfully verified the permission to be verified corresponding to the permission acquisition request, then the data on the storage path matching the permission acquisition request is retrieved based on the proxy access credentials. The server verifies the permissions to be verified based on user permission information and the proxy access credential. The user permission information corresponds to the user information. The proxy access credential is generated when fine-grained permissions exist in the user permission information. The fine-grained permissions include at least one of partial row permissions and partial column permissions. The proxy access credential is generated based on temporary authorization information and a mask matrix. The mask matrix is ​​generated based on the partial row permissions and / or the partial column permissions, and is used to instruct the computing engine to hide data that the user does not have permission for. The temporary authorization information is obtained by temporarily authorizing the data storage path. The data storage path is determined by the fine-grained permissions.

6. An access control device, characterized in that, The device includes: The request receiving module is used to receive permission acquisition requests from the computing engine, wherein the permission acquisition requests carry user information. An authorization module is used to determine the corresponding data storage path based on the fine-grained permissions if the user permission information corresponding to the user information contains fine-grained permissions; the fine-grained permissions include at least one of partial row permissions and partial column permissions; temporarily authorize the data storage path to obtain temporary authorization information; generate a mask matrix based on the partial row permissions and / or the partial column permissions; the mask matrix is ​​used to instruct the computing engine to hide data that the user does not have permission to; and generate proxy access credentials based on the temporary authorization information and the mask matrix. The authentication module is used to verify the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential. If the permission verification is successful, the proxy access credential is fed back to the computing engine so that the computing engine can obtain the data on the storage path that matches the permission acquisition request based on the proxy access credential.

7. The apparatus according to claim 6, characterized in that, The device further includes a request parsing module, which is used to parse the permission acquisition request, determine the target namespace matching the permission acquisition request, and the target database, target data table, and target operation in the target namespace. The target database includes the target data table, and the target operation is an operation performed on the target data table. Based on the target namespace, the target database, the target data table, and the target operation, the permission to be verified corresponding to the permission acquisition request is obtained.

8. The apparatus according to claim 6, characterized in that, The authentication module is also used to determine the scope of user authorization based on the proxy access credentials and the user permission information, and compare the scope of user authorization with the permissions to be verified in order to perform permission verification.

9. The apparatus according to claim 6, characterized in that, The authorization module is further configured to generate an empty proxy access credential if the user permission information corresponding to the user information does not contain fine-grained permissions, and proceed to the step of verifying the permissions to be verified corresponding to the permission acquisition request based on the user permission information and the proxy access credential.

10. A business processing apparatus, characterized in that, The device includes: The request sending module is used to send a permission acquisition request to the server based on the user's business processing request when it receives the user's business processing request. The permission acquisition request carries user information. The response receiving module is used to receive the permission verification response fed back by the server, the permission verification response including proxy access credentials; The data acquisition module is used to, if based on the permission verification response, determine that the server has passed the permission verification for the permission to be verified corresponding to the permission acquisition request, and acquire the data on the storage path that matches the permission acquisition request based on the proxy access credential; The server verifies the permissions to be verified based on user permission information and the proxy access credential. The user permission information corresponds to the user information. The proxy access credential is generated when fine-grained permissions exist in the user permission information. The fine-grained permissions include at least one of partial row permissions and partial column permissions. The proxy access credential is generated based on temporary authorization information and a mask matrix. The mask matrix is ​​generated based on the partial row permissions and / or the partial column permissions, and is used to instruct the computing engine to hide data that the user does not have permission for. The temporary authorization information is obtained by temporarily authorizing the data storage path. The data storage path is determined by the fine-grained permissions.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images