Trino-based permission control dynamic update method, device and equipment

Abstract

The present invention discloses a method, device and equipment for dynamically updating permission control based on Trino, and relates to the technical field of permission control. The method includes defining TrinoAccessMode in Trino source code; defining ExternalSystemAccessControl in Trino source code; modifying ServerInfoResource in main module, and adding HTTP interface for saving permission data in ServerInfoResource; packaging the adjusted main module and trino‑plugin‑toolkit module to replace the corresponding jar file in Trino server, and restarting trino application to apply the permission control policy configured. The present application updates and maintains the permission data of Trino cluster by exposing HTTP interface to the outside to ensure the real-time performance of permission data.

Description

Technical Field

[0001] The present application relates to the technical field of permission control, and in particular to a Trino-based permission control dynamic update method, device and equipment. Background Art

[0002] Trino is an open source distributed SQL (Structured Query Language) query engine that evolved from a relational database architecture. It is used to interactively analyze and query data sets from various data sources. It supports standard ANSI SQL (Structured Query Language standard developed by the Standards Association) and has good performance in terms of support for multiple data sources, high performance, ease of use, and scalability.

[0003] When Trino is widely used in applications such as big data analysis and data governance, in terms of data security, it is necessary to focus on solving the resource isolation between users and the user's permission control over the catalog / schema / table. In order to solve the above problems, Trino officially provides a permission control solution based on file configuration, but this solution requires manual modification of the permission configuration file and restarting the Trino application when updating permissions. This solution is not flexible enough when updating permissions, and the Trino application cannot provide services to users when it is restarted. Another solution is to use third-party components to implement permission control, such as Ranger (a security component), ElasticSearch (open source distributed search engine) and other external components, but this solution will cause Trino and third-party components to be highly coupled, increase the complexity of system maintenance, and when third-party components cannot operate normally (such as shutdown), it will affect the normal use of Trino. Summary of the invention

[0004] The present application provides a Trino-based permission control dynamic update method, device and equipment, which updates and maintains the permission data of the Trino cluster by exposing an HTTP interface to the outside to ensure the real-time nature of the permission data.

[0005] In a first aspect, an embodiment of the present application provides a Trino-based permission control dynamic update method, the Trino-based permission control dynamic update method comprising:

[0006] In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data and define the string type, and encapsulate the read and write operations of the defined Java class TrinoAccessModel;

[0007] Define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module;

[0008] Modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource;

[0009] Package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar files in the Trino server, and restart the trino application to apply the configured permission control policy.

[0010] In combination with the first aspect, in one implementation, a Java class TrinoAccessModel for carrying Trino's permission data is defined in the main module of the Trino source code and a string type is defined, and the read and write operations of the defined Java class TrinoAccessModel are encapsulated, specifically:

[0011] In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data;

[0012] In the Java class TrinoAccessModel, define the access permission field of string type, the catalog name field of string type, the schema name field of string type, the table name field of string type, and the user name field of string type;

[0013] Write the Java class TrinoAccessModelRepository in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel.

[0014] In combination with the first aspect, in one implementation, the Java class TrinoAccessModelRepository is written in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel, specifically:

[0015] In the Java class TrinoAccessModelRepository, define a permission data set for storing all the permission data objects of Trino, and the permission data object is an instance object of the Java class TrinoAccessModel;

[0016] In the Java class TrinoAccessModelRepository, methods for adding permissions, deleting permissions, verifying permissions, querying accessible catalog information, querying accessible schema information, synchronizing permissions, refreshing permission data to disk, and loading permission data on disk are defined to operate permission data.

[0017] In combination with the first aspect, in one implementation,

[0018] The method for adding permissions is, for an input permission data object, if the permission data set does not contain the input permission data object, then adding the input permission data object to the permission data set;

[0019] The method for deleting permissions is that, for an input permission data object, if the permission data set contains the input permission data object, the input permission data object is deleted from the permission data set;

[0020] The permission verification method is: for the input permission data object, if the permission data set contains the input permission data object, then true is returned, otherwise false is returned;

[0021] The method for querying the accessible catalog information is to match the corresponding catalog data in the permission data set according to the input user name;

[0022] The method for querying the accessible schema information is to match the corresponding schema data in the permission data set according to the input user name;

[0023] The permission synchronization method is to replace the data in the permission data set with the input permission data set data;

[0024] The method of refreshing the permission data to the disk is to write the data in the permission data set to a specified configured path;

[0025] The method for loading the permission data on the disk is to read the permission data file under the specified configuration path, and load the permission data in the permission data file into the permission data set.

[0026] In combination with the first aspect, in one implementation, the Java class ExternalSystemAccessControl is defined in the trino-plugin-toolkit module of the Trino source code, the permission control method in the interface SystemAccessControl is implemented, and the configure method and the construction method AccessControlManager are modified in the main module, specifically:

[0027] In the trino-plugin-toolkit module of the Trino source code, define the Java class ExternalSystemAccessControl and implement the permission control method in the interface SystemAccessControl;

[0028] In the main module of the Trino source code, modify the configure method of the Java class AccessControlModule in the Trino source code, complete the configuration binding and initialization of the Java class TrinoAccessModel in the configure method, and configure the TrinoAccessModelRepository object into ExternalSystemAccessControl;

[0029] In the main module of the Trino source code, modify the constructor AccessControlManager of the Java class AccessControlManager in the Trino source code, and add the factory object Factory of ExternalSystemAccessControl to the member variable SystemAccessControlFactories of AccessControlManager in the constructor.

[0030] In combination with the first aspect, in one implementation, the permission control method in the implementation interface SystemAccessControl is specifically:

[0031] In the permission control method of SystemAccessControl, encapsulate the input access data into a TrinoAccessModel object, and call the permission verification method of the TrinoAccessModelRepository object to complete the Trino permission verification;

[0032] In ExternalSystemAccessControl, there corresponds a static member factory class Factory, which implements the getName method and create method of the interface SystemAccessControlFactory.

[0033] In combination with the first aspect, in one implementation,

[0034] The getName method is used to return the specified access control policy name;

[0035] The create method is used to call the method of loading permission data on disk of TrinoAccessModelRepository, start the scheduled task, periodically call the method of refreshing permission data to disk of TrinoAccessModelRepository, persist the permission data to disk, and finally return the instance object of Java class ExternalSystemAccessControl.

[0036] In combination with the first aspect, in one implementation, the Java class ServerInfoResource in the Trino source code is modified in the main module, and an HTTP interface for saving permission data is added to ServerInfoResource, specifically:

[0037] In the main module of the Trino source code, modify the Java class ServerInfoResource in the Trino source code;

[0038] Add an HTTP interface for saving permission data in the Java class ServerInfoResource. The input parameters of the HTTP interface include a TrinoAccessModel object of a collection type and a permission update type of a string type. The permission update type of the string type includes full synchronization of permission data, addition of permission data, and deletion of permission data.

[0039] Read the permission control policy in the permission configuration file, and when the permission control policy is configured as external, if the synchronization mark in the input parameter is full synchronization of permission data, call the permission synchronization method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data addition, call the add permission method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data deletion, call the delete permission method of the Java class TrinoAccessModelRepository;

[0040] Call the method of refreshing permission data to disk of the Java class TrinoAccessModelRepository to persist the permission data to disk.

[0041] In a second aspect, an embodiment of the present application provides a TRINO-based permission control dynamic update device, the TRINO-based permission control dynamic update device comprising:

[0042] The first definition module is used to define a Java class TrinoAccessModel for carrying Trino's permission data in the main module of the Trino source code and to define the string type, and to encapsulate the read and write operations of the defined Java class TrinoAccessModel;

[0043] The second definition module is used to define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module;

[0044] The modification module is used to modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource;

[0045] The execution module is used to package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar files in the Trino server, and restart the trino application to apply the configured permission control policy.

[0046] In the third aspect, an embodiment of the present application provides a TRINO-based permission control dynamic update device, which includes a processor, a memory, and a TRINO-based permission control dynamic update program stored in the memory and executable by the processor, wherein when the TRINO-based permission control dynamic update program is executed by the processor, the steps of the above-mentioned TRINO-based permission control dynamic update method are implemented.

[0047] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0048] (1) Update and maintain the permission data of the Trino cluster by exposing the HTTP interface to the outside world to ensure the real-time nature of the permission data; at the same time, start a scheduled task in the Trino cluster to periodically save the permission data in the cluster to the disk to ensure the integrity of the permission data. This application can be applied to data governance and big data analysis permission control, which is an important supplement and functional improvement in data security;

[0049] (2) Compared with the default file-based configuration method provided by the official system to configure permission data, this application updates and maintains the permission data of the Trino cluster by exposing the HTTP interface to the outside world, ensuring the dynamic update of Trino permission data without restarting the service, and improving the flexibility and real-time performance of Trino permission data maintenance;

[0050] (3) Compared with the industry's implementation solutions based on third-party plug-ins such as Ranger and ElasticSearch, the Trino permission control method of this application is less coupled with third-party plug-ins, and third-party plug-ins will not directly affect the Trino cluster;

[0051] (4) The memory-based permission control solution of this application is more excellent in performance. This application ensures the integrity of Trino permission data by persisting the permission data to disk. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a flowchart of a TRINO-based permission control dynamic update method for this application;

[0053] Figure 2 Flowchart for loading permission data when Trino starts;

[0054] Figure 3 A flowchart for updating permission data during Trino operation;

[0055] Figure 4 This is a flowchart of permission control during SQL execution;

[0056] Figure 5 It is a functional module diagram of a TRINO-based permission control dynamic update device;

[0057] Figure 6 Schematic diagram of the hardware structure of the dynamic update device for TRINO-based permission control. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] First, a brief introduction is given to the terms involved in this application.

[0060] TrinoAccessModel is a Java class used to carry Trino's permission data, which encapsulates attribute fields related to Trino engine permissions, such as access permission fields of string type, catalog name fields of string type, schema name fields of string type, table name fields of string type, and user name fields of string type.

[0061] The trino-plugin-toolkit module is a plug-in toolkit that comes with the trino engine, which defines trino's native access control permission logic. For the sake of logical consistency, the policy control logic proposed in this application will also be implemented in this module.

[0062] ExternalSystemAccessControl is a Java class defined in this application. This class implements the access control interface defined by the trino engine. The ExternalSystemAccessControl class is mainly used to implement the access control logic in the solution of this application.

[0063] SystemAccessControl is the system access control interface provided by the trino engine for developers to reimplement the access control logic of the trino engine.

[0064] AccessControlManager is the native access control policy management class in the trino engine, which encapsulates the configuration, activation, and installation logic of the access control policy.

[0065] ServerInfoResource is the native external interface of the trino engine, which encapsulates some remote interfaces exposed by the trino engine for external system access.

[0066] The TrinoAccessModelRepository class is a java class defined in this application, which is used to encapsulate the read and write operations of the permission data defined in this solution.

[0067] SystemAccessControlFactories is an attribute in the access control policy management class in trino, which encapsulates all access control policy implementation logic of the trino engine.

[0068] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0069] On the first aspect, an embodiment of the present application provides a TRINO-based permission control dynamic update method, which updates and maintains the permission data of the Trino cluster by exposing an HTTP interface to the outside to ensure the real-time nature of the permission data, and at the same time starts a scheduled task in the Trino cluster to periodically save the permission data in the cluster to the disk to ensure the integrity of the permission data.

[0070] In one embodiment, referring to Figure 1 , Figure 1 This is a flowchart of the TRINO-based permission control dynamic update method of this application. Figure 1 As shown, the TRINO-based permission control dynamic update method includes:

[0071] S1: In the main module (main module) of the Trino source code, define the Java (object-oriented programming language) class TrinoAccessModel for carrying Trino's permission data and define the string type, and encapsulate the read and write operations of the defined Java class TrinoAccessModel;

[0072] Furthermore, in one embodiment, a Java class TrinoAccessModel for carrying Trino's permission data is defined in the main module of the Trino source code and a string type is defined, and the read and write operations of the defined Java class TrinoAccessModel are encapsulated, specifically:

[0073] S101: In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data;

[0074] S102: Define an access permission field of string type, a catalog name field of string type, a schema name field of string type, a table name field of string type, and a user name field of string type in the Java class TrinoAccessModel; Catalog and Schema are abstract concepts for convenient management of database objects, mainly to solve the naming conflict problem of database object access. In a database system, it may contain multiple catalogs, each catalog contains multiple schemas, and each schema contains multiple database objects.

[0075] S103: Write a Java class TrinoAccessModelRepository in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel. That is, in the main module of the Trino source code, write a Java class TrinoAccessModelRepository to encapsulate the read and write operations of the permission data (i.e., Java class TrinoAccessModel) defined in the above steps.

[0076] Furthermore, in one embodiment, a Java class TrinoAccessModelRepository is written in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel, specifically:

[0077] S1031: In the Java class TrinoAccessModelRepository, define a permission data set for storing all the permission data objects of Trino, where the permission data object is an instance object of the Java class TrinoAccessModel;

[0078] S1032: In the Java class TrinoAccessModelRepository, define methods for adding permission, deleting permission, verifying permission, querying accessible catalog information, querying accessible schema information, synchronizing permission, refreshing permission data to disk, and loading permission data on disk, so as to operate on permission data.

[0079] Specifically, the method for adding permissions is, for the input permission data object, if the permission data set does not contain the input permission data object, then the input permission data object is added to the permission data set; the method for deleting permissions is, for the input permission data object, if the permission data set contains the input permission data object, then the input permission data object is deleted from the permission data set; the method for verifying permissions is, for the input permission data object, if the permission data set contains the input permission data object, then true is returned, otherwise false is returned; the method for querying accessible catalog information is, according to the input user name, matching the corresponding catalog data in the permission data set; the method for querying accessible schema information is, according to the input user name, matching the corresponding schema data in the permission data set; the method for synchronizing permissions is, replacing the data in the permission data set with the input permission data set data; the method for refreshing permission data to disk is, writing the data in the permission data set to the specified configured path; the method for loading permission data on disk is, reading the permission data file under the specified configured path, and loading the permission data in the permission data file into the permission data set.

[0080] That is, step S1 in this application is the definition of the permission data model.

[0081] S2: Define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module;

[0082] Further, in one embodiment, a Java class ExternalSystemAccessControl is defined in the trino-plugin-toolkit module of the Trino source code, the permission control method in the interface SystemAccessControl is implemented, and the configure method and the constructor AccessControlManager are modified in the main module, specifically:

[0083] S201: In the trino-plugin-toolkit module of the Trino source code, define the Java class ExternalSystemAccessControl and implement the permission control methods in the interface SystemAccessControl; the permission control methods include the checkCanAccessCatalog method, the checkCanCreateCatalog method, and the like.

[0084] Specifically, implement the permission control method in the SystemAccessControl interface, as follows:

[0085] S2011: In the permission control method of SystemAccessControl, the input access data is encapsulated into a TrinoAccessModel object, and the permission verification method of the TrinoAccessModelRepository object is called to complete the permission verification of Trino;

[0086] S2012: Create a static member factory class Factory in ExternalSystemAccessControl, and implement the getName method and create method of the SystemAccessControlFactory interface.

[0087] The getName method is used to return the specified access control policy name, that is, external (it should be noted that this value needs to be consistent with the policy configuration in the permission configuration file);

[0088] The create method is used to call the method of TrinoAccessModelRepository to load permission data on disk. Next, the scheduled task is started according to the configuration, and the method of TrinoAccessModelRepository to refresh permission data to disk is periodically called to persist the permission data to disk. Finally, the instance object of the Java class ExternalSystemAccessControl is returned.

[0089] S202: In the main module of the Trino source code, modify the configure method of the Java class AccessControlModule in the Trino source code (a common software installation method), complete the configuration binding and initialization of the Java class TrinoAccessModel in the configure method, and configure the TrinoAccessModelRepository object into ExternalSystemAccessControl;

[0090] S203: In the main module of the Trino source code, modify the constructor AccessControlManager of the Java class AccessControlManager in the Trino source code, and add the factory object Factory of ExternalSystemAccessControl to the member variable SystemAccessControlFactories of AccessControlManager in the constructor.

[0091] In this application, step S2 constitutes the definition of the permission control policy. For the flowchart of loading permission data when Trino starts, see Figure 2 As shown, the specific steps include:

[0092] S21: Read configuration, go to S22:

[0093] S22: Determine whether the process enables external permission control. If so, go to S23; if not, go to S24;

[0094] S23: Determine whether there is a permission data file, if yes, go to S25, if no, go to S26;

[0095] S24: Use the default permission control policy and end;

[0096] S25: Load the permission data file, and go to S26;

[0097] S26: Enable the scheduled task to periodically persist the permission data, and end.

[0098] S3: Modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource;

[0099] Furthermore, in one embodiment, the Java class ServerInfoResource in the Trino source code is modified in the main module, and an HTTP interface for saving permission data is added to ServerInfoResource, specifically:

[0100] S301: In the main module of the Trino source code, modify the Java class ServerInfoResource in the Trino source code;

[0101] S302: Add an HTTP (Hypertext Transfer Protocol) interface for saving permission data in the Java class ServerInfoResource. The input parameters of the HTTP interface include a TrinoAccessModel object of a collection type and a permission update type of a string type. The permission update type of the string type includes full synchronization of permission data, addition of permission data, and deletion of permission data.

[0102] S303: Read the permission control policy in the permission configuration file, and when the permission control policy is configured as external, if the synchronization mark in the input parameter is full synchronization of permission data, then call the permission synchronization method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data addition, then call the add permission method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data deletion, then call the delete permission method of the Java class TrinoAccessModelRepository; when the permission control policy is not configured as external, return directly.

[0103] S304: Call the method of refreshing the permission data to disk of the Java class TrinoAccessModelRepository to persist the permission data to the disk.

[0104] In this application, step S3 constitutes an update of the permission data. For a flowchart of updating the permission data during Trino operation, see Figure 3 As shown, specifically:

[0105] S31: Push permission data to Trino engine interface and go to S32;

[0106] S32: Determine whether the access control policy is external. If so, go to S33. If not, end.

[0107] S33: Compare whether the permission data has been changed, if so, go to S34, if not, end;

[0108] S34: Update authority data, and go to S35;

[0109] S35: Persist the permission data to disk, and then finish.

[0110] S4: Package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar (a software package file format) files in the Trino server, and restart the trino application to apply the configured permission control policy.

[0111] That is, package the modified main module and trino-plugin-toolkit module, then replace the corresponding jar files in the Trino server, and configure access-control.name = external, access-control.data.dir = / etc / access-info.json in the etc / access-control.properties file in the trino server, and restart the trino application to enable the permission control policy configured in the above solution.

[0112] For the flowchart of permission control during SQL execution, see Figure 4 As shown, specifically including:

[0113] S41: The process user executes the SQL statement and goes to S42;

[0114] S42: parse the SQL statement, obtain the corresponding metadata, and go to S43;

[0115] S43: Is the access control policy external? If yes, go to S44; if no, go to S45;

[0116] S44: Obtain the corresponding permission data in the Trino memory, and go to S46;

[0117] S45: Use the official default authority policy to complete the authentication, and then end;

[0118] S46: Check whether the permission allows SQL execution, and end.

[0119] In a second aspect, an embodiment of the present application also provides a TRINO-based permission control dynamic update device.

[0120] In one embodiment, referring to Figure 5 , Figure 5 This is a functional module diagram of the TRINO-based permission control dynamic update device of this application. Figure 5 As shown, the TRINO-based permission control dynamic update device includes a first definition module, a second definition module, a modification module and an execution module.

[0121] The first definition module is used to define the Java class TrinoAccessModel for carrying Trino's permission data in the main module of the Trino source code and to define the string type, and to encapsulate the read and write operations of the defined Java class TrinoAccessModel; the second definition module is used to define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module; the modification module is used to modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource; the execution module is used to package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar file in the Trino server, and restart the trino application to apply the configured permission control policy.

[0122] In this application, a Java class TrinoAccessModel for carrying Trino's permission data is defined in the main module of the Trino source code and a string type is defined, and the read and write operations of the defined Java class TrinoAccessModel are encapsulated, specifically:

[0123] In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data;

[0124] In the Java class TrinoAccessModel, define the access permission field of string type, the catalog name field of string type, the schema name field of string type, the table name field of string type, and the user name field of string type;

[0125] Write the Java class TrinoAccessModelRepository in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel.

[0126] Among them, the functional implementation of each module in the above-mentioned TRINO-based permission control dynamic update device corresponds to the steps in the above-mentioned TRINO-based permission control dynamic update method embodiment, and its functions and implementation processes are no longer repeated here.

[0127] In a third aspect, an embodiment of the present application provides a TRINO-based permission control dynamic update device, which may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0128] Reference Figure 6 , Figure 6 The hardware structure diagram of the TRINO-based permission control dynamic update device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the TRINO-based permission control dynamic update device may include a processor, a memory, a communication interface, and a communication bus.

[0129] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0130] The communication interface includes input / output (I / O) interface, physical interface and logical interface, etc., which are used to realize the interconnection of devices inside the TRINO-based permission control dynamic update device, and the interface used to realize the interconnection between the TRINO-based permission control dynamic update device and other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0131] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0132] The processor may be a general-purpose processor, which may call the TRINO-based permission control dynamic update program stored in the memory and execute the TRINO-based permission control dynamic update method provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the TRINO-based permission control dynamic update program is called may refer to the various embodiments of the TRINO-based permission control dynamic update method of the present application, which will not be repeated here.

[0133] Those skilled in the art will understand that Figure 6 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0134] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0135] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0136] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0137] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0138] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0139] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0140] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A Trino-based permission control dynamic update method, characterized in that: The Trino-based permission control dynamic update method includes: In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data and define the string type, and encapsulate the read and write operations of the defined Java class TrinoAccessModel; Define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module; Modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource; Package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar files in the Trino server, and restart the trino application to apply the configured permission control policy; The Java class TrinoAccessModel for carrying Trino's permission data is defined in the main module of the Trino source code and a string type is defined, and the read and write operations of the defined Java class TrinoAccessModel are encapsulated, specifically: In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data; In the Java class TrinoAccessModel, define the access permission field of string type, the catalog name field of string type, the schema name field of string type, the table name field of string type, and the user name field of string type; Write the Java class TrinoAccessModelRepository in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel; Among them, the Java class ExternalSystemAccessControl is defined in the trino-plugin-toolkit module of the Trino source code, the permission control method in the interface SystemAccessControl is implemented, and the configure method and the construction method AccessControlManager are modified in the main module, specifically: In the trino-plugin-toolkit module of the Trino source code, define the Java class ExternalSystemAccessControl and implement the permission control method in the interface SystemAccessControl; In the main module of the Trino source code, modify the configure method of the Java class AccessControlModule in the Trino source code, complete the configuration binding and initialization of the Java class TrinoAccessModel in the configure method, and configure the TrinoAccessModelRepository object into ExternalSystemAccessControl; In the main module of the Trino source code, modify the constructor AccessControlManager of the Java class in the Trino source code, and add the factory object Factory of ExternalSystemAccessControl to the member variable SystemAccessControlFactories of AccessControlManager in the constructor; The Java class ServerInfoResource in the Trino source code is modified in the main module, and an HTTP interface for saving permission data is added to ServerInfoResource, specifically: In the main module of the Trino source code, modify the Java class ServerInfoResource in the Trino source code; Add an HTTP interface for saving permission data in the Java class ServerInfoResource. The input parameters of the HTTP interface include a TrinoAccessModel object of a collection type and a permission update type of a string type. The permission update type of the string type includes full synchronization of permission data, addition of permission data, and deletion of permission data. Read the permission control policy in the permission configuration file, and when the permission control policy is configured as external, if the synchronization mark in the input parameter is full synchronization of permission data, call the permission synchronization method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data addition, call the add permission method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data deletion, call the delete permission method of the Java class TrinoAccessModelRepository; Call the method of refreshing permission data to disk of the Java class TrinoAccessModelRepository to persist the permission data to disk.

2. A Trino-based permission control dynamic update method as claimed in claim 1, characterized in that: The Java class TrinoAccessModelRepository is written in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel, specifically: In the Java class TrinoAccessModelRepository, define a permission data set for storing all the permission data objects of Trino, and the permission data object is an instance object of the Java class TrinoAccessModel; In the Java class TrinoAccessModelRepository, methods for adding permissions, deleting permissions, verifying permissions, querying accessible catalog information, querying accessible schema information, synchronizing permissions, refreshing permission data to disk, and loading permission data on disk are defined to operate permission data.

3. A Trino-based permission control dynamic update method as claimed in claim 2, characterized in that: The method for adding permissions is, for an input permission data object, if the permission data set does not contain the input permission data object, then adding the input permission data object to the permission data set; The method for deleting permissions is that, for an input permission data object, if the permission data set contains the input permission data object, the input permission data object is deleted from the permission data set; The permission verification method is: for the input permission data object, if the permission data set contains the input permission data object, then true is returned, otherwise false is returned; The method for querying the accessible catalog information is to match the corresponding catalog data in the permission data set according to the input user name; The method for querying the accessible schema information is to match the corresponding schema data in the permission data set according to the input user name; The permission synchronization method is to replace the data in the permission data set with the input permission data set data; The method of refreshing the permission data to the disk is to write the data in the permission data set to a specified configured path; The method for loading the permission data on the disk is to read the permission data file under the specified configuration path, and load the permission data in the permission data file into the permission data set.

4. A Trino-based permission control dynamic update method as claimed in claim 3, characterized in that: The permission control method in the implementation interface SystemAccessControl is specifically: In the permission control method of SystemAccessControl, encapsulate the input access data into a TrinoAccessModel object, and call the permission verification method of the TrinoAccessModelRepository object to complete the Trino permission verification; In ExternalSystemAccessControl, there corresponds a static member factory class Factory, which implements the getName method and create method of the interface SystemAccessControlFactory.

5. A Trino-based permission control dynamic update method as claimed in claim 4, characterized in that: The getName method is used to return the specified access control policy name; The create method is used to call the method of loading permission data on disk of TrinoAccessModelRepository, start the scheduled task, periodically call the method of refreshing permission data to disk of TrinoAccessModelRepository, persist the permission data to disk, and finally return the instance object of Java class ExternalSystemAccessControl.

6. A TRINO-based permission control dynamic update device, characterized in that: The TRINO-based authority control dynamic update device includes: The first definition module is used to define a Java class TrinoAccessModel for carrying Trino's permission data in the main module of the Trino source code and to define the string type, and to encapsulate the read and write operations of the defined Java class TrinoAccessModel; The second definition module is used to define the Java class ExternalSystemAccessControl in the trino-plugin-toolkit module of the Trino source code, implement the permission control method in the interface SystemAccessControl, and modify the configure method and the constructor AccessControlManager in the main module; The modification module is used to modify the Java class ServerInfoResource in the Trino source code in the main module, and add an HTTP interface for saving permission data in ServerInfoResource; The execution module is used to package the adjusted main module and trino-plugin-toolkit module to replace the corresponding jar files in the Trino server, and restart the trino application to apply the configured permission control policy; The Java class TrinoAccessModel for carrying Trino's permission data is defined in the main module of the Trino source code and a string type is defined, and the read and write operations of the defined Java class TrinoAccessModel are encapsulated, specifically: In the main module of the Trino source code, define the Java class TrinoAccessModel for carrying Trino's permission data; In the Java class TrinoAccessModel, define the access permission field of string type, the catalog name field of string type, the schema name field of string type, the table name field of string type, and the user name field of string type; Write the Java class TrinoAccessModelRepository in the main module of the Trino source code to encapsulate the read and write operations of the defined Java class TrinoAccessModel; Among them, the Java class ExternalSystemAccessControl is defined in the trino-plugin-toolkit module of the Trino source code, the permission control method in the interface SystemAccessControl is implemented, and the configure method and the construction method AccessControlManager are modified in the main module, specifically: In the trino-plugin-toolkit module of the Trino source code, define the Java class ExternalSystemAccessControl and implement the permission control method in the interface SystemAccessControl; In the main module of the Trino source code, modify the configure method of the Java class AccessControlModule in the Trino source code, complete the configuration binding and initialization of the Java class TrinoAccessModel in the configure method, and configure the TrinoAccessModelRepository object into ExternalSystemAccessControl; In the main module of the Trino source code, modify the constructor AccessControlManager of the Java class in the Trino source code, and add the factory object Factory of ExternalSystemAccessControl to the member variable SystemAccessControlFactories of AccessControlManager in the constructor; The Java class ServerInfoResource in the Trino source code is modified in the main module, and an HTTP interface for saving permission data is added to ServerInfoResource, specifically: In the main module of the Trino source code, modify the Java class ServerInfoResource in the Trino source code; Add an HTTP interface for saving permission data in the Java class ServerInfoResource. The input parameters of the HTTP interface include a TrinoAccessModel object of a collection type and a permission update type of a string type. The permission update type of the string type includes full synchronization of permission data, addition of permission data, and deletion of permission data. Read the permission control policy in the permission configuration file, and when the permission control policy is configured as external, if the synchronization mark in the input parameter is full synchronization of permission data, call the permission synchronization method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data addition, call the add permission method of the Java class TrinoAccessModelRepository; if the synchronization mark in the input parameter is permission data deletion, call the delete permission method of the Java class TrinoAccessModelRepository; Call the method of refreshing permission data to disk of the Java class TrinoAccessModelRepository to persist the permission data to disk.

7. A TRINO-based permission control dynamic update device, characterized in that: The TRINO-based permission control dynamic update device includes a processor, a memory, and a TRINO-based permission control dynamic update program stored in the memory and executable by the processor, wherein when the TRINO-based permission control dynamic update program is executed by the processor, the steps of the TRINO-based permission control dynamic update method as described in any one of claims 1 to 5 are implemented.

Images